Merge lp:~ntt-pf-lab/nova/ipv6-support into lp:~hudson-openstack/nova/trunk

[Hisaharu Ishii]

OpenStack Compute (Nova) IPv4/IPv6 dual stack support
http://wiki.openstack.org/BexarIpv6supportReadme

Tested with
 unit test
 smoke test

No conflict with current branch r 557.
Fixed comment by Soren

[Soren Hansen (soren)]

Please find my comments inline.

Please note that ipv6 is still a bit of a mystery to me, so I'll review
structure and style moreso than technical correctness.

2011/1/5 Nachi Ueno <email address hidden>:
> Nachi Ueno has proposed merging lp:~ntt-pf-lab/nova/ipv6-support into lp:nova.
>
> Requested reviews:
>  Nova Core (nova-core)
>
> For more details, see:
> https://code.launchpad.net/~ntt-pf-lab/nova/ipv6-support/+merge/45228
>
> OpenStack Compute (Nova) IPv4/IPv6 dual stack support
> http://wiki.openstack.org/BexarIpv6supportReadme
>
> Tested with
>  unit test
>  smoke test
>
> No conflict with current branch r 515.
> --
> https://code.launchpad.net/~ntt-pf-lab/nova/ipv6-support/+merge/45228
> You are subscribed to branch lp:nova.
>
> === modified file 'bin/nova-manage'
> --- bin/nova-manage     2010-12-28 20:11:41 +0000
> +++ bin/nova-manage     2011-01-05 11:56:16 +0000
> @@ -89,7 +89,7 @@
>  flags.DECLARE('network_size', 'nova.network.manager')
>  flags.DECLARE('vlan_start', 'nova.network.manager')
>  flags.DECLARE('vpn_start', 'nova.network.manager')
> -
> +flags.DECLARE('fixed_range_v6', 'nova.network.manager')
>
>  class VpnCommands(object):
>     """Class for managing VPNs."""
> @@ -432,11 +432,11 @@
>     """Class for managing networks."""
>
>     def create(self, fixed_range=None, num_networks=None,
> -               network_size=None, vlan_start=None, vpn_start=None):
> +               network_size=None, vlan_start=None, vpn_start=None,fixed_range_v6=None):

This line is too long. Nova is pep8 clean. You can install the pep8
utility and check for yourself.

>         """Creates fixed ips for host by range
>         arguments: [fixed_range=FLAG], [num_networks=FLAG],
>                    [network_size=FLAG], [vlan_start=FLAG],
> -                   [vpn_start=FLAG]"""
> +                   [vpn_start=FLAG],[fixed_range_v6=FLAG]"""

Missing a space (for consistency).

>         if not fixed_range:
>             fixed_range = FLAGS.fixed_range
>         if not num_networks:
> @@ -447,11 +447,15 @@
>             vlan_start = FLAGS.vlan_start
>         if not vpn_start:
>             vpn_start = FLAGS.vpn_start
> +        if not fixed_range_v6:
> +            fixed_range_v6 = FLAGS.fixed_range_v6
>         net_manager = utils.import_object(FLAGS.network_manager)
>         net_manager.create_networks(context.get_admin_context(),
>                                     fixed_range, int(num_networks),
>                                     int(network_size), int(vlan_start),
> -                                    int(vpn_start))
> +                                    int(vpn_start),fixed_range_v6)
> +
> +

Same here. Please add a space (pep8 will tell you this, too).

> === modified file 'nova/api/ec2/cloud.py'
> --- nova/api/ec2/cloud.py       2011-01-03 19:29:39 +0000
> +++ nova/api/ec2/cloud.py       2011-01-05 11:56:16 +0000
> @@ -30,7 +30,7 @@
>
>  from nova import context
>  import IPy
> -
> +import urllib
>  from nova import crypto
>  from nova import db
>  from nova import exception
> @@ -347,6 +347,7 @@
>             values['group_id'] = source_security_group['id']
>         elif cidr_ip:
>             # If this fails, it throws an...

[Soren Hansen (soren)]

review: Needs Fixing

[Devin Carlen (devcamcar)]

It looks like we are essentially providing our own IPV6 version of boto with this patch, which is a bit scary. If we aren't able to use the official libraries (boto, etc.) for IPV6, then maybe we shouldn't be trying to do this with the EC2 API? Forgive me if this has already been discussed by the community, but I think it's a fair question.

review: Needs Information

[Nachi Ueno (nati-ueno)]

>Devin Carlen
Thank you for your comment.
We extended DescribeInstance. However we will revert DescribeInstance,and We will add DescribeInstanceV6 today.
Users,who don't need to see v6 address in a DescribeInstance response,can use standard boto libraries with no side effect in current version.
(Users can use EC2 API and DescribeInstanceV6 API)

We continue to support IPv6 version of boto.
As you can see, we created boto_v6 by extending boto classes.
So the code is really simple :).

[Soren Hansen (soren)]

I'm getting a number of failures when I run the test suite.

======================================================================
ERROR: test_associate_disassociate_address (nova.tests.test_cloud.CloudTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/soren/src/openstack/nova/nova/nova/tests/test_cloud.py", line 112, in test_associate_disassociate_address
    public_ip=address)
  File "/home/soren/src/openstack/nova/nova/nova/api/ec2/cloud.py", line 758, in associate_address
    self.compute_api.associate_floating_ip(context, instance_id, public_ip)
  File "/home/soren/src/openstack/nova/nova/nova/compute/api.py", line 501, in associate_floating_ip
    instance['fixed_ip'])
  File "/home/soren/src/openstack/nova/nova/nova/network/api.py", line 70, in associate_floating_ip
    host = fixed_ip['network']['host']
  File "/home/soren/src/openstack/nova/nova/nova/db/sqlalchemy/models.py", line 74, in __getitem__
    return getattr(self, key)
  File "/usr/lib/python2.6/dist-packages/sqlalchemy/orm/attributes.py", line 163, in __get__
    instance_dict(instance))
  File "/usr/lib/python2.6/dist-packages/sqlalchemy/orm/attributes.py", line 382, in get
    value = callable_(passive=passive)
  File "/usr/lib/python2.6/dist-packages/sqlalchemy/orm/strategies.py", line 578, in __call__
    (mapperutil.state_str(state), self.key)
DetachedInstanceError: Parent instance <FixedIp at 0x5a13e90> is not bound to a Session; lazy load operation of attribute 'network' cannot proceed

======================================================================
ERROR: test_private_ipv6 (nova.tests.test_network.NetworkTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/soren/src/openstack/nova/nova/nova/tests/test_network.py", line 108, in test_private_ipv6
    instance_ref['id'])
  File "/home/soren/src/openstack/nova/nova/nova/db/api.py", line 361, in instance_get_fixed_address_v6
    return IMPL.instance_get_fixed_address_v6(context, instance_id)
  File "/home/soren/src/openstack/nova/nova/nova/db/sqlalchemy/api.py", line 107, in wrapper
    return f(*args, **kwargs)
  File "/home/soren/src/openstack/nova/nova/nova/db/sqlalchemy/api.py", line 810, in instance_get_fixed_address_v6
    network_ref = network_get_by_instance(context, instance_id)
  File "/home/soren/src/openstack/nova/nova/nova/db/sqlalchemy/api.py", line 95, in wrapper
    raise exception.NotAuthorized()
NotAuthorized: None

======================================================================
ERROR: test_static_filters (nova.tests.test_virt.IptablesFirewallTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/soren/src/openstack/nova/nova/nova/tests/test_virt.py", line 306, in test_static_filters
    out_rules = self.fw.modify_rules(self.in_rules)
TypeError: modify_rules() takes exactly 3 arguments (2 given)

======================================================================
FAIL: test_describe_instances (nova.tests.test_cloud.CloudTestCase)
---------------------------...

review: Needs Fixing

[Nachi Ueno (nati-ueno)]

Thank you.
We fixed some bug.

export TEST=1
nova/contrib/nova.sh run

~~~~
----------------------------------------------------------------------
Ran 277 tests in 501.898s

OK

[Vish Ishaya (vishvananda)]

Tests all pass for me. It looks like we need a dependency on python-netaddr and radvd for packaging. It should probably also be added to the pip requires:

=== modified file 'tools/pip-requires'
--- tools/pip-requires 2010-12-28 00:10:26 +0000
+++ tools/pip-requires 2011-01-13 20:39:01 +0000
@@ -25,3 +25,4 @@
 Twisted>=10.1.0
 PasteDeploy
 paste
+netaddr

It appears we will need a new/updated version of Iptables Security Groups for this, but I think that can be put in as a bug and fixed later.

I don't think the following code will work:

383 + if(FLAGS.use_ipv6):
384 + _execute('sudo bash -c ' +
385 + '"echo 1 > /proc/sys/net/ipv6/conf/all/forwarding"')
386 + _execute('sudo bash -c ' +
387 + '"echo 0 > /proc/sys/net/ipv6/conf/all/accept_ra"')

we don't want to give add bash to sudo commands for nova user, so I think we're going to have to depend on admins to set this up in advance or do it in packaging. Perhaps move it to nova.sh for now?

Aside from that the branch looks very clean and well put together. I'm happy to approve after the above changes.

review: Needs Fixing

[lp:~ntt-pf-lab/nova/ipv6-support]

492. By Nachi Ueno on 2011-01-13

Added netaddr for pip-requires

493. By Nachi Ueno on 2011-01-13

Moved commands which needs sudo to nova.sh

494. By Nachi Ueno on 2011-01-13

Merged with r561

[Vish Ishaya (vishvananda)]

lgtm

review: Approve

[lp:~ntt-pf-lab/nova/ipv6-support]

495. By Hisaharu Ishii on 2011-01-14

Merged with r562

496. By Hisaharu Ishii on 2011-01-14

sort Authors

497. By Koji Iida on 2011-01-14

Merged to rev.563

Unmerged revisions

=== modified file 'Authors'
--- Authors	2011-01-12 19:39:25 +0000
+++ Authors	2011-01-13 21:53:11 +0000
@@ -45,3 +45,7 @@
 Vishvananda Ishaya <[e-mail]>
 Youcef Laribi <[e-mail]>
 Zhixue Wu <[e-mail]>
+Hisaharu Ishii <[e-mail]>
+Koji Iida <[e-mail]>
+Nachi Ueno <[e-mail]> <[e-mail]> <[e-mail]> <nova@u4>
+

=== modified file 'bin/nova-manage'
--- bin/nova-manage	2011-01-12 20:12:08 +0000
+++ bin/nova-manage	2011-01-13 21:53:11 +0000
@@ -91,6 +91,7 @@
 flags.DECLARE('network_size', 'nova.network.manager')
 flags.DECLARE('vlan_start', 'nova.network.manager')
 flags.DECLARE('vpn_start', 'nova.network.manager')
+flags.DECLARE('fixed_range_v6', 'nova.network.manager')
 
 
 class VpnCommands(object):
@@ -439,11 +440,12 @@
     """Class for managing networks."""
 
     def create(self, fixed_range=None, num_networks=None,
-               network_size=None, vlan_start=None, vpn_start=None):
+               network_size=None, vlan_start=None, vpn_start=None,
+               fixed_range_v6=None):
         """Creates fixed ips for host by range
         arguments: [fixed_range=FLAG], [num_networks=FLAG],
                    [network_size=FLAG], [vlan_start=FLAG],
-                   [vpn_start=FLAG]"""
+                   [vpn_start=FLAG], [fixed_range_v6=FLAG]"""
         if not fixed_range:
             fixed_range = FLAGS.fixed_range
         if not num_networks:
@@ -454,11 +456,13 @@
             vlan_start = FLAGS.vlan_start
         if not vpn_start:
             vpn_start = FLAGS.vpn_start
+        if not fixed_range_v6:
+            fixed_range_v6 = FLAGS.fixed_range_v6
         net_manager = utils.import_object(FLAGS.network_manager)
         net_manager.create_networks(context.get_admin_context(),
                                     fixed_range, int(num_networks),
                                     int(network_size), int(vlan_start),
-                                    int(vpn_start))
+                                    int(vpn_start), fixed_range_v6)
 
 
 class ServiceCommands(object):

=== added directory 'contrib/boto_v6'
=== added file 'contrib/boto_v6/__init__.py'
--- contrib/boto_v6/__init__.py	1970-01-01 00:00:00 +0000
+++ contrib/boto_v6/__init__.py	2011-01-13 21:53:11 +0000
@@ -0,0 +1,37 @@
+# Copyright (c) 2006-2010 Mitch Garnaat http://garnaat.org/
+# Copyright (c) 2010, Eucalyptus Systems, Inc.
+# All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the
+# "Software"), to deal in the Software without restriction, including
+# without limitation the rights to use, copy, modify, merge, publish, dis-
+# tribute, sublicense, and/or sell copies of the Software, and to permit
+# persons to whom the Software is furnished to do so, subject to the fol-
+# lowing conditions:
+#
+# The above copyright notice and this permission notice shall be included
+# in all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+# OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABIL-
+# ITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+# SHALL THE AUTHOR BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+# WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+# IN THE SOFTWARE.
+
+
+def connect_ec2(aws_access_key_id=None, aws_secret_access_key=None, **kwargs):
+    """
+    :type aws_access_key_id: string
+    :param aws_access_key_id: Your AWS Access Key ID
+
+    :type aws_secret_access_key: string
+    :param aws_secret_access_key: Your AWS Secret Access Key
+
+    :rtype: :class:`boto.ec2.connection.EC2Connection`
+    :return: A connection to Amazon's EC2
+    """
+    from boto_v6.ec2.connection import EC2ConnectionV6
+    return EC2ConnectionV6(aws_access_key_id, aws_secret_access_key, **kwargs)

=== added directory 'contrib/boto_v6/ec2'
=== added file 'contrib/boto_v6/ec2/__init__.py'
=== added file 'contrib/boto_v6/ec2/connection.py'
--- contrib/boto_v6/ec2/connection.py	1970-01-01 00:00:00 +0000
+++ contrib/boto_v6/ec2/connection.py	2011-01-13 21:53:11 +0000
@@ -0,0 +1,41 @@
+'''
+Created on 2010/12/20
+
+@author: Nachi Ueno <[e-mail]>
+'''
+import boto
+import boto.ec2
+from boto_v6.ec2.instance import  ReservationV6
+
+
+class EC2ConnectionV6(boto.ec2.EC2Connection):
+    '''
+    EC2Connection for OpenStack IPV6 mode
+    '''
+    def get_all_instances(self, instance_ids=None, filters=None):
+        """
+        Retrieve all the instances associated with your account.
+
+        :type instance_ids: list
+        :param instance_ids: A list of strings of instance IDs
+
+        :type filters: dict
+        :param filters: Optional filters that can be used to limit
+                        the results returned.  Filters are provided
+                        in the form of a dictionary consisting of
+                        filter names as the key and filter values
+                        as the value.  The set of allowable filter
+                        names/values is dependent on the request
+                        being performed.  Check the EC2 API guide
+                        for details.
+
+        :rtype: list
+        :return: A list of  :class:`boto.ec2.instance.Reservation`
+        """
+        params = {}
+        if instance_ids:
+            self.build_list_params(params, instance_ids, 'InstanceId')
+        if filters:
+            self.build_filter_params(params, filters)
+        return self.get_list('DescribeInstancesV6', params,
+                             [('item', ReservationV6)])

=== added file 'contrib/boto_v6/ec2/instance.py'
--- contrib/boto_v6/ec2/instance.py	1970-01-01 00:00:00 +0000
+++ contrib/boto_v6/ec2/instance.py	2011-01-13 21:53:11 +0000
@@ -0,0 +1,37 @@
+'''
+Created on 2010/12/20
+
+@author: Nachi Ueno <[e-mail]>
+'''
+import boto
+from boto.resultset import ResultSet
+from boto.ec2.instance import Reservation
+from boto.ec2.instance import Group
+from boto.ec2.instance import Instance
+
+
+class ReservationV6(Reservation):
+    def startElement(self, name, attrs, connection):
+        if name == 'instancesSet':
+            self.instances = ResultSet([('item', InstanceV6)])
+            return self.instances
+        elif name == 'groupSet':
+            self.groups = ResultSet([('item', Group)])
+            return self.groups
+        else:
+            return None
+
+
+class InstanceV6(Instance):
+    def __init__(self, connection=None):
+        Instance.__init__(self, connection)
+        self.dns_name_v6 = None
+
+    def endElement(self, name, value, connection):
+        Instance.endElement(self, name, value, connection)
+        if name == 'dnsNameV6':
+            self.dns_name_v6 = value
+
+    def _update(self, updated):
+        self.__dict__.update(updated.__dict__)
+        self.dns_name_v6 = updated.dns_name_v6

=== modified file 'contrib/nova.sh'
--- contrib/nova.sh	2010-12-30 00:07:41 +0000
+++ contrib/nova.sh	2011-01-13 21:53:11 +0000
@@ -86,6 +86,13 @@
     sudo apt-get install -y python-twisted python-sqlalchemy python-mox python-greenlet python-carrot
     sudo apt-get install -y python-daemon python-eventlet python-gflags python-tornado python-ipy
     sudo apt-get install -y python-libvirt python-libxml2 python-routes
+#For IPV6
+    sudo apt-get install -y python-netaddr 
+    sudo apt-get install -y radvd
+#(Nati) Note that this configuration is only needed for nova-network node.
+    sudo bash -c "echo 1 > /proc/sys/net/ipv6/conf/all/forwarding"
+    sudo bash -c "echo 0 > /proc/sys/net/ipv6/conf/all/accept_ra"
+    
     if [ "$USE_MYSQL" == 1 ]; then
         cat <<MYSQL_PRESEED | debconf-set-selections
 mysql-server-5.1 mysql-server/root_password password $MYSQL_PASS
@@ -107,6 +114,8 @@
 
 if [ "$CMD" == "run" ]; then
     killall dnsmasq
+    #For IPv6
+    killall radvd
     screen -d -m -S nova -t nova
     sleep 1
     if [ "$USE_MYSQL" == 1 ]; then

=== modified file 'nova/api/ec2/cloud.py'
--- nova/api/ec2/cloud.py	2011-01-13 18:24:06 +0000
+++ nova/api/ec2/cloud.py	2011-01-13 21:53:11 +0000
@@ -26,9 +26,11 @@
 import datetime
 import IPy
 import os
+import urllib
 
 from nova import compute
 from nova import context
+
 from nova import crypto
 from nova import db
 from nova import exception
@@ -374,6 +376,7 @@
             values['group_id'] = source_security_group['id']
         elif cidr_ip:
             # If this fails, it throws an exception. This is what we want.
+            cidr_ip = urllib.unquote(cidr_ip).decode()
             IPy.IP(cidr_ip)
             values['cidr'] = cidr_ip
         else:
@@ -643,6 +646,10 @@
     def describe_instances(self, context, **kwargs):
         return self._format_describe_instances(context, **kwargs)
 
+    def describe_instances_v6(self, context, **kwargs):
+        kwargs['use_v6'] = True
+        return self._format_describe_instances(context, **kwargs)
+
     def _format_describe_instances(self, context, **kwargs):
         return {'reservationSet': self._format_instances(context, **kwargs)}
 
@@ -678,10 +685,16 @@
                 if instance['fixed_ip']['floating_ips']:
                     fixed = instance['fixed_ip']
                     floating_addr = fixed['floating_ips'][0]['address']
+                if instance['fixed_ip']['network'] and 'use_v6' in kwargs:
+                    i['dnsNameV6'] = utils.to_global_ipv6(
+                        instance['fixed_ip']['network']['cidr_v6'],
+                        instance['mac_address'])
+
             i['privateDnsName'] = fixed_addr
             i['publicDnsName'] = floating_addr
             i['dnsName'] = i['publicDnsName'] or i['privateDnsName']
             i['keyName'] = instance['key_name']
+
             if context.user.is_admin():
                 i['keyName'] = '%s (%s, %s)' % (i['keyName'],
                     instance['project_id'],

=== modified file 'nova/db/api.py'
--- nova/db/api.py	2011-01-12 23:03:08 +0000
+++ nova/db/api.py	2011-01-13 21:53:11 +0000
@@ -299,6 +299,10 @@
     return IMPL.fixed_ip_get_instance(context, address)
 
 
+def fixed_ip_get_instance_v6(context, address):
+    return IMPL.fixed_ip_get_instance_v6(context, address)
+
+
 def fixed_ip_get_network(context, address):
     """Get a network for a fixed ip by address."""
     return IMPL.fixed_ip_get_network(context, address)
@@ -357,6 +361,10 @@
     return IMPL.instance_get_fixed_address(context, instance_id)
 
 
+def instance_get_fixed_address_v6(context, instance_id):
+    return IMPL.instance_get_fixed_address_v6(context, instance_id)
+
+
 def instance_get_floating_address(context, instance_id):
     """Get the first floating ip address of an instance."""
     return IMPL.instance_get_floating_address(context, instance_id)
@@ -552,6 +560,10 @@
     return IMPL.project_get_network(context, project_id)
 
 
+def project_get_network_v6(context, project_id):
+    return IMPL.project_get_network_v6(context, project_id)
+
+
 ###################
 
 

=== modified file 'nova/db/sqlalchemy/api.py'
--- nova/db/sqlalchemy/api.py	2011-01-12 22:24:16 +0000
+++ nova/db/sqlalchemy/api.py	2011-01-13 21:53:11 +0000
@@ -606,6 +606,17 @@
     return fixed_ip_ref.instance
 
 
+@require_context
+def fixed_ip_get_instance_v6(context, address):
+    session = get_session()
+    mac = utils.to_mac(address)
+
+    result = session.query(models.Instance
+                   ).filter_by(mac_address=mac
+                   ).first()
+    return result
+
+
 @require_admin_context
 def fixed_ip_get_network(context, address):
     fixed_ip_ref = fixed_ip_get_by_address(context, address)
@@ -794,6 +805,17 @@
 
 
 @require_context
+def instance_get_fixed_address_v6(context, instance_id):
+    session = get_session()
+    with session.begin():
+        instance_ref = instance_get(context, instance_id, session=session)
+        network_ref = network_get_by_instance(context, instance_id)
+        prefix = network_ref.cidr_v6
+        mac = instance_ref.mac_address
+        return utils.to_global_ipv6(prefix, mac)
+
+
+@require_context
 def instance_get_floating_address(context, instance_id):
     session = get_session()
     with session.begin():
@@ -1130,6 +1152,11 @@
     return result
 
 
+@require_context
+def project_get_network_v6(context, project_id):
+    return project_get_network(context, project_id)
+
+
 ###################
 
 

=== modified file 'nova/db/sqlalchemy/models.py'
--- nova/db/sqlalchemy/models.py	2011-01-12 23:03:08 +0000
+++ nova/db/sqlalchemy/models.py	2011-01-13 21:53:11 +0000
@@ -411,6 +411,10 @@
 
     injected = Column(Boolean, default=False)
     cidr = Column(String(255), unique=True)
+    cidr_v6 = Column(String(255), unique=True)
+
+    ra_server = Column(String(255))
+
     netmask = Column(String(255))
     bridge = Column(String(255))
     gateway = Column(String(255))

=== modified file 'nova/network/linux_net.py'
--- nova/network/linux_net.py	2011-01-11 05:49:46 +0000
+++ nova/network/linux_net.py	2011-01-13 21:53:11 +0000
@@ -50,6 +50,7 @@
                     'Public IP of network host')
 flags.DEFINE_bool('use_nova_chains', False,
                   'use the nova_ routing chains instead of default')
+
 flags.DEFINE_string('dns_server', None,
                     'if set, uses specific dns server for dnsmasq')
 flags.DEFINE_string('dmz_cidr', '10.128.0.0/24',
@@ -196,6 +197,10 @@
                  net_attrs['gateway'],
                  net_attrs['broadcast'],
                  net_attrs['netmask']))
+        if(FLAGS.use_ipv6):
+            _execute("sudo ifconfig %s add %s up" % \
+                     (bridge,
+                      net_attrs['cidr_v6']))
     else:
         _execute("sudo ifconfig %s up" % bridge)
     if FLAGS.use_nova_chains:
@@ -262,6 +267,50 @@
     _execute(command, addl_env=env)
 
 
+def update_ra(context, network_id):
+    network_ref = db.network_get(context, network_id)
+
+    conffile = _ra_file(network_ref['bridge'], 'conf')
+    with open(conffile, 'w') as f:
+        conf_str = """
+interface %s
+{
+   AdvSendAdvert on;
+   MinRtrAdvInterval 3;
+   MaxRtrAdvInterval 10;
+   prefix %s
+   {
+        AdvOnLink on;
+        AdvAutonomous on;
+   };
+};
+""" % (network_ref['bridge'], network_ref['cidr_v6'])
+        f.write(conf_str)
+
+    # Make sure radvd can actually read it (it setuid()s to "nobody")
+    os.chmod(conffile, 0644)
+
+    pid = _ra_pid_for(network_ref['bridge'])
+
+    # if radvd is already running, then tell it to reload
+    if pid:
+        out, _err = _execute('cat /proc/%d/cmdline'
+                             % pid, check_exit_code=False)
+        if conffile in out:
+            try:
+                _execute('sudo kill -HUP %d' % pid)
+                return
+            except Exception as exc:  # pylint: disable-msg=W0703
+                LOG.debug(_("Hupping radvd threw %s"), exc)
+        else:
+            LOG.debug(_("Pid %d is stale, relaunching radvd"), pid)
+    command = _ra_cmd(network_ref)
+    _execute(command)
+    db.network_update(context, network_id,
+                      {"ra_server":
+                       utils.get_my_linklocal(network_ref['bridge'])})
+
+
 def _host_dhcp(fixed_ip_ref):
     """Return a host string for an address"""
     instance_ref = fixed_ip_ref['instance']
@@ -323,6 +372,15 @@
     return ''.join(cmd)
 
 
+def _ra_cmd(net):
+    """Builds radvd command"""
+    cmd = ['sudo -E radvd',
+#           ' -u nobody',
+           ' -C %s' % _ra_file(net['bridge'], 'conf'),
+           ' -p %s' % _ra_file(net['bridge'], 'pid')]
+    return ''.join(cmd)
+
+
 def _stop_dnsmasq(network):
     """Stops the dnsmasq instance for a given network"""
     pid = _dnsmasq_pid_for(network)
@@ -344,6 +402,16 @@
                                               kind))
 
 
+def _ra_file(bridge, kind):
+    """Return path to a pid or conf file for a bridge"""
+
+    if not os.path.exists(FLAGS.networks_path):
+        os.makedirs(FLAGS.networks_path)
+    return os.path.abspath("%s/nova-ra-%s.%s" % (FLAGS.networks_path,
+                                              bridge,
+                                              kind))
+
+
 def _dnsmasq_pid_for(bridge):
     """Returns the pid for prior dnsmasq instance for a bridge
 
@@ -357,3 +425,18 @@
     if os.path.exists(pid_file):
         with open(pid_file, 'r') as f:
             return int(f.read())
+
+
+def _ra_pid_for(bridge):
+    """Returns the pid for prior radvd instance for a bridge
+
+    Returns None if no pid file exists
+
+    If machine has rebooted pid might be incorrect (caller should check)
+    """
+
+    pid_file = _ra_file(bridge, 'pid')
+
+    if os.path.exists(pid_file):
+        with open(pid_file, 'r') as f:
+            return int(f.read())

=== modified file 'nova/network/manager.py'
--- nova/network/manager.py	2011-01-10 02:08:54 +0000
+++ nova/network/manager.py	2011-01-13 21:53:11 +0000
@@ -82,6 +82,7 @@
 flags.DEFINE_string('floating_range', '4.4.4.0/24',
                     'Floating IP address block')
 flags.DEFINE_string('fixed_range', '10.0.0.0/8', 'Fixed IP address block')
+flags.DEFINE_string('fixed_range_v6', 'fd00::/48', 'Fixed IPv6 address block')
 flags.DEFINE_integer('cnt_vpn_clients', 5,
                      'Number of addresses reserved for vpn clients')
 flags.DEFINE_string('network_driver', 'nova.network.linux_net',
@@ -90,6 +91,9 @@
                   'Whether to update dhcp when fixed_ip is disassociated')
 flags.DEFINE_integer('fixed_ip_disassociate_timeout', 600,
                      'Seconds after which a deallocated ip is disassociated')
+
+flags.DEFINE_bool('use_ipv6', True,
+                  'use the ipv6')
 flags.DEFINE_string('network_host', socket.gethostname(),
                     'Network host to use for ip allocation in flat modes')
 flags.DEFINE_bool('fake_call', False,
@@ -235,7 +239,7 @@
         """Get the network host for the current context."""
         raise NotImplementedError()
 
-    def create_networks(self, context, num_networks, network_size,
+    def create_networks(self, context, num_networks, network_size, cidr_v6,
                         *args, **kwargs):
         """Create networks based on parameters."""
         raise NotImplementedError()
@@ -321,9 +325,11 @@
         pass
 
     def create_networks(self, context, cidr, num_networks, network_size,
-                        *args, **kwargs):
+                        cidr_v6, *args, **kwargs):
         """Create networks based on parameters."""
         fixed_net = IPy.IP(cidr)
+        fixed_net_v6 = IPy.IP(cidr_v6)
+        significant_bits_v6 = 64
         for index in range(num_networks):
             start = index * network_size
             significant_bits = 32 - int(math.log(network_size, 2))
@@ -336,7 +342,13 @@
             net['gateway'] = str(project_net[1])
             net['broadcast'] = str(project_net.broadcast())
             net['dhcp_start'] = str(project_net[2])
+
+            if(FLAGS.use_ipv6):
+                cidr_v6 = "%s/%s" % (fixed_net_v6[0], significant_bits_v6)
+                net['cidr_v6'] = cidr_v6
+
             network_ref = self.db.network_create_safe(context, net)
+
             if network_ref:
                 self._create_fixed_ips(context, network_ref['id'])
 
@@ -482,12 +494,16 @@
                                        network_ref['bridge'])
 
     def create_networks(self, context, cidr, num_networks, network_size,
-                        vlan_start, vpn_start):
+                        vlan_start, vpn_start, cidr_v6):
         """Create networks based on parameters."""
         fixed_net = IPy.IP(cidr)
+        fixed_net_v6 = IPy.IP(cidr_v6)
+        network_size_v6 = 1 << 64
+        significant_bits_v6 = 64
         for index in range(num_networks):
             vlan = vlan_start + index
             start = index * network_size
+            start_v6 = index * network_size_v6
             significant_bits = 32 - int(math.log(network_size, 2))
             cidr = "%s/%s" % (fixed_net[start], significant_bits)
             project_net = IPy.IP(cidr)
@@ -500,6 +516,13 @@
             net['dhcp_start'] = str(project_net[3])
             net['vlan'] = vlan
             net['bridge'] = 'br%s' % vlan
+            if(FLAGS.use_ipv6):
+                cidr_v6 = "%s/%s" % (
+                                     fixed_net_v6[start_v6],
+                                     significant_bits_v6
+                                     )
+                net['cidr_v6'] = cidr_v6
+
             # NOTE(vish): This makes ports unique accross the cloud, a more
             #             robust solution would be to make them unique per ip
             net['vpn_public_port'] = vpn_start + index
@@ -538,6 +561,7 @@
         self.driver.ensure_vlan_bridge(network_ref['vlan'],
                                        network_ref['bridge'],
                                        network_ref)
+
         # NOTE(vish): only ensure this forward if the address hasn't been set
         #             manually.
         if address == FLAGS.vpn_ip:
@@ -546,6 +570,8 @@
                                             network_ref['vpn_private_address'])
         if not FLAGS.fake_network:
             self.driver.update_dhcp(context, network_id)
+            if(FLAGS.use_ipv6):
+                self.driver.update_ra(context, network_id)
 
     @property
     def _bottom_reserved_ips(self):

=== modified file 'nova/test.py'
--- nova/test.py	2010-12-17 01:05:54 +0000
+++ nova/test.py	2011-01-13 21:53:11 +0000
@@ -156,7 +156,8 @@
                                                           FLAGS.fixed_range,
                                                           5, 16,
                                                           FLAGS.vlan_start,
-                                                          FLAGS.vpn_start)
+                                                          FLAGS.vpn_start,
+                                                          FLAGS.fixed_range_v6)
 
         # emulate some of the mox stuff, we can't use the metaclass
         # because it screws with our generators

=== modified file 'nova/tests/test_api.py'
--- nova/tests/test_api.py	2010-12-17 01:05:54 +0000
+++ nova/tests/test_api.py	2011-01-13 21:53:11 +0000
@@ -265,6 +265,72 @@
 
         return
 
+    def test_authorize_revoke_security_group_cidr_v6(self):
+        """
+        Test that we can add and remove CIDR based rules
+        to a security group for IPv6
+        """
+        self.expect_http()
+        self.mox.ReplayAll()
+        user = self.manager.create_user('fake', 'fake', 'fake')
+        project = self.manager.create_project('fake', 'fake', 'fake')
+
+        # At the moment, you need both of these to actually be netadmin
+        self.manager.add_role('fake', 'netadmin')
+        project.add_role('fake', 'netadmin')
+
+        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
+                                      for x in range(random.randint(4, 8)))
+
+        group = self.ec2.create_security_group(security_group_name,
+                                               'test group')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        group.authorize('tcp', 80, 81, '::/0')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        rv = self.ec2.get_all_security_groups()
+        # I don't bother checkng that we actually find it here,
+        # because the create/delete unit test further up should
+        # be good enough for that.
+        for group in rv:
+            if group.name == security_group_name:
+                self.assertEquals(len(group.rules), 1)
+                self.assertEquals(int(group.rules[0].from_port), 80)
+                self.assertEquals(int(group.rules[0].to_port), 81)
+                self.assertEquals(len(group.rules[0].grants), 1)
+                self.assertEquals(str(group.rules[0].grants[0]), '::/0')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        group.revoke('tcp', 80, 81, '::/0')
+
+        self.expect_http()
+        self.mox.ReplayAll()
+
+        self.ec2.delete_security_group(security_group_name)
+
+        self.expect_http()
+        self.mox.ReplayAll()
+        group.connection = self.ec2
+
+        rv = self.ec2.get_all_security_groups()
+
+        self.assertEqual(len(rv), 1)
+        self.assertEqual(rv[0].name, 'default')
+
+        self.manager.delete_project(project)
+        self.manager.delete_user(user)
+
+        return
+
     def test_authorize_revoke_security_group_foreign_group(self):
         """
         Test that we can grant and revoke another security group access

=== modified file 'nova/tests/test_network.py'
--- nova/tests/test_network.py	2011-01-04 05:23:35 +0000
+++ nova/tests/test_network.py	2011-01-13 21:53:11 +0000
@@ -96,6 +96,28 @@
         self.context.project_id = self.projects[project_num].id
         self.network.deallocate_fixed_ip(self.context, address)
 
+    def test_private_ipv6(self):
+        """Make sure ipv6 is OK"""
+        if FLAGS.use_ipv6:
+            instance_ref = self._create_instance(0)
+            address = self._create_address(0, instance_ref['id'])
+            network_ref = db.project_get_network(
+                                                 context.get_admin_context(),
+                                                 self.context.project_id)
+            address_v6 = db.instance_get_fixed_address_v6(
+                                                 context.get_admin_context(),
+                                                 instance_ref['id'])
+            self.assertEqual(instance_ref['mac_address'],
+                             utils.to_mac(address_v6))
+            instance_ref2 = db.fixed_ip_get_instance_v6(
+                                                 context.get_admin_context(),
+                                                 address_v6)
+            self.assertEqual(instance_ref['id'], instance_ref2['id'])
+            self.assertEqual(address_v6,
+                             utils.to_global_ipv6(
+                                                 network_ref['cidr_v6'],
+                                                 instance_ref['mac_address']))
+
     def test_public_network_association(self):
         """Makes sure that we can allocaate a public ip"""
         # TODO(vish): better way of adding floating ips

=== modified file 'nova/utils.py'
--- nova/utils.py	2011-01-12 01:32:12 +0000
+++ nova/utils.py	2011-01-13 21:53:11 +0000
@@ -30,6 +30,8 @@
 import sys
 import time
 from xml.sax import saxutils
+import re
+import netaddr
 
 from eventlet import event
 from eventlet import greenthread
@@ -200,6 +202,40 @@
     return int(address.split(".")[-1])
 
 
+def  get_my_linklocal(interface):
+    try:
+        if_str = execute("ip -f inet6 -o addr show %s" % interface)
+        condition = "\s+inet6\s+([0-9a-f:]+/\d+)\s+scope\s+link"
+        links = [re.search(condition, x) for x in if_str[0].split('\n')]
+        address = [w.group(1) for w in links if w is not None]
+        if address[0] is not None:
+            return address[0]
+        else:
+            return 'fe00::'
+    except IndexError as ex:
+        LOG.warn(_("Couldn't get Link Local IP of %s :%s"), interface, ex)
+    except ProcessExecutionError as ex:
+        LOG.warn(_("Couldn't get Link Local IP of %s :%s"), interface, ex)
+    except:
+        return 'fe00::'
+
+
+def to_global_ipv6(prefix, mac):
+    mac64 = netaddr.EUI(mac).eui64().words
+    int_addr = int(''.join(['%02x' % i for i in mac64]), 16)
+    mac64_addr = netaddr.IPAddress(int_addr)
+    maskIP = netaddr.IPNetwork(prefix).ip
+    return (mac64_addr ^ netaddr.IPAddress('::0200:0:0:0') | maskIP).format()
+
+
+def to_mac(ipv6_address):
+    address = netaddr.IPAddress(ipv6_address)
+    mask1 = netaddr.IPAddress("::ffff:ffff:ffff:ffff")
+    mask2 = netaddr.IPAddress("::0200:0:0:0")
+    mac64 = netaddr.EUI(int(address & mask1 ^ mask2)).words
+    return ":".join(["%02x" % i for i in mac64[0:3] + mac64[5:8]])
+
+
 def utcnow():
     """Overridable version of datetime.datetime.utcnow."""
     if utcnow.override_time:

=== modified file 'nova/virt/libvirt.xml.template'
--- nova/virt/libvirt.xml.template	2011-01-05 00:22:47 +0000
+++ nova/virt/libvirt.xml.template	2011-01-13 21:53:11 +0000
@@ -66,6 +66,7 @@
             <filterref filter="nova-instance-${name}">
                 <parameter name="IP" value="${ip_address}" />
                 <parameter name="DHCPSERVER" value="${dhcp_server}" />
+                <parameter name="RASERVER" value="${ra_server}" />
 #if $getVar('extra_params', False)
                 ${extra_params}
 #end if

=== modified file 'nova/virt/libvirt_conn.py'
--- nova/virt/libvirt_conn.py	2011-01-13 17:08:53 +0000
+++ nova/virt/libvirt_conn.py	2011-01-13 21:53:11 +0000
@@ -127,6 +127,16 @@
     return str(net.net()), str(net.netmask())
 
 
+def _get_net_and_prefixlen(cidr):
+    net = IPy.IP(cidr)
+    return str(net.net()), str(net.prefixlen())
+
+
+def _get_ip_version(cidr):
+        net = IPy.IP(cidr)
+        return int(net.version())
+
+
 class LibvirtConnection(object):
 
     def __init__(self, read_only):
@@ -372,7 +382,6 @@
                               instance['id'],
                               power_state.NOSTATE,
                               'launching')
-
         self.nwfilter.setup_basic_filtering(instance)
         self.firewall_driver.prepare_instance_filter(instance)
         self._create_image(instance, xml)
@@ -541,12 +550,16 @@
         if network_ref['injected']:
             admin_context = context.get_admin_context()
             address = db.instance_get_fixed_address(admin_context, inst['id'])
+            ra_server = network_ref['ra_server']
+            if not ra_server:
+                ra_server = "fd00::"
             with open(FLAGS.injected_network_template) as f:
                 net = f.read() % {'address': address,
                                   'netmask': network_ref['netmask'],
                                   'gateway': network_ref['gateway'],
                                   'broadcast': network_ref['broadcast'],
-                                  'dns': network_ref['dns']}
+                                  'dns': network_ref['dns'],
+                                  'ra_server': ra_server}
         if key or net:
             if key:
                 LOG.info(_('instance %s: injecting key into image %s'),
@@ -601,13 +614,30 @@
                                                    instance['id'])
         # Assume that the gateway also acts as the dhcp server.
         dhcp_server = network['gateway']
-
+        ra_server = network['ra_server']
+        if not ra_server:
+            ra_server = 'fd00::'
         if FLAGS.allow_project_net_traffic:
-            net, mask = _get_net_and_mask(network['cidr'])
-            extra_params = ("<parameter name=\"PROJNET\" "
-                            "value=\"%s\" />\n"
-                            "<parameter name=\"PROJMASK\" "
-                            "value=\"%s\" />\n") % (net, mask)
+            if FLAGS.use_ipv6:
+                net, mask = _get_net_and_mask(network['cidr'])
+                net_v6, prefixlen_v6 = _get_net_and_prefixlen(
+                                           network['cidr_v6'])
+                extra_params = ("<parameter name=\"PROJNET\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASK\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJNETV6\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASKV6\" "
+                            "value=\"%s\" />\n") % \
+                              (net, mask, net_v6, prefixlen_v6)
+            else:
+                net, mask = _get_net_and_mask(network['cidr'])
+                extra_params = ("<parameter name=\"PROJNET\" "
+                            "value=\"%s\" />\n"
+                            "<parameter name=\"PROJMASK\" "
+                            "value=\"%s\" />\n") % \
+                              (net, mask)
         else:
             extra_params = "\n"
 
@@ -621,6 +651,7 @@
                     'mac_address': instance['mac_address'],
                     'ip_address': ip_address,
                     'dhcp_server': dhcp_server,
+                    'ra_server': ra_server,
                     'extra_params': extra_params,
                     'rescue': rescue}
         if not rescue:
@@ -882,6 +913,15 @@
                     </rule>
                   </filter>'''
 
+    def nova_ra_filter(self):
+        return '''<filter name='nova-allow-ra-server' chain='root'>
+                            <uuid>d707fa71-4fb5-4b27-9ab7-ba5ca19c8804</uuid>
+                              <rule action='accept' direction='inout'
+                                    priority='100'>
+                                <icmpv6 srcipaddr='$RASERVER'/>
+                              </rule>
+                            </filter>'''
+
     def setup_basic_filtering(self, instance):
         """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
         logging.info('called setup_basic_filtering in nwfilter')
@@ -906,13 +946,17 @@
                                                    ['no-mac-spoofing',
                                                     'no-ip-spoofing',
                                                     'no-arp-spoofing',
-                                                    'allow-dhcp-server']))
+                                                    'allow-dhcp-server'
+                                                   ]))
         self._define_filter(self.nova_base_ipv4_filter)
         self._define_filter(self.nova_base_ipv6_filter)
         self._define_filter(self.nova_dhcp_filter)
+        self._define_filter(self.nova_ra_filter)
         self._define_filter(self.nova_vpn_filter)
         if FLAGS.allow_project_net_traffic:
             self._define_filter(self.nova_project_filter)
+            if FLAGS.use_ipv6:
+                self._define_filter(self.nova_project_filter_v6)
 
         self.static_filters_configured = True
 
@@ -944,13 +988,13 @@
 
     def nova_base_ipv6_filter(self):
         retval = "<filter name='nova-base-ipv6' chain='ipv6'>"
-        for protocol in ['tcp', 'udp', 'icmp']:
+        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
             for direction, action, priority in [('out', 'accept', 399),
                                                 ('in', 'drop', 400)]:
                 retval += """<rule action='%s' direction='%s' priority='%d'>
-                               <%s-ipv6 />
+                               <%s />
                              </rule>""" % (action, direction,
-                                             priority, protocol)
+                                              priority, protocol)
         retval += '</filter>'
         return retval
 
@@ -963,10 +1007,20 @@
         retval += '</filter>'
         return retval
 
+    def nova_project_filter_v6(self):
+        retval = "<filter name='nova-project-v6' chain='ipv6'>"
+        for protocol in ['tcp-ipv6', 'udp-ipv6', 'icmpv6']:
+            retval += """<rule action='accept' direction='inout'
+                                                   priority='200'>
+                           <%s srcipaddr='$PROJNETV6'
+                               srcipmask='$PROJMASKV6' />
+                         </rule>""" % (protocol)
+        retval += '</filter>'
+        return retval
+
     def _define_filter(self, xml):
         if callable(xml):
             xml = xml()
-
         # execute in a native thread and block current greenthread until done
         tpool.execute(self._conn.nwfilterDefineXML, xml)
 
@@ -980,7 +1034,6 @@
         it makes sure the filters for the security groups as well as
         the base filter are all in place.
         """
-
         if instance['image_id'] == FLAGS.vpn_image_id:
             base_filter = 'nova-vpn'
         else:
@@ -992,11 +1045,15 @@
         instance_secgroup_filter_children = ['nova-base-ipv4',
                                              'nova-base-ipv6',
                                              'nova-allow-dhcp-server']
+        if FLAGS.use_ipv6:
+            instance_secgroup_filter_children += ['nova-allow-ra-server']
 
         ctxt = context.get_admin_context()
 
         if FLAGS.allow_project_net_traffic:
             instance_filter_children += ['nova-project']
+            if FLAGS.use_ipv6:
+                instance_filter_children += ['nova-project-v6']
 
         for security_group in db.security_group_get_by_instance(ctxt,
                                                                instance['id']):
@@ -1024,12 +1081,19 @@
         security_group = db.security_group_get(context.get_admin_context(),
                                                security_group_id)
         rule_xml = ""
+        v6protocol = {'tcp': 'tcp-ipv6', 'udp': 'udp-ipv6', 'icmp': 'icmpv6'}
         for rule in security_group.rules:
             rule_xml += "<rule action='accept' direction='in' priority='300'>"
             if rule.cidr:
-                net, mask = _get_net_and_mask(rule.cidr)
-                rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
-                            (rule.protocol, net, mask)
+                version = _get_ip_version(rule.cidr)
+                if(FLAGS.use_ipv6 and version == 6):
+                    net, prefixlen = _get_net_and_prefixlen(rule.cidr)
+                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
+                                (v6protocol[rule.protocol], net, prefixlen)
+                else:
+                    net, mask = _get_net_and_mask(rule.cidr)
+                    rule_xml += "<%s srcipaddr='%s' srcipmask='%s' " % \
+                                (rule.protocol, net, mask)
                 if rule.protocol in ['tcp', 'udp']:
                     rule_xml += "dstportstart='%s' dstportend='%s' " % \
                                 (rule.from_port, rule.to_port)
@@ -1044,8 +1108,11 @@
 
                 rule_xml += '/>\n'
             rule_xml += "</rule>\n"
-        xml = "<filter name='nova-secgroup-%s' chain='ipv4'>%s</filter>" % \
-              (security_group_id, rule_xml,)
+        xml = "<filter name='nova-secgroup-%s' " % security_group_id
+        if(FLAGS.use_ipv6):
+            xml += "chain='root'>%s</filter>" % rule_xml
+        else:
+            xml += "chain='ipv4'>%s</filter>" % rule_xml
         return xml
 
     def _instance_filter_name(self, instance):
@@ -1082,11 +1149,17 @@
     def apply_ruleset(self):
         current_filter, _ = self.execute('sudo iptables-save -t filter')
         current_lines = current_filter.split('\n')
-        new_filter = self.modify_rules(current_lines)
+        new_filter = self.modify_rules(current_lines, 4)
         self.execute('sudo iptables-restore',
                      process_input='\n'.join(new_filter))
+        if(FLAGS.use_ipv6):
+            current_filter, _ = self.execute('sudo ip6tables-save -t filter')
+            current_lines = current_filter.split('\n')
+            new_filter = self.modify_rules(current_lines, 6)
+            self.execute('sudo ip6tables-restore',
+                         process_input='\n'.join(new_filter))
 
-    def modify_rules(self, current_lines):
+    def modify_rules(self, current_lines, ip_version=4):
         ctxt = context.get_admin_context()
         # Remove any trace of nova rules.
         new_filter = filter(lambda l: 'nova-' not in l, current_lines)
@@ -1100,8 +1173,8 @@
                 if not new_filter[rules_index].startswith(':'):
                     break
 
-        our_chains = [':nova-ipv4-fallback - [0:0]']
-        our_rules = ['-A nova-ipv4-fallback -j DROP']
+        our_chains = [':nova-fallback - [0:0]']
+        our_rules = ['-A nova-fallback -j DROP']
 
         our_chains += [':nova-local - [0:0]']
         our_rules += ['-A FORWARD -j nova-local']
@@ -1112,7 +1185,10 @@
         for instance_id in self.instances:
             instance = self.instances[instance_id]
             chain_name = self._instance_chain_name(instance)
-            ip_address = self._ip_for_instance(instance)
+            if(ip_version == 4):
+                ip_address = self._ip_for_instance(instance)
+            elif(ip_version == 6):
+                ip_address = self._ip_for_instance_v6(instance)
 
             our_chains += [':%s - [0:0]' % chain_name]
 
@@ -1139,13 +1215,19 @@
 
                 our_rules += ['-A %s -j %s' % (chain_name, sg_chain_name)]
 
-            # Allow DHCP responses
-            dhcp_server = self._dhcp_server_for_instance(instance)
-            our_rules += ['-A %s -s %s -p udp --sport 67 --dport 68' %
-                                                     (chain_name, dhcp_server)]
+            if(ip_version == 4):
+                # Allow DHCP responses
+                dhcp_server = self._dhcp_server_for_instance(instance)
+                our_rules += ['-A %s -s %s -p udp --sport 67 --dport 68' %
+                                                 (chain_name, dhcp_server)]
+            elif(ip_version == 6):
+                # Allow RA responses
+                ra_server = self._ra_server_for_instance(instance)
+                our_rules += ['-A %s -s %s -p icmpv6' %
+                                                 (chain_name, ra_server)]
 
             # If nothing matches, jump to the fallback chain
-            our_rules += ['-A %s -j nova-ipv4-fallback' % (chain_name,)]
+            our_rules += ['-A %s -j nova-fallback' % (chain_name,)]
 
         # then, security group chains and rules
         for security_group_id in security_groups:
@@ -1158,15 +1240,22 @@
 
             for rule in rules:
                 logging.info('%r', rule)
-                args = ['-A', chain_name, '-p', rule.protocol]
 
-                if rule.cidr:
-                    args += ['-s', rule.cidr]
-                else:
+                if not rule.cidr:
                     # Eventually, a mechanism to grant access for security
                     # groups will turn up here. It'll use ipsets.
                     continue
 
+                version = _get_ip_version(rule.cidr)
+                if version != ip_version:
+                    continue
+
+                protocol = rule.protocol
+                if version == 6 and rule.protocol == 'icmp':
+                    protocol = 'icmpv6'
+
+                args = ['-A', chain_name, '-p', protocol, '-s', rule.cidr]
+
                 if rule.protocol in ['udp', 'tcp']:
                     if rule.from_port == rule.to_port:
                         args += ['--dport', '%s' % (rule.from_port,)]
@@ -1186,7 +1275,12 @@
                             icmp_type_arg += '/%s' % icmp_code
 
                     if icmp_type_arg:
-                        args += ['-m', 'icmp', '--icmp-type', icmp_type_arg]
+                        if(ip_version == 4):
+                            args += ['-m', 'icmp', '--icmp-type',
+                                     icmp_type_arg]
+                        elif(ip_version == 6):
+                            args += ['-m', 'icmp6', '--icmpv6-type',
+                                     icmp_type_arg]
 
                 args += ['-j ACCEPT']
                 our_rules += [' '.join(args)]
@@ -1212,7 +1306,16 @@
         return db.instance_get_fixed_address(context.get_admin_context(),
                                              instance['id'])
 
+    def _ip_for_instance_v6(self, instance):
+        return db.instance_get_fixed_address_v6(context.get_admin_context(),
+                                             instance['id'])
+
     def _dhcp_server_for_instance(self, instance):
         network = db.project_get_network(context.get_admin_context(),
                                          instance['project_id'])
         return network['gateway']
+
+    def _ra_server_for_instance(self, instance):
+        network = db.project_get_network(context.get_admin_context(),
+                                         instance['project_id'])
+        return network['ra_server']

=== modified file 'smoketests/admin_smoketests.py'
--- smoketests/admin_smoketests.py	2011-01-06 01:51:05 +0000
+++ smoketests/admin_smoketests.py	2011-01-13 21:53:11 +0000
@@ -43,7 +43,7 @@
 # TODO(devamcar): Use random tempfile
 ZIP_FILENAME = '/tmp/nova-me-x509.zip'
 
-TEST_PREFIX = 'test%s' % int(random.random()*1000000)
+TEST_PREFIX = 'test%s' % int(random.random() * 1000000)
 TEST_USERNAME = '%suser' % TEST_PREFIX
 TEST_PROJECTNAME = '%sproject' % TEST_PREFIX
 
@@ -96,4 +96,3 @@
 if __name__ == "__main__":
     suites = {'user': unittest.makeSuite(UserTests)}
     sys.exit(base.run_tests(suites))
-

=== modified file 'smoketests/base.py'
--- smoketests/base.py	2010-11-04 22:50:23 +0000
+++ smoketests/base.py	2011-01-13 21:53:11 +0000
@@ -17,6 +17,7 @@
 #    under the License.
 
 import boto
+import boto_v6
 import commands
 import httplib
 import os
@@ -69,6 +70,17 @@
                             'test.')
 
         parts = self.split_clc_url(clc_url)
+        if FLAGS.use_ipv6:
+            return boto_v6.connect_ec2(aws_access_key_id=access_key,
+                                aws_secret_access_key=secret_key,
+                                is_secure=parts['is_secure'],
+                                region=RegionInfo(None,
+                                                  'nova',
+                                                  parts['ip']),
+                                port=parts['port'],
+                                path='/services/Cloud',
+                                **kwargs)
+
         return boto.connect_ec2(aws_access_key_id=access_key,
                                 aws_secret_access_key=secret_key,
                                 is_secure=parts['is_secure'],
@@ -115,7 +127,8 @@
         return True
 
     def upload_image(self, bucket_name, image):
-        cmd = 'euca-upload-bundle -b %s -m /tmp/%s.manifest.xml' % (bucket_name, image)
+        cmd = 'euca-upload-bundle -b '
+        cmd += '%s -m /tmp/%s.manifest.xml' % (bucket_name, image)
         status, output = commands.getstatusoutput(cmd)
         if status != 0:
             print '%s -> \n %s' % (cmd, output)
@@ -130,6 +143,7 @@
             raise Exception(output)
         return True
 
+
 def run_tests(suites):
     argv = FLAGS(sys.argv)
 
@@ -151,4 +165,3 @@
     else:
         for suite in suites.itervalues():
             unittest.TextTestRunner(verbosity=2).run(suite)
-

=== modified file 'smoketests/flags.py'
--- smoketests/flags.py	2010-11-04 22:50:23 +0000
+++ smoketests/flags.py	2011-01-13 21:53:11 +0000
@@ -33,6 +33,7 @@
 # __GLOBAL FLAGS ONLY__
 # Define any app-specific flags in their own files, docs at:
 # http://code.google.com/p/python-gflags/source/browse/trunk/gflags.py#39
+
 DEFINE_string('region', 'nova', 'Region to use')
 DEFINE_string('test_image', 'ami-tiny', 'Image to use for launch tests')
-
+DEFINE_string('use_ipv6', True, 'use the ipv6 or not')

=== added file 'smoketests/public_network_smoketests.py'
--- smoketests/public_network_smoketests.py	1970-01-01 00:00:00 +0000
+++ smoketests/public_network_smoketests.py	2011-01-13 21:53:11 +0000
@@ -0,0 +1,180 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import commands
+import os
+import random
+import socket
+import sys
+import time
+import unittest
+
+from smoketests import flags
+from smoketests import base
+from smoketests import user_smoketests
+
+#Note that this test should run from
+#public network (outside of private network segments)
+#Please set EC2_URL correctly
+#You should use admin account in this test
+
+FLAGS = flags.FLAGS
+
+TEST_PREFIX = 'test%s' % int(random.random() * 1000000)
+TEST_BUCKET = '%s_bucket' % TEST_PREFIX
+TEST_KEY = '%s_key' % TEST_PREFIX
+TEST_KEY2 = '%s_key2' % TEST_PREFIX
+TEST_DATA = {}
+
+
+class InstanceTestsFromPublic(user_smoketests.UserSmokeTestCase):
+    def test_001_can_create_keypair(self):
+        key = self.create_key_pair(self.conn, TEST_KEY)
+        self.assertEqual(key.name, TEST_KEY)
+
+    def test_002_security_group(self):
+        security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
+                                      for x in range(random.randint(4, 8)))
+        group = self.conn.create_security_group(security_group_name,
+                                               'test group')
+        group.connection = self.conn
+        group.authorize('tcp', 22, 22, '0.0.0.0/0')
+        if FLAGS.use_ipv6:
+            group.authorize('tcp', 22, 22, '::/0')
+
+        reservation = self.conn.run_instances(FLAGS.test_image,
+                                        key_name=TEST_KEY,
+                                        security_groups=[security_group_name],
+                                        instance_type='m1.tiny')
+        self.data['security_group_name'] = security_group_name
+        self.data['group'] = group
+        self.data['instance_id'] = reservation.instances[0].id
+
+    def test_003_instance_with_group_runs_within_60_seconds(self):
+        reservations = self.conn.get_all_instances([self.data['instance_id']])
+        instance = reservations[0].instances[0]
+        # allow 60 seconds to exit pending with IP
+        for x in xrange(60):
+            instance.update()
+            if instance.state == u'running':
+                break
+            time.sleep(1)
+        else:
+            self.fail('instance failed to start')
+        ip = reservations[0].instances[0].private_dns_name
+        self.failIf(ip == '0.0.0.0')
+        self.data['private_ip'] = ip
+        if FLAGS.use_ipv6:
+            ipv6 = reservations[0].instances[0].dns_name_v6
+            self.failIf(ipv6 is None)
+            self.data['ip_v6'] = ipv6
+
+    def test_004_can_ssh_to_ipv6(self):
+        if FLAGS.use_ipv6:
+            for x in xrange(20):
+                try:
+                    conn = self.connect_ssh(
+                                        self.data['ip_v6'], TEST_KEY)
+                    conn.close()
+                except Exception as ex:
+                    print ex
+                    time.sleep(1)
+                else:
+                    break
+            else:
+                self.fail('could not ssh to instance')
+
+    def test_012_can_create_instance_with_keypair(self):
+        if 'instance_id' in self.data:
+            self.conn.terminate_instances([self.data['instance_id']])
+        reservation = self.conn.run_instances(FLAGS.test_image,
+                                              key_name=TEST_KEY,
+                                              instance_type='m1.tiny')
+        self.assertEqual(len(reservation.instances), 1)
+        self.data['instance_id'] = reservation.instances[0].id
+
+    def test_013_instance_runs_within_60_seconds(self):
+        reservations = self.conn.get_all_instances([self.data['instance_id']])
+        instance = reservations[0].instances[0]
+        # allow 60 seconds to exit pending with IP
+        for x in xrange(60):
+            instance.update()
+            if instance.state == u'running':
+                break
+            time.sleep(1)
+        else:
+            self.fail('instance failed to start')
+        ip = reservations[0].instances[0].private_dns_name
+        self.failIf(ip == '0.0.0.0')
+        self.data['private_ip'] = ip
+        if FLAGS.use_ipv6:
+            ipv6 = reservations[0].instances[0].dns_name_v6
+            self.failIf(ipv6 is None)
+            self.data['ip_v6'] = ipv6
+
+    def test_014_can_not_ping_private_ip(self):
+        for x in xrange(4):
+            # ping waits for 1 second
+            status, output = commands.getstatusoutput(
+                'ping -c1 %s' % self.data['private_ip'])
+            if status == 0:
+                self.fail('can ping private ip from public network')
+            if FLAGS.use_ipv6:
+                status, output = commands.getstatusoutput(
+                    'ping6 -c1 %s' % self.data['ip_v6'])
+                if status == 0:
+                    self.fail('can ping ipv6 from public network')
+        else:
+            pass
+
+    def test_015_can_not_ssh_to_private_ip(self):
+        for x in xrange(1):
+            try:
+                conn = self.connect_ssh(self.data['private_ip'], TEST_KEY)
+                conn.close()
+            except Exception:
+                time.sleep(1)
+            else:
+                self.fail('can ssh for ipv4 address from public network')
+
+        if FLAGS.use_ipv6:
+            for x in xrange(1):
+                try:
+                    conn = self.connect_ssh(
+                                        self.data['ip_v6'], TEST_KEY)
+                    conn.close()
+                except Exception:
+                    time.sleep(1)
+                else:
+                    self.fail('can ssh for ipv6 address from public network')
+
+    def test_999_tearDown(self):
+        self.delete_key_pair(self.conn, TEST_KEY)
+        security_group_name = self.data['security_group_name']
+        group = self.data['group']
+        if group:
+            group.revoke('tcp', 22, 22, '0.0.0.0/0')
+            if FLAGS.use_ipv6:
+                group.revoke('tcp', 22, 22, '::/0')
+        self.conn.delete_security_group(security_group_name)
+        if 'instance_id' in self.data:
+            self.conn.terminate_instances([self.data['instance_id']])
+
+if __name__ == "__main__":
+    suites = {'instance': unittest.makeSuite(InstanceTestsFromPublic)}
+    sys.exit(base.run_tests(suites))

=== modified file 'smoketests/user_smoketests.py'
--- smoketests/user_smoketests.py	2011-01-06 01:51:05 +0000
+++ smoketests/user_smoketests.py	2011-01-13 21:53:11 +0000
@@ -45,7 +45,7 @@
 flags.DEFINE_string('bundle_image', 'openwrt-x86-ext2.image',
               'Local image file to use for bundling tests')
 
-TEST_PREFIX = 'test%s' % int (random.random()*1000000)
+TEST_PREFIX = 'test%s' % int(random.random() * 1000000)
 TEST_BUCKET = '%s_bucket' % TEST_PREFIX
 TEST_KEY = '%s_key' % TEST_PREFIX
 TEST_GROUP = '%s_group' % TEST_PREFIX
@@ -80,7 +80,7 @@
 
     def test_006_can_register_kernel(self):
         kernel_id = self.conn.register_image('%s/%s.manifest.xml' %
-                                             (TEST_BUCKET, FLAGS.bundle_kernel))
+                                            (TEST_BUCKET, FLAGS.bundle_kernel))
         self.assert_(kernel_id is not None)
         self.data['kernel_id'] = kernel_id
 
@@ -92,7 +92,7 @@
             time.sleep(1)
         else:
             print image.state
-            self.assert_(False) # wasn't available within 10 seconds
+            self.assert_(False)  # wasn't available within 10 seconds
         self.assert_(image.type == 'machine')
 
         for i in xrange(10):
@@ -101,7 +101,7 @@
                 break
             time.sleep(1)
         else:
-            self.assert_(False) # wasn't available within 10 seconds
+            self.assert_(False)    # wasn't available within 10 seconds
         self.assert_(kernel.type == 'kernel')
 
     def test_008_can_describe_image_attribute(self):
@@ -152,14 +152,17 @@
         for x in xrange(60):
             instance.update()
             if instance.state == u'running':
-                 break
+                break
             time.sleep(1)
         else:
             self.fail('instance failed to start')
         ip = reservations[0].instances[0].private_dns_name
         self.failIf(ip == '0.0.0.0')
         self.data['private_ip'] = ip
-        print self.data['private_ip']
+        if FLAGS.use_ipv6:
+            ipv6 = reservations[0].instances[0].dns_name_v6
+            self.failIf(ipv6 is None)
+            self.data['ip_v6'] = ipv6
 
     def test_004_can_ping_private_ip(self):
         for x in xrange(120):
@@ -171,6 +174,16 @@
         else:
             self.fail('could not ping instance')
 
+        if FLAGS.use_ipv6:
+            for x in xrange(120):
+            # ping waits for 1 second
+                status, output = commands.getstatusoutput(
+                    'ping6 -c1 %s' % self.data['ip_v6'])
+                if status == 0:
+                    break
+            else:
+                self.fail('could not ping instance')
+
     def test_005_can_ssh_to_private_ip(self):
         for x in xrange(30):
             try:
@@ -183,6 +196,19 @@
         else:
             self.fail('could not ssh to instance')
 
+        if FLAGS.use_ipv6:
+            for x in xrange(30):
+                try:
+                    conn = self.connect_ssh(
+                                        self.data['ip_v6'], TEST_KEY)
+                    conn.close()
+                except Exception:
+                    time.sleep(1)
+                else:
+                    break
+            else:
+                self.fail('could not ssh to instance v6')
+
     def test_006_can_allocate_elastic_ip(self):
         result = self.conn.allocate_address()
         self.assertTrue(hasattr(result, 'public_ip'))
@@ -388,7 +414,6 @@
                 raise Exception("Timeout")
             time.sleep(1)
 
-
     def test_999_tearDown(self):
         self.conn.delete_key_pair(TEST_KEY)
         self.conn.delete_security_group(TEST_GROUP)

=== modified file 'tools/pip-requires'
--- tools/pip-requires	2010-12-28 00:10:26 +0000
+++ tools/pip-requires	2011-01-13 21:53:11 +0000
@@ -25,3 +25,4 @@
 Twisted>=10.1.0
 PasteDeploy
 paste
+netaddr