Merge lp:~vishvananda/nova/fix-network-info into lp:~hudson-openstack/nova/trunk

[Vish Ishaya]

Libvirt has some autogenerated network info that is breaking ha network.

 * pases network info from manager wherever it is needed
 * fixes libvirt tests
 * renames allow_project_net_traffic to allow_same_net_traffic
 * makes firewall driver use dhcp_server instead of gateway for dhcp exception.

[Jason Kölker (jason-koelker)]

Sweet! Too slow tr3buchet!

Just FYI, there are a couple of pep8 issues.

review: Approve

[Trey Morris (tr3buchet)]

203 + network_info = _create_network_info

looks wrong, what's going on here?

[Vish Ishaya (vishvananda)]

an nice one. I forgot some of the libvirt tests are silently skipped if libvirt isn't installed. Let me rerun on linux system.

[Vish Ishaya (vishvananda)]

Trey, fixed that issue.

[OpenStack Infra (hudson-openstack)]

There are additional revisions which have not been approved in review. Please seek review and approval of these new revisions.

[Matt Dietz (cerberus)]

Looks good

review: Approve

[Devin Carlen (devcamcar)]

lgtm

review: Approve

=== modified file 'nova/compute/manager.py'
--- nova/compute/manager.py	2011-08-09 09:54:51 +0000
+++ nova/compute/manager.py	2011-08-15 18:13:25 +0000
@@ -170,7 +170,9 @@
             elif drv_state == power_state.RUNNING:
                 # Hyper-V and VMWareAPI drivers will raise and exception
                 try:
-                    self.driver.ensure_filtering_rules_for_instance(instance)
+                    net_info = self._get_instance_nw_info(context, instance)
+                    self.driver.ensure_filtering_rules_for_instance(instance,
+                                                                    net_info)
                 except NotImplementedError:
                     LOG.warning(_('Hypervisor driver does not '
                             'support firewall rules'))
@@ -1308,7 +1310,7 @@
         # This nwfilter is necessary on the destination host.
         # In addition, this method is creating filtering rule
         # onto destination host.
-        self.driver.ensure_filtering_rules_for_instance(instance_ref)
+        self.driver.ensure_filtering_rules_for_instance(instance_ref, network_info)
 
     def live_migration(self, context, instance_id, dest):
         """Executing live migration.

=== modified file 'nova/tests/test_compute.py'
--- nova/tests/test_compute.py	2011-08-09 22:46:57 +0000
+++ nova/tests/test_compute.py	2011-08-15 18:13:25 +0000
@@ -632,7 +632,7 @@
             vid = i_ref['volumes'][i]['id']
             volmock.setup_compute_volume(c, vid).InAnyOrder('g1')
         drivermock.plug_vifs(i_ref, [])
-        drivermock.ensure_filtering_rules_for_instance(i_ref)
+        drivermock.ensure_filtering_rules_for_instance(i_ref, [])
 
         self.compute.db = dbmock
         self.compute.volume_manager = volmock
@@ -657,7 +657,7 @@
         self.mox.StubOutWithMock(compute_manager.LOG, 'info')
         compute_manager.LOG.info(_("%s has no volume."), i_ref['hostname'])
         drivermock.plug_vifs(i_ref, [])
-        drivermock.ensure_filtering_rules_for_instance(i_ref)
+        drivermock.ensure_filtering_rules_for_instance(i_ref, [])
 
         self.compute.db = dbmock
         self.compute.driver = drivermock

=== modified file 'nova/tests/test_libvirt.py'
--- nova/tests/test_libvirt.py	2011-08-14 04:17:48 +0000
+++ nova/tests/test_libvirt.py	2011-08-15 18:13:25 +0000
@@ -49,18 +49,19 @@
     if ipv6 is None:
         ipv6 = FLAGS.use_ipv6
     fake = 'fake'
-    fake_ip = '0.0.0.0/0'
-    fake_ip_2 = '0.0.0.1/0'
-    fake_ip_3 = '0.0.0.1/0'
+    fake_ip = '10.11.12.13'
+    fake_ip_2 = '0.0.0.1'
+    fake_ip_3 = '0.0.0.1'
     fake_vlan = 100
     fake_bridge_interface = 'eth0'
     network = {'bridge': fake,
                'cidr': fake_ip,
                'cidr_v6': fake_ip,
+               'gateway_v6': fake,
                'vlan': fake_vlan,
                'bridge_interface': fake_bridge_interface}
     mapping = {'mac': fake,
-               'dhcp_server': fake,
+               'dhcp_server': '10.0.0.1',
                'gateway': fake,
                'gateway6': fake,
                'ips': [{'ip': fake_ip}, {'ip': fake_ip}]}
@@ -273,15 +274,14 @@
         conn = connection.LibvirtConnection(True)
         instance_ref = db.instance_create(self.context, self.test_instance)
 
-        result = conn._prepare_xml_info(instance_ref, False)
-        self.assertFalse(result['nics'])
-
-        result = conn._prepare_xml_info(instance_ref, False,
-                                        _create_network_info())
+        result = conn._prepare_xml_info(instance_ref,
+                                        _create_network_info(),
+                                        False)
         self.assertTrue(len(result['nics']) == 1)
 
-        result = conn._prepare_xml_info(instance_ref, False,
-                                        _create_network_info(2))
+        result = conn._prepare_xml_info(instance_ref,
+                                        _create_network_info(2),
+                                        False)
         self.assertTrue(len(result['nics']) == 2)
 
     def test_xml_and_uri_no_ramdisk_no_kernel(self):
@@ -408,16 +408,16 @@
         network_info = _create_network_info(2)
         conn = connection.LibvirtConnection(True)
         instance_ref = db.instance_create(self.context, instance_data)
-        xml = conn.to_xml(instance_ref, False, network_info)
+        xml = conn.to_xml(instance_ref, network_info, False)
         tree = xml_to_tree(xml)
         interfaces = tree.findall("./devices/interface")
         self.assertEquals(len(interfaces), 2)
         parameters = interfaces[0].findall('./filterref/parameter')
         self.assertEquals(interfaces[0].get('type'), 'bridge')
         self.assertEquals(parameters[0].get('name'), 'IP')
-        self.assertEquals(parameters[0].get('value'), '0.0.0.0/0')
+        self.assertEquals(parameters[0].get('value'), '10.11.12.13')
         self.assertEquals(parameters[1].get('name'), 'DHCPSERVER')
-        self.assertEquals(parameters[1].get('value'), 'fake')
+        self.assertEquals(parameters[1].get('value'), '10.0.0.1')
 
     def _check_xml_and_container(self, instance):
         user_context = context.RequestContext(self.user_id,
@@ -431,7 +431,8 @@
         uri = conn.get_uri()
         self.assertEquals(uri, 'lxc:///')
 
-        xml = conn.to_xml(instance_ref)
+        network_info = _create_network_info()
+        xml = conn.to_xml(instance_ref, network_info)
         tree = xml_to_tree(xml)
 
         check = [
@@ -528,17 +529,20 @@
             uri = conn.get_uri()
             self.assertEquals(uri, expected_uri)
 
-            xml = conn.to_xml(instance_ref, rescue)
+            network_info = _create_network_info()
+            xml = conn.to_xml(instance_ref, network_info, rescue)
             tree = xml_to_tree(xml)
             for i, (check, expected_result) in enumerate(checks):
                 self.assertEqual(check(tree),
                                  expected_result,
-                                 '%s failed check %d' % (xml, i))
+                                 '%s != %s failed check %d' %
+                                 (check(tree), expected_result, i))
 
             for i, (check, expected_result) in enumerate(common_checks):
                 self.assertEqual(check(tree),
                                  expected_result,
-                                 '%s failed common check %d' % (xml, i))
+                                 '%s != %s failed common check %d' %
+                                 (check(tree), expected_result, i))
 
         # This test is supposed to make sure we don't
         # override a specifically set uri
@@ -623,7 +627,7 @@
             return
 
         # Preparing mocks
-        def fake_none(self):
+        def fake_none(self, *args):
             return
 
         def fake_raise(self):
@@ -640,6 +644,7 @@
 
         self.create_fake_libvirt_mock()
         instance_ref = db.instance_create(self.context, self.test_instance)
+        network_info = _create_network_info()
 
         # Start test
         self.mox.ReplayAll()
@@ -649,6 +654,7 @@
             conn.firewall_driver.setattr('prepare_instance_filter', fake_none)
             conn.firewall_driver.setattr('instance_filter_exists', fake_none)
             conn.ensure_filtering_rules_for_instance(instance_ref,
+                                                     network_info,
                                                      time=fake_timer)
         except exception.Error, e:
             c1 = (0 <= e.message.find('Timeout migrating for'))
@@ -962,8 +968,9 @@
         from nova.network import linux_net
         linux_net.iptables_manager.execute = fake_iptables_execute
 
-        self.fw.prepare_instance_filter(instance_ref)
-        self.fw.apply_instance_filter(instance_ref)
+        network_info = _create_network_info()
+        self.fw.prepare_instance_filter(instance_ref, network_info)
+        self.fw.apply_instance_filter(instance_ref, network_info)
 
         in_rules = filter(lambda l: not l.startswith('#'),
                           self.in_filter_rules)
@@ -1033,7 +1040,7 @@
         ipv6_len = len(self.fw.iptables.ipv6['filter'].rules)
         inst_ipv4, inst_ipv6 = self.fw.instance_rules(instance_ref,
                                                       network_info)
-        self.fw.add_filters_for_instance(instance_ref, network_info)
+        self.fw.prepare_instance_filter(instance_ref, network_info)
         ipv4 = self.fw.iptables.ipv4['filter'].rules
         ipv6 = self.fw.iptables.ipv6['filter'].rules
         ipv4_network_rules = len(ipv4) - len(inst_ipv4) - ipv4_len
@@ -1048,7 +1055,7 @@
         self.mox.StubOutWithMock(self.fw,
                                  'add_filters_for_instance',
                                  use_mock_anything=True)
-        self.fw.add_filters_for_instance(instance_ref, mox.IgnoreArg())
+        self.fw.prepare_instance_filter(instance_ref, mox.IgnoreArg())
         self.fw.instances[instance_ref['id']] = instance_ref
         self.mox.ReplayAll()
         self.fw.do_refresh_security_group_rules("fake")
@@ -1068,11 +1075,12 @@
         instance_ref = self._create_instance_ref()
 
         _setup_networking(instance_ref['id'], self.test_ip)
-        self.fw.setup_basic_filtering(instance_ref)
-        self.fw.prepare_instance_filter(instance_ref)
-        self.fw.apply_instance_filter(instance_ref)
+        network_info = _create_network_info()
+        self.fw.setup_basic_filtering(instance_ref, network_info)
+        self.fw.prepare_instance_filter(instance_ref, network_info)
+        self.fw.apply_instance_filter(instance_ref, network_info)
         original_filter_count = len(fakefilter.filters)
-        self.fw.unfilter_instance(instance_ref)
+        self.fw.unfilter_instance(instance_ref, network_info)
 
         # should undefine just the instance filter
         self.assertEqual(original_filter_count - len(fakefilter.filters), 1)
@@ -1082,14 +1090,14 @@
     def test_provider_firewall_rules(self):
         # setup basic instance data
         instance_ref = self._create_instance_ref()
-        nw_info = _create_network_info(1)
         _setup_networking(instance_ref['id'], self.test_ip)
         # FRAGILE: peeks at how the firewall names chains
         chain_name = 'inst-%s' % instance_ref['id']
 
         # create a firewall via setup_basic_filtering like libvirt_conn.spawn
         # should have a chain with 0 rules
-        self.fw.setup_basic_filtering(instance_ref, network_info=nw_info)
+        network_info = _create_network_info(1)
+        self.fw.setup_basic_filtering(instance_ref, network_info)
         self.assertTrue('provider' in self.fw.iptables.ipv4['filter'].chains)
         rules = [rule for rule in self.fw.iptables.ipv4['filter'].rules
                       if rule.chain == 'provider']
@@ -1119,8 +1127,8 @@
         self.assertEqual(2, len(rules))
 
         # create the instance filter and make sure it has a jump rule
-        self.fw.prepare_instance_filter(instance_ref, network_info=nw_info)
-        self.fw.apply_instance_filter(instance_ref)
+        self.fw.prepare_instance_filter(instance_ref, network_info)
+        self.fw.apply_instance_filter(instance_ref, network_info)
         inst_rules = [rule for rule in self.fw.iptables.ipv4['filter'].rules
                            if rule.chain == chain_name]
         jump_rules = [rule for rule in inst_rules if '-j' in rule.rule]
@@ -1272,7 +1280,7 @@
 
         def _ensure_all_called():
             instance_filter = 'nova-instance-%s-%s' % (instance_ref['name'],
-                                                       '561212121212')
+                                                       'fake')
             secgroup_filter = 'nova-secgroup-%s' % self.security_group['id']
             for required in [secgroup_filter, 'allow-dhcp-server',
                              'no-arp-spoofing', 'no-ip-spoofing',
@@ -1288,9 +1296,10 @@
                                        self.security_group.id)
         instance = db.instance_get(self.context, inst_id)
 
-        self.fw.setup_basic_filtering(instance)
-        self.fw.prepare_instance_filter(instance)
-        self.fw.apply_instance_filter(instance)
+        network_info = _create_network_info()
+        self.fw.setup_basic_filtering(instance, network_info)
+        self.fw.prepare_instance_filter(instance, network_info)
+        self.fw.apply_instance_filter(instance, network_info)
         _ensure_all_called()
         self.teardown_security_group()
         db.instance_destroy(context.get_admin_context(), instance_ref['id'])
@@ -1321,11 +1330,12 @@
         instance = db.instance_get(self.context, inst_id)
 
         _setup_networking(instance_ref['id'], self.test_ip)
-        self.fw.setup_basic_filtering(instance)
-        self.fw.prepare_instance_filter(instance)
-        self.fw.apply_instance_filter(instance)
+        network_info = _create_network_info()
+        self.fw.setup_basic_filtering(instance, network_info)
+        self.fw.prepare_instance_filter(instance, network_info)
+        self.fw.apply_instance_filter(instance, network_info)
         original_filter_count = len(fakefilter.filters)
-        self.fw.unfilter_instance(instance)
+        self.fw.unfilter_instance(instance, network_info)
 
         # should undefine 2 filters: instance and instance-secgroup
         self.assertEqual(original_filter_count - len(fakefilter.filters), 2)

=== modified file 'nova/virt/driver.py'
--- nova/virt/driver.py	2011-08-09 09:54:51 +0000
+++ nova/virt/driver.py	2011-08-15 18:13:25 +0000
@@ -252,7 +252,7 @@
         # TODO(Vek): Need to pass context in for access to auth_token
         pass
 
-    def ensure_filtering_rules_for_instance(self, instance_ref):
+    def ensure_filtering_rules_for_instance(self, instance_ref, network_info):
         """Setting up filtering rules and waiting for its completion.
 
         To migrate an instance, filtering rules to hypervisors

=== modified file 'nova/virt/fake.py'
--- nova/virt/fake.py	2011-08-09 22:46:57 +0000
+++ nova/virt/fake.py	2011-08-15 18:13:25 +0000
@@ -487,7 +487,7 @@
         """This method is supported only by libvirt."""
         raise NotImplementedError('This method is supported only by libvirt.')
 
-    def ensure_filtering_rules_for_instance(self, instance_ref):
+    def ensure_filtering_rules_for_instance(self, instance_ref, network_info):
         """This method is supported only by libvirt."""
         raise NotImplementedError('This method is supported only by libvirt.')
 
@@ -496,7 +496,7 @@
         """This method is supported only by libvirt."""
         return
 
-    def unfilter_instance(self, instance_ref, network_info=None):
+    def unfilter_instance(self, instance_ref, network_info):
         """This method is supported only by libvirt."""
         raise NotImplementedError('This method is supported only by libvirt.')
 

=== modified file 'nova/virt/libvirt/connection.py'
--- nova/virt/libvirt/connection.py	2011-08-11 12:34:04 +0000
+++ nova/virt/libvirt/connection.py	2011-08-15 18:13:25 +0000
@@ -32,7 +32,7 @@
 :rescue_kernel_id:  Rescue aki image (default: aki-rescue).
 :rescue_ramdisk_id:  Rescue ari image (default: ari-rescue).
 :injected_network_template:  Template file for injected network
-:allow_project_net_traffic:  Whether to allow in project network traffic
+:allow_same_net_traffic:  Whether to allow in project network traffic
 
 """
 
@@ -96,9 +96,9 @@
                     '',
                     'Override the default libvirt URI (which is dependent'
                     ' on libvirt_type)')
-flags.DEFINE_bool('allow_project_net_traffic',
+flags.DEFINE_bool('allow_same_net_traffic',
                   True,
-                  'Whether to allow in project network traffic')
+                  'Whether to allow network traffic from same network')
 flags.DEFINE_bool('use_cow_images',
                   True,
                   'Whether to use cow images')
@@ -463,18 +463,18 @@
         """
         virt_dom = self._conn.lookupByName(instance['name'])
         # NOTE(itoumsn): Use XML delived from the running instance
-        # instead of using to_xml(instance). This is almost the ultimate
-        # stupid workaround.
+        # instead of using to_xml(instance, network_info). This is almost
+        # the ultimate stupid workaround.
         xml = virt_dom.XMLDesc(0)
         # NOTE(itoumsn): self.shutdown() and wait instead of self.destroy() is
         # better because we cannot ensure flushing dirty buffers
         # in the guest OS. But, in case of KVM, shutdown() does not work...
         self.destroy(instance, network_info, cleanup=False)
         self.plug_vifs(instance, network_info)
-        self.firewall_driver.setup_basic_filtering(instance)
-        self.firewall_driver.prepare_instance_filter(instance)
+        self.firewall_driver.setup_basic_filtering(instance, network_info)
+        self.firewall_driver.prepare_instance_filter(instance, network_info)
         self._create_new_domain(xml)
-        self.firewall_driver.apply_instance_filter(instance)
+        self.firewall_driver.apply_instance_filter(instance, network_info)
 
         def _wait_for_reboot():
             """Called at an interval until the VM is running again."""
@@ -531,7 +531,7 @@
         """
         self.destroy(instance, network_info, cleanup=False)
 
-        xml = self.to_xml(instance, rescue=True)
+        xml = self.to_xml(instance, network_info, rescue=True)
         rescue_images = {'image_id': FLAGS.rescue_image_id,
                          'kernel_id': FLAGS.rescue_kernel_id,
                          'ramdisk_id': FLAGS.rescue_ramdisk_id}
@@ -574,9 +574,9 @@
     # NOTE(ilyaalekseyev): Implementation like in multinics
     # for xenapi(tr3buchet)
     @exception.wrap_exception()
-    def spawn(self, context, instance,
-              network_info=None, block_device_info=None):
-        xml = self.to_xml(instance, False, network_info=network_info,
+    def spawn(self, context, instance, network_info,
+              block_device_info=None):
+        xml = self.to_xml(instance, network_info, False,
                           block_device_info=block_device_info)
         self.firewall_driver.setup_basic_filtering(instance, network_info)
         self.firewall_driver.prepare_instance_filter(instance, network_info)
@@ -584,7 +584,7 @@
                            block_device_info=block_device_info)
         domain = self._create_new_domain(xml)
         LOG.debug(_("instance %s: is running"), instance['name'])
-        self.firewall_driver.apply_instance_filter(instance)
+        self.firewall_driver.apply_instance_filter(instance, network_info)
 
         def _wait_for_boot():
             """Called at an interval until the VM is running."""
@@ -988,14 +988,10 @@
         else:
             raise exception.InvalidDevicePath(path=device_path)
 
-    def _prepare_xml_info(self, instance, rescue=False, network_info=None,
+    def _prepare_xml_info(self, instance, network_info, rescue,
                           block_device_info=None):
         block_device_mapping = driver.block_device_info_get_mapping(
             block_device_info)
-        # TODO(adiantum) remove network_info creation code
-        # when multinics will be completed
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
 
         nics = []
         for (network, mapping) in network_info:
@@ -1082,11 +1078,11 @@
             xml_info['disk'] = xml_info['basepath'] + "/disk"
         return xml_info
 
-    def to_xml(self, instance, rescue=False, network_info=None,
+    def to_xml(self, instance, network_info, rescue=False,
                block_device_info=None):
         # TODO(termie): cache?
         LOG.debug(_('instance %s: starting toXML method'), instance['name'])
-        xml_info = self._prepare_xml_info(instance, rescue, network_info,
+        xml_info = self._prepare_xml_info(instance, network_info, rescue,
                                           block_device_info)
         xml = str(Template(self.libvirt_xml, searchList=[xml_info]))
         LOG.debug(_('instance %s: finished toXML method'), instance['name'])
@@ -1506,7 +1502,7 @@
 
         return
 
-    def ensure_filtering_rules_for_instance(self, instance_ref,
+    def ensure_filtering_rules_for_instance(self, instance_ref, network_info,
                                             time=None):
         """Setting up filtering rules and waiting for its completion.
 
@@ -1536,14 +1532,15 @@
 
         # If any instances never launch at destination host,
         # basic-filtering must be set here.
-        self.firewall_driver.setup_basic_filtering(instance_ref)
+        self.firewall_driver.setup_basic_filtering(instance_ref, network_info)
         # setting up n)ova-instance-instance-xx mainly.
-        self.firewall_driver.prepare_instance_filter(instance_ref)
+        self.firewall_driver.prepare_instance_filter(instance_ref, network_info)
 
         # wait for completion
         timeout_count = range(FLAGS.live_migration_retry_count)
         while timeout_count:
-            if self.firewall_driver.instance_filter_exists(instance_ref):
+            if self.firewall_driver.instance_filter_exists(instance_ref,
+                                                           network_info):
                 break
             timeout_count.pop()
             if len(timeout_count) == 0:

=== modified file 'nova/virt/libvirt/firewall.py'
--- nova/virt/libvirt/firewall.py	2011-07-26 21:08:29 +0000
+++ nova/virt/libvirt/firewall.py	2011-08-15 18:13:25 +0000
@@ -40,17 +40,17 @@
 
 
 class FirewallDriver(object):
-    def prepare_instance_filter(self, instance, network_info=None):
+    def prepare_instance_filter(self, instance, network_info):
         """Prepare filters for the instance.
 
         At this point, the instance isn't running yet."""
         raise NotImplementedError()
 
-    def unfilter_instance(self, instance, network_info=None):
+    def unfilter_instance(self, instance, network_info):
         """Stop filtering instance"""
         raise NotImplementedError()
 
-    def apply_instance_filter(self, instance):
+    def apply_instance_filter(self, instance, network_info):
         """Apply instance filter.
 
         Once this method returns, the instance should be firewalled
@@ -60,9 +60,7 @@
         """
         raise NotImplementedError()
 
-    def refresh_security_group_rules(self,
-                                     security_group_id,
-                                     network_info=None):
+    def refresh_security_group_rules(self, security_group_id):
         """Refresh security group rules from data store
 
         Gets called when a rule has been added to or removed from
@@ -85,7 +83,7 @@
         """
         raise NotImplementedError()
 
-    def setup_basic_filtering(self, instance, network_info=None):
+    def setup_basic_filtering(self, instance, network_info):
         """Create rules to block spoofing and allow dhcp.
 
         This gets called when spawning an instance, before
@@ -94,7 +92,7 @@
         """
         raise NotImplementedError()
 
-    def instance_filter_exists(self, instance):
+    def instance_filter_exists(self, instance, network_info):
         """Check nova-instance-instance-xxx exists"""
         raise NotImplementedError()
 
@@ -150,7 +148,7 @@
         self.static_filters_configured = False
         self.handle_security_groups = False
 
-    def apply_instance_filter(self, instance):
+    def apply_instance_filter(self, instance, network_info):
         """No-op. Everything is done in prepare_instance_filter"""
         pass
 
@@ -189,13 +187,10 @@
                               </rule>
                             </filter>'''
 
-    def setup_basic_filtering(self, instance, network_info=None):
+    def setup_basic_filtering(self, instance, network_info):
         """Set up basic filtering (MAC, IP, and ARP spoofing protection)"""
         logging.info('called setup_basic_filtering in nwfilter')
 
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
-
         if self.handle_security_groups:
             # No point in setting up a filter set that we'll be overriding
             # anyway.
@@ -237,7 +232,7 @@
         self._define_filter(self.nova_base_ipv6_filter)
         self._define_filter(self.nova_dhcp_filter)
         self._define_filter(self.nova_ra_filter)
-        if FLAGS.allow_project_net_traffic:
+        if FLAGS.allow_same_net_traffic:
             self._define_filter(self.nova_project_filter)
             if FLAGS.use_ipv6:
                 self._define_filter(self.nova_project_filter_v6)
@@ -300,10 +295,8 @@
         # execute in a native thread and block current greenthread until done
         tpool.execute(self._conn.nwfilterDefineXML, xml)
 
-    def unfilter_instance(self, instance, network_info=None):
+    def unfilter_instance(self, instance, network_info):
         """Clear out the nwfilter rules."""
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
         instance_name = instance.name
         for (network, mapping) in network_info:
             nic_id = mapping['mac'].replace(':', '')
@@ -326,16 +319,13 @@
             LOG.debug(_('The nwfilter(%(instance_secgroup_filter_name)s) '
                         'for %(instance_name)s is not found.') % locals())
 
-    def prepare_instance_filter(self, instance, network_info=None):
+    def prepare_instance_filter(self, instance, network_info):
         """Creates an NWFilter for the given instance.
 
         In the process, it makes sure the filters for the provider blocks,
         security groups, and base filter are all in place.
 
         """
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
-
         self.refresh_provider_fw_rules()
 
         ctxt = context.get_admin_context()
@@ -388,7 +378,7 @@
             instance_filter_children = [base_filter, 'nova-provider-rules',
                                         instance_secgroup_filter_name]
 
-            if FLAGS.allow_project_net_traffic:
+            if FLAGS.allow_same_net_traffic:
                 instance_filter_children.append('nova-project')
                 if FLAGS.use_ipv6:
                     instance_filter_children.append('nova-project-v6')
@@ -401,9 +391,7 @@
         self._define_filter(self._filter_container(filter_name,
                                                    filter_children))
 
-    def refresh_security_group_rules(self,
-                                     security_group_id,
-                                     network_info=None):
+    def refresh_security_group_rules(self, security_group_id):
         return self._define_filter(
                    self.security_group_to_nwfilter_xml(security_group_id))
 
@@ -500,9 +488,8 @@
             return 'nova-instance-%s' % (instance['name'])
         return 'nova-instance-%s-%s' % (instance['name'], nic_id)
 
-    def instance_filter_exists(self, instance):
+    def instance_filter_exists(self, instance, network_info):
         """Check nova-instance-instance-xxx exists"""
-        network_info = netutils.get_network_info(instance)
         for (network, mapping) in network_info:
             nic_id = mapping['mac'].replace(':', '')
             instance_filter_name = self._instance_filter_name(instance, nic_id)
@@ -521,6 +508,7 @@
         from nova.network import linux_net
         self.iptables = linux_net.iptables_manager
         self.instances = {}
+        self.network_infos = {}
         self.nwfilter = NWFilterFirewall(kwargs['get_connection'])
         self.basicly_filtered = False
 
@@ -529,22 +517,22 @@
         self.iptables.ipv6['filter'].add_chain('sg-fallback')
         self.iptables.ipv6['filter'].add_rule('sg-fallback', '-j DROP')
 
-    def setup_basic_filtering(self, instance, network_info=None):
+    def setup_basic_filtering(self, instance, network_info):
         """Set up provider rules and basic NWFilter."""
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
         self.nwfilter.setup_basic_filtering(instance, network_info)
         if not self.basicly_filtered:
             LOG.debug(_('iptables firewall: Setup Basic Filtering'))
             self.refresh_provider_fw_rules()
             self.basicly_filtered = True
 
-    def apply_instance_filter(self, instance):
+    def apply_instance_filter(self, instance, network_info):
         """No-op. Everything is done in prepare_instance_filter"""
         pass
 
-    def unfilter_instance(self, instance, network_info=None):
+    def unfilter_instance(self, instance, network_info):
         if self.instances.pop(instance['id'], None):
+            # NOTE(vish): use the passed info instead of the stored info
+            self.network_infos.pop(instance['id'])
             self.remove_filters_for_instance(instance)
             self.iptables.apply()
             self.nwfilter.unfilter_instance(instance, network_info)
@@ -552,11 +540,10 @@
             LOG.info(_('Attempted to unfilter instance %s which is not '
                      'filtered'), instance['id'])
 
-    def prepare_instance_filter(self, instance, network_info=None):
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
+    def prepare_instance_filter(self, instance, network_info):
         self.instances[instance['id']] = instance
-        self.add_filters_for_instance(instance, network_info)
+        self.network_infos[instance['id']] = network_info
+        self.add_filters_for_instance(instance)
         self.iptables.apply()
 
     def _create_filter(self, ips, chain_name):
@@ -583,7 +570,8 @@
             for rule in ipv6_rules:
                 self.iptables.ipv6['filter'].add_rule(chain_name, rule)
 
-    def add_filters_for_instance(self, instance, network_info=None):
+    def add_filters_for_instance(self, instance):
+        network_info = self.network_infos[instance['id']]
         chain_name = self._instance_chain_name(instance)
         if FLAGS.use_ipv6:
             self.iptables.ipv6['filter'].add_chain(chain_name)
@@ -601,9 +589,7 @@
         if FLAGS.use_ipv6:
             self.iptables.ipv6['filter'].remove_chain(chain_name)
 
-    def instance_rules(self, instance, network_info=None):
-        if not network_info:
-            network_info = netutils.get_network_info(instance)
+    def instance_rules(self, instance, network_info):
         ctxt = context.get_admin_context()
 
         ipv4_rules = []
@@ -621,14 +607,14 @@
         ipv4_rules += ['-j $provider']
         ipv6_rules += ['-j $provider']
 
-        dhcp_servers = [info['gateway'] for (_n, info) in network_info]
+        dhcp_servers = [info['dhcp_server'] for (_n, info) in network_info]
 
         for dhcp_server in dhcp_servers:
             ipv4_rules.append('-s %s -p udp --sport 67 --dport 68 '
                               '-j ACCEPT' % (dhcp_server,))
 
         #Allow project network traffic
-        if FLAGS.allow_project_net_traffic:
+        if FLAGS.allow_same_net_traffic:
             cidrs = [network['cidr'] for (network, _m) in network_info]
             for cidr in cidrs:
                 ipv4_rules.append('-s %s -j ACCEPT' % (cidr,))
@@ -645,7 +631,7 @@
                         '-s %s/128 -p icmpv6 -j ACCEPT' % (gateway_v6,))
 
             #Allow project network traffic
-            if FLAGS.allow_project_net_traffic:
+            if FLAGS.allow_same_net_traffic:
                 cidrv6s = [network['cidr_v6'] for (network, _m) in
                            network_info]
 
@@ -726,27 +712,23 @@
 
         return ipv4_rules, ipv6_rules
 
-    def instance_filter_exists(self, instance):
+    def instance_filter_exists(self, instance, network_info):
         """Check nova-instance-instance-xxx exists"""
-        return self.nwfilter.instance_filter_exists(instance)
+        return self.nwfilter.instance_filter_exists(instance, network_info)
 
     def refresh_security_group_members(self, security_group):
         self.do_refresh_security_group_rules(security_group)
         self.iptables.apply()
 
-    def refresh_security_group_rules(self, security_group, network_info=None):
-        self.do_refresh_security_group_rules(security_group, network_info)
+    def refresh_security_group_rules(self, security_group):
+        self.do_refresh_security_group_rules(security_group)
         self.iptables.apply()
 
     @utils.synchronized('iptables', external=True)
-    def do_refresh_security_group_rules(self,
-                                        security_group,
-                                        network_info=None):
+    def do_refresh_security_group_rules(self, security_group):
         for instance in self.instances.values():
             self.remove_filters_for_instance(instance)
-            if not network_info:
-                network_info = netutils.get_network_info(instance)
-            self.add_filters_for_instance(instance, network_info)
+            self.add_filters_for_instance(instance)
 
     def refresh_provider_fw_rules(self):
         """See class:FirewallDriver: docs."""

=== modified file 'nova/virt/libvirt/netutils.py'
--- nova/virt/libvirt/netutils.py	2011-07-27 16:52:28 +0000
+++ nova/virt/libvirt/netutils.py	2011-08-15 18:13:25 +0000
@@ -23,12 +23,7 @@
 
 import netaddr
 
-from nova import context
-from nova import db
-from nova import exception
 from nova import flags
-from nova import ipv6
-from nova import utils
 
 
 FLAGS = flags.FLAGS
@@ -47,65 +42,3 @@
 def get_ip_version(cidr):
     net = netaddr.IPNetwork(cidr)
     return int(net.version)
-
-
-def get_network_info(instance):
-    # TODO(tr3buchet): this function needs to go away! network info
-    #                  MUST be passed down from compute
-    # TODO(adiantum) If we will keep this function
-    # we should cache network_info
-    admin_context = context.get_admin_context()
-
-    try:
-        fixed_ips = db.fixed_ip_get_by_instance(admin_context, instance['id'])
-    except exception.FixedIpNotFoundForInstance:
-        fixed_ips = []
-
-    vifs = db.virtual_interface_get_by_instance(admin_context, instance['id'])
-    flavor = db.instance_type_get(admin_context,
-                                        instance['instance_type_id'])
-    network_info = []
-
-    for vif in vifs:
-        network = vif['network']
-
-        # determine which of the instance's IPs belong to this network
-        network_ips = [fixed_ip['address'] for fixed_ip in fixed_ips if
-                       fixed_ip['network_id'] == network['id']]
-
-        def ip_dict(ip):
-            return {
-                'ip': ip,
-                'netmask': network['netmask'],
-                'enabled': '1'}
-
-        def ip6_dict():
-            prefix = network['cidr_v6']
-            mac = vif['address']
-            project_id = instance['project_id']
-            return  {
-                'ip': ipv6.to_global(prefix, mac, project_id),
-                'netmask': network['netmask_v6'],
-                'enabled': '1'}
-
-        mapping = {
-            'label': network['label'],
-            'gateway': network['gateway'],
-            'broadcast': network['broadcast'],
-            'dhcp_server': network['gateway'],
-            'mac': vif['address'],
-            'rxtx_cap': flavor['rxtx_cap'],
-            'dns': [],
-            'ips': [ip_dict(ip) for ip in network_ips]}
-
-        if network['dns1']:
-            mapping['dns'].append(network['dns1'])
-        if network['dns2']:
-            mapping['dns'].append(network['dns2'])
-
-        if FLAGS.use_ipv6:
-            mapping['ip6s'] = [ip6_dict()]
-            mapping['gateway6'] = network['gateway_v6']
-
-        network_info.append((network, mapping))
-    return network_info

=== modified file 'nova/virt/libvirt/vif.py'
--- nova/virt/libvirt/vif.py	2011-08-05 14:23:48 +0000
+++ nova/virt/libvirt/vif.py	2011-08-15 18:13:25 +0000
@@ -44,7 +44,7 @@
         gateway6 = mapping.get('gateway6')
         mac_id = mapping['mac'].replace(':', '')
 
-        if FLAGS.allow_project_net_traffic:
+        if FLAGS.allow_same_net_traffic:
             template = "<parameter name=\"%s\"value=\"%s\" />\n"
             net, mask = netutils.get_net_and_mask(network['cidr'])
             values = [("PROJNET", net), ("PROJMASK", mask)]

=== modified file 'nova/virt/xenapi_conn.py'
--- nova/virt/xenapi_conn.py	2011-08-09 22:46:57 +0000
+++ nova/virt/xenapi_conn.py	2011-08-15 18:13:25 +0000
@@ -309,7 +309,7 @@
         """This method is supported only by libvirt."""
         raise NotImplementedError('This method is supported only by libvirt.')
 
-    def ensure_filtering_rules_for_instance(self, instance_ref):
+    def ensure_filtering_rules_for_instance(self, instance_ref, network_info):
         """This method is supported only libvirt."""
         return