From 75c9d43f2f9afb0bb936900c130f2487006df525 Mon Sep 17 00:00:00 2001
From: Kelven Yang <kelven@cloud.com>
Date: Tue, 9 Aug 2011 13:31:23 -0700
Subject: [PATCH 01/77] Seperate template cleanup control to enable template
 preloading

---
 .../src/com/cloud/configuration/Config.java   |  1 +
 .../com/cloud/storage/StorageManagerImpl.java | 60 +++++++++++--------
 setup/db/db/schema-229to2210.sql              |  1 +
 3 files changed, 36 insertions(+), 26 deletions(-)

diff --git a/server/src/com/cloud/configuration/Config.java b/server/src/com/cloud/configuration/Config.java
index b1bcaa9a0d1..67fae82f481 100755
--- a/server/src/com/cloud/configuration/Config.java
+++ b/server/src/com/cloud/configuration/Config.java
@@ -55,6 +55,7 @@ public enum Config {
 	MaxVolumeSize("Storage", ManagementServer.class, Integer.class, "storage.max.volume.size", "2000", "The maximum size for a volume (in GB).", null),
 	TotalRetries("Storage", AgentManager.class, Integer.class, "total.retries", "4", "The number of times each command sent to a host should be retried in case of failure.", null),
 	StoragePoolMaxWaitSeconds("Storage", ManagementServer.class, Integer.class, "storage.pool.max.waitseconds", "3600", "Timeout (in seconds) to synchronize storage pool operations.", null),
+	StorageTemplateCleanupEnabled("Storage", ManagementServer.class, Boolean.class, "storage.template.cleanup.enabled", "true", "Enable/disable template cleanup activity, only take effect when overall storage cleanup is enabled", null),
 	
 	// Network
 	NetworkLBHaproxyStatsVisbility("Network", ManagementServer.class, String.class, "network.loadbalancer.haproxy.stats.visibility", "global", "Load Balancer(haproxy) stats visibilty, it can be global,guest-network,disabled", null),
diff --git a/server/src/com/cloud/storage/StorageManagerImpl.java b/server/src/com/cloud/storage/StorageManagerImpl.java
index dd434c20d7c..ab86e63be37 100755
--- a/server/src/com/cloud/storage/StorageManagerImpl.java
+++ b/server/src/com/cloud/storage/StorageManagerImpl.java
@@ -295,6 +295,7 @@ public class StorageManagerImpl implements StorageManager, StorageService, Manag
 
     ScheduledExecutorService _executor = null;
     boolean _storageCleanupEnabled;
+    boolean _templateCleanupEnabled = true;
     int _storageCleanupInterval;
     int _storagePoolAcquisitionWaitSeconds = 1800; // 30 minutes
     protected int _retry = 2;
@@ -809,9 +810,14 @@ public class StorageManagerImpl implements StorageManager, StorageService, Manag
 
         String storageCleanupEnabled = configs.get("storage.cleanup.enabled");
         _storageCleanupEnabled = (storageCleanupEnabled == null) ? true : Boolean.parseBoolean(storageCleanupEnabled);
-
+        
+        String value = configDao.getValue(Config.StorageTemplateCleanupEnabled.key());
+    	_templateCleanupEnabled = (value == null ? true : Boolean.parseBoolean(value));
+        
         String time = configs.get("storage.cleanup.interval");
         _storageCleanupInterval = NumbersUtil.parseInt(time, 86400);
+        
+        s_logger.info("Storage cleanup enabled: " + _storageCleanupEnabled + ", interval: " + _storageCleanupInterval + ", template cleanup enabled: " + _templateCleanupEnabled);
 
         String workers = configs.get("expunge.workers");
         int wrks = NumbersUtil.parseInt(workers, 10);
@@ -1913,31 +1919,33 @@ public class StorageManagerImpl implements StorageManager, StorageService, Manag
             if (scanLock.lock(3)) {
                 try {
                     // Cleanup primary storage pools
-                    List<StoragePoolVO> storagePools = _storagePoolDao.listAll();
-                    for (StoragePoolVO pool : storagePools) {
-                        try {
-
-                            List<VMTemplateStoragePoolVO> unusedTemplatesInPool = _tmpltMgr.getUnusedTemplatesInPool(pool);
-                            s_logger.debug("Storage pool garbage collector found " + unusedTemplatesInPool.size() + " templates to clean up in storage pool: " + pool.getName());
-                            for (VMTemplateStoragePoolVO templatePoolVO : unusedTemplatesInPool) {
-                                if (templatePoolVO.getDownloadState() != VMTemplateStorageResourceAssoc.Status.DOWNLOADED) {
-                                    s_logger.debug("Storage pool garbage collector is skipping templatePoolVO with ID: " + templatePoolVO.getId() + " because it is not completely downloaded.");
-                                    continue;
-                                }
-
-                                if (!templatePoolVO.getMarkedForGC()) {
-                                    templatePoolVO.setMarkedForGC(true);
-                                    _vmTemplatePoolDao.update(templatePoolVO.getId(), templatePoolVO);
-                                    s_logger.debug("Storage pool garbage collector has marked templatePoolVO with ID: " + templatePoolVO.getId() + " for garbage collection.");
-                                    continue;
-                                }
-
-                                _tmpltMgr.evictTemplateFromStoragePool(templatePoolVO);
-                            }
-                        } catch (Exception e) {
-                            s_logger.warn("Problem cleaning up primary storage pool " + pool, e);
-                        }
-                    }
+                	if(_templateCleanupEnabled) {
+	                    List<StoragePoolVO> storagePools = _storagePoolDao.listAll();
+	                    for (StoragePoolVO pool : storagePools) {
+	                        try {
+	
+	                            List<VMTemplateStoragePoolVO> unusedTemplatesInPool = _tmpltMgr.getUnusedTemplatesInPool(pool);
+	                            s_logger.debug("Storage pool garbage collector found " + unusedTemplatesInPool.size() + " templates to clean up in storage pool: " + pool.getName());
+	                            for (VMTemplateStoragePoolVO templatePoolVO : unusedTemplatesInPool) {
+	                                if (templatePoolVO.getDownloadState() != VMTemplateStorageResourceAssoc.Status.DOWNLOADED) {
+	                                    s_logger.debug("Storage pool garbage collector is skipping templatePoolVO with ID: " + templatePoolVO.getId() + " because it is not completely downloaded.");
+	                                    continue;
+	                                }
+	
+	                                if (!templatePoolVO.getMarkedForGC()) {
+	                                    templatePoolVO.setMarkedForGC(true);
+	                                    _vmTemplatePoolDao.update(templatePoolVO.getId(), templatePoolVO);
+	                                    s_logger.debug("Storage pool garbage collector has marked templatePoolVO with ID: " + templatePoolVO.getId() + " for garbage collection.");
+	                                    continue;
+	                                }
+	
+	                                _tmpltMgr.evictTemplateFromStoragePool(templatePoolVO);
+	                            }
+	                        } catch (Exception e) {
+	                            s_logger.warn("Problem cleaning up primary storage pool " + pool, e);
+	                        }
+	                    }
+                	}
 
                     // Cleanup secondary storage hosts
                     List<HostVO> secondaryStorageHosts = _hostDao.listSecondaryStorageHosts();
diff --git a/setup/db/db/schema-229to2210.sql b/setup/db/db/schema-229to2210.sql
index 0bfa781a99f..dffa1a3fbfc 100644
--- a/setup/db/db/schema-229to2210.sql
+++ b/setup/db/db/schema-229to2210.sql
@@ -17,3 +17,4 @@ ALTER TABLE `cloud`.`host` MODIFY `storage_ip_address` char(40);
 
 INSERT IGNORE INTO configuration VALUES ('Network', 'DEFAULT', 'management-server', 'network.redundantrouter', 'false', 'enable/disable redundant virtual router');
 INSERT IGNORE INTO configuration VALUES ('Storage', 'DEFAULT', 'management-server', 'storage.pool.max.waitseconds', '3600', 'Timeout (in seconds) to synchronize storage pool operations.');
+INSERT IGNORE INTO configuration VALUES ('Storage', 'DEFAULT', 'management-server', 'storage.template.cleanup.enabled', 'true', 'Enable/disable template cleanup activity, only take effect when overall storage cleanup is enabled');

From f558f74863ccfec3c46a389188117ca579c99790 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Tue, 9 Aug 2011 15:02:41 -0700
Subject: [PATCH 02/77] Catch domr creation exception

---
 .../VirtualNetworkApplianceManagerImpl.java     | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 5c38b04a177..283e63212d6 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -940,6 +940,11 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
             }
 
             txn.commit();
+        } catch (InsufficientCapacityException ex) {
+            s_logger.error("Fail to create the virtual router!", ex);
+            throw ex;
+        } catch (Exception ex) {
+            s_logger.error("Fail to create the virtual router due to error: " + ex.getMessage());
         } finally {
             if (network != null) {
                 _networkDao.releaseFromLockTable(network.getId());
@@ -1018,10 +1023,10 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
         assert guestNetwork.getTrafficType() == TrafficType.Guest;
 
         List<DomainRouterVO> routers = findOrCreateVirtualRouters(guestNetwork, dest, owner, isRedundant);
-        List<DomainRouterVO> runningRouters = null;
+        List<DomainRouterVO> runningRouters = new ArrayList<DomainRouterVO>();
         
-        if (routers != null) {
-            runningRouters = new ArrayList<DomainRouterVO>();
+        if (routers == null) {
+            return runningRouters;
         }
         
         for (DomainRouterVO router : routers) {
@@ -1118,7 +1123,11 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
             }
 
             txn.commit();
-
+        } catch (InsufficientCapacityException ex) {
+            s_logger.error("Fail to create the virtual router!", ex);
+            throw ex;
+        } catch (Exception ex) {
+            s_logger.error("Fail to create the virtual router due to error: " + ex.getMessage());
         } finally {
             if (network != null) {
                 _networkDao.releaseFromLockTable(network.getId());

From 2846f569238cce3be04648aa81308ee2cedaf5d4 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Tue, 9 Aug 2011 15:04:35 -0700
Subject: [PATCH 03/77] Revert "Network_domain is supported in nectarine 2.2.8,
 so adding corresponding db upgrade step to 228-229 upgrade"

This reverts commit bc43d5ba5c6b329f39b2ab89256c381e3ca677f6.

Conflicts:

	setup/db/db/schema-228to229.sql
---
 setup/db/db/schema-228to229.sql | 1 -
 1 file changed, 1 deletion(-)

diff --git a/setup/db/db/schema-228to229.sql b/setup/db/db/schema-228to229.sql
index 26cdc42e24d..248bf751825 100644
--- a/setup/db/db/schema-228to229.sql
+++ b/setup/db/db/schema-228to229.sql
@@ -76,4 +76,3 @@ CREATE TABLE `cloud`.`elastic_lb_vm_map` (
   CONSTRAINT `fk_elastic_lb_vm_map__lb_id` FOREIGN KEY `fk_elastic_lb_vm_map__lb_id` (`lb_id`) REFERENCES `load_balancing_rules` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
-

From 31153792cc8fe51fb50e482072ea3be041c3c0dd Mon Sep 17 00:00:00 2001
From: Edison Su <edison@cloud.com>
Date: Tue, 9 Aug 2011 15:31:40 -0700
Subject: [PATCH 04/77] bug 10809: add copyvolume for kvm status 10809:
 resolved fixed

---
 .../computing/LibvirtComputingResource.java   | 46 ++++++++++++++++++-
 .../computing/LibvirtStorageResource.java     | 13 ++++++
 2 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/agent/src/com/cloud/agent/resource/computing/LibvirtComputingResource.java b/agent/src/com/cloud/agent/resource/computing/LibvirtComputingResource.java
index 0c6ad49fdf9..022af07baaf 100644
--- a/agent/src/com/cloud/agent/resource/computing/LibvirtComputingResource.java
+++ b/agent/src/com/cloud/agent/resource/computing/LibvirtComputingResource.java
@@ -138,6 +138,8 @@ import com.cloud.agent.api.proxy.WatchConsoleProxyLoadCommand;
 import com.cloud.agent.api.routing.IpAssocCommand;
 import com.cloud.agent.api.routing.IpAssocAnswer;
 import com.cloud.agent.api.routing.NetworkElementCommand;
+import com.cloud.agent.api.storage.CopyVolumeAnswer;
+import com.cloud.agent.api.storage.CopyVolumeCommand;
 import com.cloud.agent.api.storage.CreateAnswer;
 import com.cloud.agent.api.storage.CreateCommand;
 import com.cloud.agent.api.storage.CreatePrivateTemplateAnswer;
@@ -894,6 +896,8 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
                return execute((NetworkRulesSystemVmCommand)cmd);
             } else if (cmd instanceof CleanupNetworkRulesCmd) {
                return execute((CleanupNetworkRulesCmd)cmd);
+            } else if (cmd instanceof CopyVolumeCommand) {
+               return execute((CopyVolumeCommand)cmd);
             } else {
         		s_logger.warn("Unsupported command ");
                 return Answer.createUnsupportedCommandAnswer(cmd);
@@ -904,7 +908,47 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
 	}
 	
 	
-	protected Answer execute(DeleteStoragePoolCommand cmd) {
+	private CopyVolumeAnswer execute(CopyVolumeCommand cmd) {
+	    boolean copyToSecondary = cmd.toSecondaryStorage();
+	    String volumePath = cmd.getVolumePath();
+	    StorageFilerTO pool = cmd.getPool();
+	    String secondaryStorageUrl = cmd.getSecondaryStorageURL();
+	    StoragePool primaryPool = null;
+	    Connect conn;
+        try {
+            conn = LibvirtConnection.getConnection();
+            primaryPool = _storageResource.getStoragePool(conn, pool.getUuid());
+            LibvirtStoragePoolDef primary = _storageResource.getStoragePoolDef(conn, primaryPool);
+            String primaryMountPath = primary.getTargetPath();
+            
+            StoragePool secondaryStoragePool = _storageResource.getStoragePoolbyURI(conn, new URI(secondaryStorageUrl));
+            LibvirtStoragePoolDef spd = _storageResource.getStoragePoolDef(conn, secondaryStoragePool);
+            String ssPmountPath = spd.getTargetPath();
+            
+            String volumeName = UUID.randomUUID().toString();
+            
+            if (copyToSecondary) {
+                StorageVol volume = _storageResource.getVolume(conn, primaryPool, volumePath);
+                String volumeDestPath = ssPmountPath + File.separator + "volumes/" + cmd.getVolumeId() + File.separator;
+                _storageResource.copyVolume(volumePath, volumeDestPath, volumeName, _cmdsTimeout);
+                return new CopyVolumeAnswer(cmd, true, null, null, volumeName);
+            } else {
+                volumePath = ssPmountPath + File.separator + "volumes/" + cmd.getVolumeId() + File.separator + volumePath;
+                _storageResource.copyVolume(volumePath, primaryMountPath, volumeName, _cmdsTimeout);
+                return new CopyVolumeAnswer(cmd, true, null, null, primaryMountPath + File.separator + volumeName);
+            }
+           
+        } catch (LibvirtException e) {
+            return new CopyVolumeAnswer(cmd, false, e.toString(), null, null);
+        } catch (URISyntaxException e) {
+            return new CopyVolumeAnswer(cmd, false, e.toString(), null, null);
+        } catch (InternalErrorException e) {
+            return new CopyVolumeAnswer(cmd, false, e.toString(), null, null);
+        }
+       
+    }
+
+    protected Answer execute(DeleteStoragePoolCommand cmd) {
 		try {
 			Connect conn = LibvirtConnection.getConnection();
 			_storageResource.deleteStoragePool(conn, cmd.getPool());
diff --git a/agent/src/com/cloud/agent/resource/computing/LibvirtStorageResource.java b/agent/src/com/cloud/agent/resource/computing/LibvirtStorageResource.java
index bdbef6d6924..4143d01548c 100644
--- a/agent/src/com/cloud/agent/resource/computing/LibvirtStorageResource.java
+++ b/agent/src/com/cloud/agent/resource/computing/LibvirtStorageResource.java
@@ -386,6 +386,19 @@ public class LibvirtStorageResource {
         return vol;
     }
     
+    public boolean copyVolume(String srcPath, String destPath, String volumeName, int timeout)  throws InternalErrorException{
+        _storageLayer.mkdirs(destPath);
+        if (!_storageLayer.exists(srcPath)) {
+            throw new InternalErrorException("volume:" + srcPath + " is not exits");
+        }
+        String result = Script.runSimpleBashScript("cp " + srcPath + " " + destPath + File.separator + volumeName, timeout);
+        if (result != null) {
+            return false;
+        } else {
+            return true;
+        }
+    }
+    
     public LibvirtStoragePoolDef getStoragePoolDef(Connect conn, StoragePool pool) throws LibvirtException {
         String poolDefXML = pool.getXMLDesc(0);
         LibvirtStoragePoolXMLParser parser = new LibvirtStoragePoolXMLParser();

From 69ca341f1b814bcd1004cf593c5906d7e0729f72 Mon Sep 17 00:00:00 2001
From: Kelven Yang <kelven@cloud.com>
Date: Tue, 9 Aug 2011 15:44:58 -0700
Subject: [PATCH 05/77] bug 11017: kick VMware vSwitch by pinging the default
 gateway to work around mysterous VMware network problem

---
 patches/systemvm/debian/config/etc/init.d/cloud-early-config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index d67215c6d02..6449f405b95 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -244,6 +244,9 @@ setup_common() {
           ip route add default via $GW dev $3
       fi
   fi
+ 
+  # a hacking way to activate vSwitch under VMware
+  ping -n -c 3 $GW
 }
 
 setup_dnsmasq() {

From 15cad8ba8e2ffae83e1bd4613ac145678af43404 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Tue, 9 Aug 2011 15:57:33 -0700
Subject: [PATCH 06/77] Revert "Catch domr creation exception"

This reverts commit 2eff1d0eb9e39e4a8d702bb9867b9e95bb276b3e.
---
 .../VirtualNetworkApplianceManagerImpl.java     | 17 ++++-------------
 1 file changed, 4 insertions(+), 13 deletions(-)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 283e63212d6..5c38b04a177 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -940,11 +940,6 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
             }
 
             txn.commit();
-        } catch (InsufficientCapacityException ex) {
-            s_logger.error("Fail to create the virtual router!", ex);
-            throw ex;
-        } catch (Exception ex) {
-            s_logger.error("Fail to create the virtual router due to error: " + ex.getMessage());
         } finally {
             if (network != null) {
                 _networkDao.releaseFromLockTable(network.getId());
@@ -1023,10 +1018,10 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
         assert guestNetwork.getTrafficType() == TrafficType.Guest;
 
         List<DomainRouterVO> routers = findOrCreateVirtualRouters(guestNetwork, dest, owner, isRedundant);
-        List<DomainRouterVO> runningRouters = new ArrayList<DomainRouterVO>();
+        List<DomainRouterVO> runningRouters = null;
         
-        if (routers == null) {
-            return runningRouters;
+        if (routers != null) {
+            runningRouters = new ArrayList<DomainRouterVO>();
         }
         
         for (DomainRouterVO router : routers) {
@@ -1123,11 +1118,7 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
             }
 
             txn.commit();
-        } catch (InsufficientCapacityException ex) {
-            s_logger.error("Fail to create the virtual router!", ex);
-            throw ex;
-        } catch (Exception ex) {
-            s_logger.error("Fail to create the virtual router due to error: " + ex.getMessage());
+
         } finally {
             if (network != null) {
                 _networkDao.releaseFromLockTable(network.getId());

From 501dc0d9f42bbdd2ca9c42d30ec602dfc24cf657 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Tue, 9 Aug 2011 18:21:28 -0700
Subject: [PATCH 07/77] bug 10640: Update redundant virtual router allocation
 algorithm

Try to put routers to two different primary storages with two hosts, not the same
host.
---
 .../network/router/VirtualNetworkApplianceManagerImpl.java | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 5c38b04a177..661cb92cf46 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -981,12 +981,13 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
         avoids[1] = new ExcludeList();
         avoids[1].addCluster(_hostDao.findById(routerToBeAvoid.getHostId()).getClusterId());
         avoids[2] = new ExcludeList();
-        avoids[2].addHost(routerToBeAvoid.getHostId());
-        avoids[3] = new ExcludeList();
         List<VolumeVO> volumes = _volumeDao.findByInstanceAndType(routerToBeAvoid.getId(), Type.ROOT);
         if (volumes != null && volumes.size() != 0) {
-            avoids[3].addPool(volumes.get(0).getPoolId());
+            avoids[2].addPool(volumes.get(0).getPoolId());
         }
+        avoids[2].addHost(routerToBeAvoid.getHostId());
+        avoids[3] = new ExcludeList();
+        avoids[3].addHost(routerToBeAvoid.getHostId());
         avoids[4] = new ExcludeList();
         
         for (int i = 0; i < retryIndex; i++) {

From bfe3fd2a8f555b6e603b7eb23e0885417ce36b9e Mon Sep 17 00:00:00 2001
From: anthony <anthony@cloud.com>
Date: Tue, 9 Aug 2011 19:58:10 -0700
Subject: [PATCH 08/77] bug 11046: fixed a typo, otherwise Other PV doesn't
 work

status 11046: resolved fixed
---
 .../com/cloud/hypervisor/xen/resource/CitrixHelper.java   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixHelper.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixHelper.java
index 570dd2c9091..99e206289c5 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixHelper.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixHelper.java
@@ -238,8 +238,8 @@ public class CitrixHelper {
         _xenServer56FP1GuestOsMap.put("Ubuntu 10.04 (32-bit)", "Ubuntu Lucid Lynx 10.04 (32-bit) (experimental)");
         _xenServer56FP1GuestOsMap.put("Ubuntu 10.04 (64-bit)", "Ubuntu Lucid Lynx 10.04 (64-bit) (experimental)");
         _xenServer56FP1GuestOsMap.put("Other install media", "Other install media");
-        _xenServer56FP1GuestOsMap.put("Other PV (32-bit)", "CentOS 5.5 (32-bit)");
-        _xenServer56FP1GuestOsMap.put("Other PV (64-bit)", "CentOS 5.5 (64-bit)");
+        _xenServer56FP1GuestOsMap.put("Other PV (32-bit)", "CentOS 5 (32-bit)");
+        _xenServer56FP1GuestOsMap.put("Other PV (64-bit)", "CentOS 5 (64-bit)");
     }
     
     
@@ -314,8 +314,8 @@ public class CitrixHelper {
         _xenServer56FP2GuestOsMap.put("Ubuntu 10.04 (32-bit)", "Ubuntu Lucid Lynx 10.04 (32-bit) (experimental)");
         _xenServer56FP2GuestOsMap.put("Ubuntu 10.04 (64-bit)", "Ubuntu Lucid Lynx 10.04 (64-bit) (experimental)");
         _xenServer56FP2GuestOsMap.put("Other install media", "Other install media");
-        _xenServer56FP2GuestOsMap.put("Other PV (32-bit)", "CentOS 5.5 (32-bit)");
-        _xenServer56FP2GuestOsMap.put("Other PV (64-bit)", "CentOS 5.5 (64-bit)");
+        _xenServer56FP2GuestOsMap.put("Other PV (32-bit)", "CentOS 5 (32-bit)");
+        _xenServer56FP2GuestOsMap.put("Other PV (64-bit)", "CentOS 5 (64-bit)");
     }
     
     

From ba2ec7e770b843d185e9dbc332ce3b2c1eed91b7 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Tue, 9 Aug 2011 21:01:09 -0700
Subject: [PATCH 09/77] Fix redundant router start up

commit e4fe14a9ce19fbbdb15bbfaad586d80031ca9fbc break redundant router, because
at time of ping, the network is not up for redundant router.

Add timout for ping
---
 patches/systemvm/debian/config/etc/init.d/cloud-early-config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index 6449f405b95..afe2ed480db 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -246,7 +246,7 @@ setup_common() {
   fi
  
   # a hacking way to activate vSwitch under VMware
-  ping -n -c 3 $GW
+  ping -n -c 3 -deadline 5 $GW
 }
 
 setup_dnsmasq() {

From 9a0a3f195c928fa10f4e1e976874a7bf268a5873 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Tue, 9 Aug 2011 21:41:56 -0700
Subject: [PATCH 10/77] Fix ping commandline parameter

---
 patches/systemvm/debian/config/etc/init.d/cloud-early-config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index afe2ed480db..8856b4a1568 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -246,7 +246,7 @@ setup_common() {
   fi
  
   # a hacking way to activate vSwitch under VMware
-  ping -n -c 3 -deadline 5 $GW
+  ping -n -c 3 -w 5 $GW
 }
 
 setup_dnsmasq() {

From 738a9b3ad0e518abfd3fe35e7989c1d36ece3454 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Tue, 9 Aug 2011 22:25:06 -0700
Subject: [PATCH 11/77] Fix "RTNETLINK answers: No such process" when starting
 redundant router

The issue happened quite rare, but indeed can show.

And when the issue happen, the status of redundant router would be "Status:
FAULT".

It's due to ipassoc.sh wasn't executed before the system bring eth2 up and go to
master mode, then eth2 wasn't configured correctly. Then "ip route add default
xx" can't complete.

This commit should fixes the issue.
---
 .../debian/config/etc/init.d/cloud-early-config       | 11 ++++++-----
 .../root/redundant_router/enable_pubip.sh.templ       |  2 --
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index 8856b4a1568..39449f585b7 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -162,7 +162,10 @@ setup_interface() {
   fi
 
   ifdown $intf
-  ifup $intf
+  if [ "$RROUTER" != "1" -o "$1" != "2" ]
+  then
+	  ifup $intf
+  fi
 }
 
 enable_fwding() {
@@ -197,7 +200,7 @@ setup_common() {
   init_interfaces $1 $2 $3
   setup_interface "0" $ETH0_IP $ETH0_MASK $GW
   setup_interface "1" $ETH1_IP $ETH1_MASK $GW
-  if [ -n "$ETH2_IP" -a "$RROUTER" != "1" ]
+  if [ -n "$ETH2_IP" ]
   then
   	setup_interface "2" $ETH2_IP $ETH2_MASK $GW
   fi
@@ -325,12 +328,10 @@ setup_router() {
   log_it "Setting up virtual router system vm"
   if [ -n "$ETH2_IP" ]
   then
+      setup_common eth0 eth1 eth2
       if [ "$RROUTER" == "1" ]
       then
-  	    setup_common eth0 eth1
         setup_redundant_router
-      else
-  	    setup_common eth0 eth1 eth2
       fi
   else
   	setup_common eth0 eth1
diff --git a/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ b/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
index 045eac7d731..93539422753 100644
--- a/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
+++ b/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
@@ -3,7 +3,5 @@
 ifconfig eth2 down && \
 ifconfig eth2 hw ether [ETH2MAC] && \
 ifconfig eth2 up && \
-sleep 3 && \
 ip route add 0/0 via [GATEWAY] && \
-sleep 3 && \
 service dnsmasq restart

From 9bba09857ed29bd9c87305096926a2bd8f6122fe Mon Sep 17 00:00:00 2001
From: Abhinandan Prateek <aprateek@cloud.com>
Date: Wed, 10 Aug 2011 13:52:42 +0530
Subject: [PATCH 12/77] bug 10561: readding source cidr changes to firewall
 rules

---
 .../commands/CreateIpForwardingRuleCmd.java   |  5 ++++
 .../cloud/network/lb/LoadBalancingRule.java   |  5 ++++
 .../com/cloud/network/rules/FirewallRule.java |  2 ++
 .../src/com/cloud/network/LoadBalancerVO.java |  2 +-
 .../network/dao/FirewallRulesDaoImpl.java     | 21 ++++++++++++++++
 .../network/firewall/FirewallManagerImpl.java | 17 +++++++++----
 .../cloud/network/rules/FirewallManager.java  |  2 +-
 .../cloud/network/rules/FirewallRuleVO.java   | 24 +++++++++++++++----
 .../network/rules/PortForwardingRuleVO.java   |  2 +-
 .../cloud/network/rules/RulesManagerImpl.java |  4 ++--
 .../network/rules/StaticNatRuleImpl.java      |  5 ++++
 11 files changed, 76 insertions(+), 13 deletions(-)

diff --git a/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java b/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
index 1b48d4ba59d..6d2ddc2ddd4 100644
--- a/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
+++ b/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
@@ -263,5 +263,10 @@ public class CreateIpForwardingRuleCmd extends BaseAsyncCreateCmd implements Sta
     public Integer getIcmpType() {
         return null;
     }
+
+    @Override
+    public List<String> getSourceCidrList() {
+        return null;
+    }
     
 }
diff --git a/api/src/com/cloud/network/lb/LoadBalancingRule.java b/api/src/com/cloud/network/lb/LoadBalancingRule.java
index 48b82a8341e..2103badfb2d 100644
--- a/api/src/com/cloud/network/lb/LoadBalancingRule.java
+++ b/api/src/com/cloud/network/lb/LoadBalancingRule.java
@@ -164,4 +164,9 @@ public class LoadBalancingRule implements FirewallRule, LoadBalancer{
     public Integer getIcmpType() {
         return null;
     }
+
+    @Override
+    public List<String> getSourceCidrList() {
+        return null;
+    }
 }
diff --git a/api/src/com/cloud/network/rules/FirewallRule.java b/api/src/com/cloud/network/rules/FirewallRule.java
index 21593aa31b9..aa08fd1cfa9 100644
--- a/api/src/com/cloud/network/rules/FirewallRule.java
+++ b/api/src/com/cloud/network/rules/FirewallRule.java
@@ -73,5 +73,7 @@ public interface FirewallRule extends ControlledEntity {
     Integer getIcmpCode();
 
     Integer getIcmpType();
+    
+    List<String> getSourceCidrList();
 
 }
diff --git a/server/src/com/cloud/network/LoadBalancerVO.java b/server/src/com/cloud/network/LoadBalancerVO.java
index 800af92af83..1f211699f71 100644
--- a/server/src/com/cloud/network/LoadBalancerVO.java
+++ b/server/src/com/cloud/network/LoadBalancerVO.java
@@ -55,7 +55,7 @@ public class LoadBalancerVO extends FirewallRuleVO implements LoadBalancer {
     }
 
     public LoadBalancerVO(String xId, String name, String description, long srcIpId, int srcPort, int dstPort, String algorithm, long networkId, long accountId, long domainId) {
-        super(xId, srcIpId, srcPort, NetUtils.TCP_PROTO, networkId, accountId, domainId, Purpose.LoadBalancing, null, null);
+        super(xId, srcIpId, srcPort, NetUtils.TCP_PROTO, networkId, accountId, domainId, Purpose.LoadBalancing, null, null, null);
         this.name = name;
         this.description = description;
         this.algorithm = algorithm;
diff --git a/server/src/com/cloud/network/dao/FirewallRulesDaoImpl.java b/server/src/com/cloud/network/dao/FirewallRulesDaoImpl.java
index 78b403b5d26..ac56fa18487 100644
--- a/server/src/com/cloud/network/dao/FirewallRulesDaoImpl.java
+++ b/server/src/com/cloud/network/dao/FirewallRulesDaoImpl.java
@@ -176,6 +176,27 @@ public class FirewallRulesDaoImpl extends GenericDaoBase<FirewallRuleVO, Long> i
         return listBy(sc);
     }
     
+    @Override @DB
+    public FirewallRuleVO persist(FirewallRuleVO firewallRule) {        
+        Transaction txn = Transaction.currentTxn();
+        txn.start();
+        
+        FirewallRuleVO dbfirewallRule = super.persist(firewallRule);
+        saveSourceCidrs(firewallRule);
+        
+        txn.commit();
+        return dbfirewallRule;
+    }
+    
+    
+    public void saveSourceCidrs(FirewallRuleVO firewallRule) {
+        List<String> cidrlist = firewallRule.getSourceCidrList();
+        if (cidrlist == null) {
+            return;
+        }
+        _firewallRulesCidrsDao.persist(firewallRule.getId(), cidrlist);
+    }
+    
     
     @Override
     public List<FirewallRuleVO> listByIpPurposeAndProtocolAndNotRevoked(long ipAddressId, Integer startPort, Integer endPort, String protocol, FirewallRule.Purpose purpose) {
diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index b9281832db7..f02a29c73ca 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -99,13 +99,13 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
     public FirewallRule createFirewallRule(FirewallRule rule) throws NetworkRuleConflictException {
         Account caller = UserContext.current().getCaller();
 
-        return createFirewallRule(rule.getSourceIpAddressId(), caller, rule.getXid(), rule.getSourcePortStart() ,rule.getSourcePortEnd(), rule.getProtocol(), rule.getIcmpCode(), rule.getIcmpType());    
+        return createFirewallRule(rule.getSourceIpAddressId(), caller, rule.getXid(), rule.getSourcePortStart() ,rule.getSourcePortEnd(), rule.getProtocol(), rule.getSourceCidrList(), rule.getIcmpCode(), rule.getIcmpType());    
     }
     
     @DB
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_FIREWALL_OPEN, eventDescription = "creating firewll rule", create = true)
-    public FirewallRule createFirewallRule(long ipAddrId, Account caller, String xId, Integer portStart,Integer portEnd, String protocol, Integer icmpCode, Integer icmpType) throws NetworkRuleConflictException{
+    public FirewallRule createFirewallRule(long ipAddrId, Account caller, String xId, Integer portStart,Integer portEnd, String protocol, List<String> sourceCidrList, Integer icmpCode, Integer icmpType) throws NetworkRuleConflictException{
         IPAddressVO ipAddress = _ipAddressDao.findById(ipAddrId);
         
         // Validate ip address
@@ -128,7 +128,7 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         Transaction txn = Transaction.currentTxn();
         txn.start();
         
-        FirewallRuleVO newRule = new FirewallRuleVO (xId, ipAddrId, portStart, portEnd, protocol.toLowerCase(), networkId, accountId, domainId, Purpose.Firewall, icmpCode, icmpType);
+        FirewallRuleVO newRule = new FirewallRuleVO (xId, ipAddrId, portStart, portEnd, protocol.toLowerCase(), networkId, accountId, domainId, Purpose.Firewall, sourceCidrList, icmpCode, icmpType);
         newRule = _firewallDao.persist(newRule);
 
         detectRulesConflict(newRule, ipAddress);
@@ -334,6 +334,12 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
             return true;
         }
         
+        for (FirewallRuleVO rule: rules){
+            // load cidrs if any
+            rule.setSourceCidrList(_firewallCidrsDao.getSourceCidrs(rule.getId()));  
+        }
+        
+
         if (caller != null) {
             _accountMgr.checkAccess(caller, rules.toArray(new FirewallRuleVO[rules.size()]));
         }
@@ -457,7 +463,10 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         if (!rules.isEmpty()) {
             return rules.get(0);
         }
-        return createFirewallRule(ipAddrId, caller, null, startPort, endPort, protocol, icmpCode, icmpType);
+        
+        List<String> oneCidr = new ArrayList<String>();
+        oneCidr.add(NetUtils.ALL_CIDRS);
+        return createFirewallRule(ipAddrId, caller, null, startPort, endPort, protocol, oneCidr, icmpCode, icmpType);
     }
     
     @Override
diff --git a/server/src/com/cloud/network/rules/FirewallManager.java b/server/src/com/cloud/network/rules/FirewallManager.java
index bac3975cd16..c7faf66b6ac 100644
--- a/server/src/com/cloud/network/rules/FirewallManager.java
+++ b/server/src/com/cloud/network/rules/FirewallManager.java
@@ -48,7 +48,7 @@ public interface FirewallManager extends FirewallService{
      */
     boolean revokeFirewallRule(long ruleId, boolean apply, Account caller, long userId);
 
-    FirewallRule createFirewallRule(long ipAddrId, Account caller, String xId, Integer portStart, Integer portEnd, String protocol, Integer icmpCode, Integer icmpType)
+    FirewallRule createFirewallRule(long ipAddrId, Account caller, String xId, Integer portStart, Integer portEnd, String protocol, List<String> sourceCidrList, Integer icmpCode, Integer icmpType)
             throws NetworkRuleConflictException;
 
     FirewallRule createRuleForAllCidrs(long ipAddrId, Account caller, Integer startPort, Integer endPort, String protocol, Integer icmpCode, Integer icmpType) throws NetworkRuleConflictException;
diff --git a/server/src/com/cloud/network/rules/FirewallRuleVO.java b/server/src/com/cloud/network/rules/FirewallRuleVO.java
index 448ca3030f2..cf73e52d75a 100644
--- a/server/src/com/cloud/network/rules/FirewallRuleVO.java
+++ b/server/src/com/cloud/network/rules/FirewallRuleVO.java
@@ -89,7 +89,22 @@ public class FirewallRuleVO implements FirewallRule {
     
     @Column(name="icmp_type")
     Integer icmpType;
-  
+    
+    // This is a delayed load value.  If the value is null,
+    // then this field has not been loaded yet.
+    // Call firewallrules dao to load it.
+    @Transient
+    List<String> sourceCidrs;
+
+
+    public void setSourceCidrList(List<String> sourceCidrs) {
+        this.sourceCidrs=sourceCidrs;
+    }
+
+    @Override
+    public List<String> getSourceCidrList() {
+        return sourceCidrs;
+    }
 
     @Override
     public long getAccountId() {
@@ -157,7 +172,7 @@ public class FirewallRuleVO implements FirewallRule {
     protected FirewallRuleVO() {
     }
     
-    public FirewallRuleVO(String xId, long ipAddressId, Integer portStart, Integer portEnd, String protocol, long networkId, long accountId, long domainId, Purpose purpose, Integer icmpCode, Integer icmpType) {
+    public FirewallRuleVO(String xId, long ipAddressId, Integer portStart, Integer portEnd, String protocol, long networkId, long accountId, long domainId, Purpose purpose, List<String> sourceCidrs, Integer icmpCode, Integer icmpType) {
         this.xId = xId;
         if (xId == null) {
             this.xId = UUID.randomUUID().toString();
@@ -173,10 +188,11 @@ public class FirewallRuleVO implements FirewallRule {
         this.state = State.Staged;
         this.icmpCode = icmpCode;
         this.icmpType = icmpType;
+        this.sourceCidrs = sourceCidrs;
     }
     
-    public FirewallRuleVO(String xId, long ipAddressId, int port, String protocol, long networkId, long accountId, long domainId, Purpose purpose, Integer icmpCode, Integer icmpType) {
-        this(xId, ipAddressId, port, port, protocol, networkId, accountId, domainId, purpose, icmpCode, icmpType);
+    public FirewallRuleVO(String xId, long ipAddressId, int port, String protocol, long networkId, long accountId, long domainId, Purpose purpose, List<String> sourceCidrs, Integer icmpCode, Integer icmpType) {
+        this(xId, ipAddressId, port, port, protocol, networkId, accountId, domainId, purpose, sourceCidrs, icmpCode, icmpType);
     }
     
     @Override
diff --git a/server/src/com/cloud/network/rules/PortForwardingRuleVO.java b/server/src/com/cloud/network/rules/PortForwardingRuleVO.java
index 3278b68304f..69d8230a307 100644
--- a/server/src/com/cloud/network/rules/PortForwardingRuleVO.java
+++ b/server/src/com/cloud/network/rules/PortForwardingRuleVO.java
@@ -53,7 +53,7 @@ public class PortForwardingRuleVO extends FirewallRuleVO implements PortForwardi
     }
 
     public PortForwardingRuleVO(String xId, long srcIpId, int srcPortStart, int srcPortEnd, Ip dstIp, int dstPortStart, int dstPortEnd, String protocol, long networkId, long accountId, long domainId, long instanceId) {
-        super(xId, srcIpId, srcPortStart, srcPortEnd, protocol, networkId, accountId, domainId, Purpose.PortForwarding, null, null);
+        super(xId, srcIpId, srcPortStart, srcPortEnd, protocol, networkId, accountId, domainId, Purpose.PortForwarding, null, null, null);
         this.destinationIpAddress = dstIp;
         this.virtualMachineId = instanceId;
         this.destinationPortStart = dstPortStart;
diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java
index f9492d60182..4afe37eb0e3 100755
--- a/server/src/com/cloud/network/rules/RulesManagerImpl.java
+++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java
@@ -265,7 +265,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         }
         
         FirewallRuleVO newRule = new FirewallRuleVO(rule.getXid(), rule.getSourceIpAddressId(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol().toLowerCase(), 
-                networkId, accountId, domainId, rule.getPurpose(), null, null);
+                networkId, accountId, domainId, rule.getPurpose(), null, null, null);
         newRule = _firewallDao.persist(newRule);
 
         try {
@@ -904,7 +904,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
                 _firewallMgr.createRuleForAllCidrs(ip.getId(), caller, ports[i], ports[i], protocol, null, null);
             }
             
-            rules[i] = new FirewallRuleVO(null, ip.getId(), ports[i], protocol, ip.getAssociatedWithNetworkId(), ip.getAllocatedToAccountId(), ip.getAllocatedInDomainId(), purpose, null, null);
+            rules[i] = new FirewallRuleVO(null, ip.getId(), ports[i], protocol, ip.getAssociatedWithNetworkId(), ip.getAllocatedToAccountId(), ip.getAllocatedInDomainId(), purpose, null, null, null);
             rules[i] = _firewallDao.persist(rules[i]);
         }
         txn.commit();
diff --git a/server/src/com/cloud/network/rules/StaticNatRuleImpl.java b/server/src/com/cloud/network/rules/StaticNatRuleImpl.java
index dec3a208a00..58e8cda4384 100644
--- a/server/src/com/cloud/network/rules/StaticNatRuleImpl.java
+++ b/server/src/com/cloud/network/rules/StaticNatRuleImpl.java
@@ -117,5 +117,10 @@ public class StaticNatRuleImpl implements StaticNatRule{
     public Integer getIcmpType() {
         return null;
     }
+
+    @Override
+    public List<String> getSourceCidrList() {
+        return null;
+    }
     
 }

From f409a9535ffac8a4c3a1821b24a4b95392eabb43 Mon Sep 17 00:00:00 2001
From: Abhinandan Prateek <aprateek@cloud.com>
Date: Wed, 10 Aug 2011 15:43:04 +0530
Subject: [PATCH 13/77] bug 10812: adding the domain serach order to option 15,
 now the dhcp client is able to set this for search entry

---
 .../config/etc/init.d/cloud-early-config      | 30 ++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index 39449f585b7..2785816331d 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -256,15 +256,28 @@ setup_dnsmasq() {
   log_it "Setting up dnsmasq"
   [ -z $DHCP_RANGE ] && DHCP_RANGE=$ETH0_IP
   [ -z $DOMAIN ] && DOMAIN="cloudnine.internal"
+  
   if [ -n "$DOMAIN" ]
   then
-    #send domain name to dhcp clients
-    sed -i s/[#]*dhcp-option=15.*$/dhcp-option=15,\"$DOMAIN\"/ /etc/dnsmasq.conf
-    #DNS server will append $DOMAIN to local queries
-    sed -r -i s/^[#]?domain=.*$/domain=$DOMAIN/ /etc/dnsmasq.conf
-    #answer all local domain queries
-    sed  -i -e "s/^[#]*local=.*$/local=\/$DOMAIN\//" /etc/dnsmasq.conf
+        #send domain name to dhcp clients
+        sed -i s/[#]*dhcp-option=15.*$/dhcp-option=15,\"$DOMAIN\"/ /etc/dnsmasq.conf
+        #DNS server will append $DOMAIN to local queries
+        sed -r -i s/^[#]?domain=.*$/domain=$DOMAIN/ /etc/dnsmasq.conf
+        #answer all local domain queries
+        sed  -i -e "s/^[#]*local=.*$/local=\/$DOMAIN\//" /etc/dnsmasq.conf
   fi
+  
+  if [ -n  "$DNS_SEARCH_ORDER" ]
+  then
+      sed -i -e "/^[#]*dhcp-option.*=119.*$/d" /etc/dnsmasq.conf
+      echo "dhcp-option-force=119,$DNS_SEARCH_ORDER" >> /etc/dnsmasq.conf
+      # set the domain search order as a space seprated list for option 15
+      DNS_SEARCH_ORDER=$(echo $DNS_SEARCH_ORDER | sed 's/,/ /g')
+      #send domain name to dhcp clients 
+      sed -i s/[#]*dhcp-option=15.*$/dhcp-option=15,\""$DNS_SEARCH_ORDER"\"/ /etc/dnsmasq.conf
+  fi
+  
+  
   sed -i -e "s/^dhcp-range=.*$/dhcp-range=$DHCP_RANGE,static/" /etc/dnsmasq.conf
   sed -i -e "s/^[#]*listen-address=.*$/listen-address=$ETH0_IP/" /etc/dnsmasq.conf
 
@@ -276,11 +289,6 @@ setup_dnsmasq() {
       echo "dhcp-option=6,$GUEST_GW" >> /etc/dnsmasq.conf
   fi
   
-  if [ -n "$DNS_SEARCH_ORDER" ]
-  then
-    sed -i -e "/^[#]*dhcp-option=119.*$/d" /etc/dnsmasq.conf
-    echo "dhcp-option=119,$DNS_SEARCH_ORDER" >> /etc/dnsmasq.conf
-  fi
   
 }
 

From a9eb14c42e7ad1d14ad920006118e7df0d218baf Mon Sep 17 00:00:00 2001
From: Naredula Janardhana Reddy <jana@cloud.com>
Date: Wed, 10 Aug 2011 17:06:06 +0530
Subject: [PATCH 14/77] bug 10561: backend added for CreateFirewallRule and
 deleteFirewallRule

---
 .../api/routing/SetFirewallRulesAnswer.java   |   5 +-
 .../api/routing/SetFirewallRulesCommand.java  |  46 ++++++
 .../cloud/agent/api/to/FirewallRuleTO.java    |  28 +++-
 .../agent/api/to/PortForwardingRuleTO.java    |   2 +-
 .../cloud/agent/api/to/StaticNatRuleTO.java   |   4 +-
 .../xen/resource/CitrixResourceBase.java      |  36 +++--
 .../debian/config/root/firewall_rule.sh       | 138 ++++++++++++++++++
 scripts/network/domr/call_firewall.sh         |  24 ++-
 8 files changed, 260 insertions(+), 23 deletions(-)
 create mode 100755 patches/systemvm/debian/config/root/firewall_rule.sh

diff --git a/api/src/com/cloud/agent/api/routing/SetFirewallRulesAnswer.java b/api/src/com/cloud/agent/api/routing/SetFirewallRulesAnswer.java
index 701b5f5aeb8..99fbe7f055f 100644
--- a/api/src/com/cloud/agent/api/routing/SetFirewallRulesAnswer.java
+++ b/api/src/com/cloud/agent/api/routing/SetFirewallRulesAnswer.java
@@ -25,9 +25,8 @@ public class SetFirewallRulesAnswer extends Answer {
     protected SetFirewallRulesAnswer() {
     }
     
-    public SetFirewallRulesAnswer(SetFirewallRulesCommand cmd, String[] results) {
-        super(cmd, true, null);
-        
+    public SetFirewallRulesAnswer(SetFirewallRulesCommand cmd, Boolean success, String[] results) {
+        super(cmd, success, null);
         assert (cmd.getRules().length == results.length) : "rules and their results should be the same length don't you think?";
         this.results = results;
     }
diff --git a/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java b/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
index 3a48e3ffd15..f5842d1bead 100644
--- a/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
+++ b/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
@@ -17,9 +17,13 @@
  */
 package com.cloud.agent.api.routing;
 
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 import com.cloud.agent.api.to.FirewallRuleTO;
+import com.cloud.agent.api.to.LoadBalancerTO;
+import com.cloud.utils.StringUtils;
 
 /**
  * SetFirewallRulesCommand is the transport for firewall rules.
@@ -40,4 +44,46 @@ public class SetFirewallRulesCommand extends NetworkElementCommand {
     public FirewallRuleTO[] getRules() {
         return rules;
     }
+
+	public String[][] generateFwRules() {
+		String [][] result = new String [2][];
+		Set<String> toAdd = new HashSet<String>();
+
+		
+		for (FirewallRuleTO fwTO: rules) {
+			if (fwTO.revoked() == true) continue;
+			
+			List<String> cidr;
+			StringBuilder sb = new StringBuilder();
+			sb.append(fwTO.getProtocol()).append(":");
+			if ("icmp".compareTo(fwTO.getProtocol()) == 0)
+			{
+				sb.append(fwTO.getIcmpType()).append(":").append(fwTO.getIcmpCode()).append(":");
+				
+			}else if (fwTO.getStringSrcPortRange() == null)
+				sb.append("0:0").append(":");
+			else
+			    sb.append(fwTO.getStringSrcPortRange()).append(":");
+			cidr = fwTO.getSourceCidrList();
+			if (cidr == null || cidr.isEmpty())
+			{
+				sb.append("0.0.0.0/0");
+			}else{
+				Boolean firstEntry = true;
+	            for (String tag : cidr) {
+	            	if (!firstEntry) sb.append("-"); 
+	        	   sb.append(tag);
+	        	   firstEntry = false;
+	            }
+			}
+			sb.append(":");
+			String fwRuleEntry = sb.toString();
+		
+			toAdd.add(fwRuleEntry);
+			
+		}
+		result[0] = toAdd.toArray(new String[toAdd.size()]);
+		
+		return result;
+	}
 }
diff --git a/api/src/com/cloud/agent/api/to/FirewallRuleTO.java b/api/src/com/cloud/agent/api/to/FirewallRuleTO.java
index 236f0562524..96e02d0afdb 100644
--- a/api/src/com/cloud/agent/api/to/FirewallRuleTO.java
+++ b/api/src/com/cloud/agent/api/to/FirewallRuleTO.java
@@ -51,12 +51,16 @@ public class FirewallRuleTO {
     int[] srcPortRange;
     boolean revoked;
     boolean alreadyAdded;
+    private List<String> sourceCidrList;
     FirewallRule.Purpose purpose;
+    private Integer icmpType;
+    private Integer icmpCode;
+    
 
     protected FirewallRuleTO() {
     }
     
-    public FirewallRuleTO(long id, String srcIp, String protocol, Integer srcPortStart, Integer srcPortEnd, boolean revoked, boolean alreadyAdded, FirewallRule.Purpose purpose) {
+    public FirewallRuleTO(long id, String srcIp, String protocol, Integer srcPortStart, Integer srcPortEnd, boolean revoked, boolean alreadyAdded, FirewallRule.Purpose purpose, List<String> sourceCidr,Integer icmpType,Integer icmpCode) {
         this.srcIp = srcIp;
         this.protocol = protocol;
         
@@ -78,10 +82,13 @@ public class FirewallRuleTO {
         this.revoked = revoked;
         this.alreadyAdded = alreadyAdded;
         this.purpose = purpose;
+        this.sourceCidrList = sourceCidr;
+        this.icmpType = icmpType;
+        this.icmpCode = icmpCode;
     }
     
     public FirewallRuleTO(FirewallRule rule, String srcIp) {
-        this(rule.getId(), srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose());
+        this(rule.getId(), srcIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(),rule.getSourceCidrList(),rule.getIcmpType(),rule.getIcmpCode());
     }
     
     public long getId() {
@@ -100,14 +107,29 @@ public class FirewallRuleTO {
         return srcPortRange;
     }
     
+    public Integer getIcmpType(){
+    	return icmpType;
+    }
+    
+    public Integer getIcmpCode(){
+    	return icmpCode;  
+    }
+    
     public String getStringSrcPortRange() {
-        return NetUtils.portRangeToString(srcPortRange);
+    	if (srcPortRange == null || srcPortRange.length < 2)
+    		return "0:0";
+    	else
+    		return NetUtils.portRangeToString(srcPortRange);
     }
 
     public boolean revoked() {
         return revoked;
     }
     
+    public List<String> getSourceCidrList() {
+        return sourceCidrList;
+    }
+    
     public boolean isAlreadyAdded() {
         return alreadyAdded;
     }
diff --git a/api/src/com/cloud/agent/api/to/PortForwardingRuleTO.java b/api/src/com/cloud/agent/api/to/PortForwardingRuleTO.java
index 9818ebb523a..4b6342b0c59 100644
--- a/api/src/com/cloud/agent/api/to/PortForwardingRuleTO.java
+++ b/api/src/com/cloud/agent/api/to/PortForwardingRuleTO.java
@@ -45,7 +45,7 @@ public class PortForwardingRuleTO extends FirewallRuleTO {
     }
     
     protected PortForwardingRuleTO(long id, String srcIp, int srcPortStart, int srcPortEnd, String dstIp, int dstPortStart, int dstPortEnd, String protocol, boolean revoked, boolean brandNew) {
-        super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.PortForwarding);
+        super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.PortForwarding, null,0,0);
         this.dstIp = dstIp;
         this.dstPortRange = new int[] { dstPortStart, dstPortEnd };
     }
diff --git a/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java b/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java
index 2c2f0dfdd1b..c0359dbb0d7 100644
--- a/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java
+++ b/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java
@@ -36,13 +36,13 @@ public class StaticNatRuleTO extends FirewallRuleTO{
     }
     
     public StaticNatRuleTO(StaticNatRule rule, String scrIp, String dstIp) {
-        super(rule.getId(), scrIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(),rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose());
+        super(rule.getId(), scrIp, rule.getProtocol(), rule.getSourcePortStart(), rule.getSourcePortEnd(),rule.getState()==State.Revoke, rule.getState()==State.Active, rule.getPurpose(), null,0,0);
         this.dstIp = dstIp;
     }
     
     
     protected StaticNatRuleTO(long id, String srcIp, int srcPortStart, int srcPortEnd, String dstIp, int dstPortStart, int dstPortEnd, String protocol, boolean revoked, boolean brandNew) {
-        super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.StaticNat);
+        super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.StaticNat, null,0,0);
         this.dstIp = dstIp;
     }
 
diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index 9cc83671b24..a715dfa7663 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -6455,16 +6455,34 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
 	}
 	
   protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
-        Connection conn = getConnection();
-        
-        String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
-        String[] results = new String[cmd.getRules().length];
-        int i = 0;
-        for (FirewallRuleTO rule : cmd.getRules()) {
-           //FIXME - Jana, add implementation here
-        }
+	  String[] results = new String[cmd.getRules().length];
+	  String ret;
+	  Connection conn = getConnection();
+      String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
+
+      if (routerIp == null) {
+        	 return new SetFirewallRulesAnswer(cmd, false, results);
+      }
+
+      String[][] rules = cmd.generateFwRules();
+      String args = "";
+      args +=  routerIp+" -F ";
+      StringBuilder sb = new StringBuilder();
+      String[] addRules = rules[0];
+      if (addRules.length > 0) {
+          for (int i = 0; i < addRules.length; i++) {
+                sb.append(addRules[i]).append(',');
+           }
+           args += " -a " + sb.toString();
+      }
+
+      ret = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args);
+   
+      if (ret == null || ret.isEmpty()) { 
+            return new SetFirewallRulesAnswer(cmd,false, results);
+      }
+      return new SetFirewallRulesAnswer(cmd, true, results);
 
-        return new SetFirewallRulesAnswer(cmd, results);
   }
 	
 }
diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
new file mode 100755
index 00000000000..84d670873a8
--- /dev/null
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+ 
+# $Id: firewall.sh 9947 2010-06-25 19:34:24Z manuel $ $HeadURL: svn://svn.lab.vmops.com/repos/vmdev/java/patches/xenserver/root/loadbalancer.sh $
+#
+#
+# @VERSION@
+echo $* >> /tmp/jana.log
+usage() {
+  printf "Usage: %s: -F  -a <added public ip address protocol:startport:endport:sourcecidr>  \n" $(basename $0) >&2
+# scourcecidrs format:  n1-n2-n3-n4
+}
+
+# set -x
+
+#FIXME: eating up the error code during execution of iptables
+fw_remove_backup() {
+  for vif in $VIF_LIST; do 
+    sudo iptables -F back_firewall_rules_$vif 2> /dev/null
+    sudo iptables -D INPUT -i $vif  -j back_firewall_rules_$vif 2> /dev/null
+    sudo iptables -X back_firewall_rules_$vif 2> /dev/null
+  done
+}
+fw_restore() {
+  for vif in $VIF_LIST; do 
+    sudo iptables -F firewall_rules_$vif 2> /dev/null
+    sudo iptables -D INPUT -i $vif   -j firewall_rules_$vif 2> /dev/null
+    sudo iptables -X firewall_rules_$vif 2> /dev/null
+    sudo iptables -E back_firewall_rules_$vif firewall_rules_$vif 2> /dev/null
+  done
+}
+# firewall entry to ensure that haproxy can receive on specified port
+fw_entry() {
+  local added=$1
+  
+  if [ "$added" == "none" ]
+  then
+  	added=""
+  fi
+  
+  
+  local a=$(echo $added | cut -d, -f1- --output-delimiter=" ")
+
+# back up the iptable rules by renaming before creating new. 
+  for vif in $VIF_LIST; do 
+    sudo iptables -E firewall_rules_$vif back_firewall_rules_$vif 2> /dev/null
+    sudo iptables -N firewall_rules_$vif 2> /dev/null
+    sudo iptables -A INPUT -i $vif -j firewall_rules_$vif
+  done
+
+  for i in $a
+  do
+    local prot=$(echo $i | cut -d: -f1)
+    local sport=$(echo $i | cut -d: -f2)    
+    local eport=$(echo $i | cut -d: -f3)    
+    local scidrs=$(echo $i | cut -d: -f4 | sed 's/-/,/g')
+ 
+    
+    for vif in $VIF_LIST; do 
+      if [ "$prot" == "icmp" ]
+      then
+# TODO  icmp code need to be implemented
+# sport is icmpType , dport is icmpcode 
+	 if [ "$sport" == "-1" ]
+         then
+             sudo iptables -A firewall_rules_$vif -s $scidrs -p $prot  -j ACCEPT
+         else
+             sudo iptables -A firewall_rules_$vif -s $scidrs -p $prot --icmp-type $sport  -j ACCEPT
+         fi
+      else
+         sudo iptables -A firewall_rules_$vif -s $scidrs -p $prot --dport $sport:$eport -j ACCEPT
+      fi
+      
+      if [ $? -gt 0 ]
+      then
+        return 1
+      fi
+    done      
+  done
+ 
+  return 0
+}
+
+get_vif_list() {
+  local vif_list=""
+  for i in /sys/class/net/eth*; do 
+    vif=$(basename $i);
+    if [ "$vif" != "eth0" ] && [ "$vif" != "eth1" ]
+    then
+      vif_list="$vif_list $vif";
+    fi
+  done
+  if [ "$vif_list" == "" ]
+  then
+      vif_list="eth0"
+  fi
+  
+  logger -t cloud "FirewallRule public interfaces = $vif_list"
+  echo $vif_list
+}
+
+shift 
+while getopts 'a:' OPTION
+do
+  case $OPTION in
+  a)	aflag=1
+		rules="$OPTARG"
+		;;
+  ?)	usage
+		exit 2
+		;;
+  esac
+done
+
+VIF_LIST=$(get_vif_list)
+
+if [ "$rules" == "" ]
+then
+  rules="none"
+fi
+
+# iptables entry to ensure that haproxy receives traffic
+fw_entry $rules 
+  	
+if [ $? -gt 0 ]
+then
+  logger -t cloud "Reverting firewall config"
+  # Revert iptables rules on DomR
+  fw_restore
+
+  exit 1
+else
+  # Remove backedup iptable rules
+  fw_remove_backup
+fi
+ 
+exit 0
+  	
+
diff --git a/scripts/network/domr/call_firewall.sh b/scripts/network/domr/call_firewall.sh
index 29765e657d9..c9e6147cef0 100755
--- a/scripts/network/domr/call_firewall.sh
+++ b/scripts/network/domr/call_firewall.sh
@@ -24,15 +24,17 @@
 # firewall.sh -- allow some ports / protocols to vm instances
 #
 #
-
+echo $* >> /tmp/jana.log
 usage() {
-  printf "Usage: %s: (-A|-D) -i <domR eth1 ip>  -r <target-instance-ip> -P protocol (-p port_range | -t icmp_type_code)  -l <public ip address> -d <target port> [-f <firewall ip> -u <firewall user> -y <firewall password> -z <firewall enable password> ] \n" $(basename $0) >&2
+  printf "Usage for Firewall rule  : %s: <domR eth1 ip> -F " $(basename $0) >&2
+  printf "Usage for other purposes : %s: <domR eth1 ip> (-A|-D) -i <domR eth1 ip>  -r <target-instance-ip> -P protocol (-p port_range | -t icmp_type_code)  -l <public ip address> -d <target port> [-f <firewall ip> -u <firewall user> -y <firewall password> -z <firewall enable password> ] \n" $(basename $0) >&2
 }
 
-# set -x
+ set -x
 
 # check if gateway domain is up and running
 check_gw() {
+# return 0;
   ping -c 1 -n -q $1 > /dev/null
   if [ $? -gt 0 ]
   then
@@ -52,9 +54,21 @@ if [ $? -gt 0 ]
 then
   exit 1
 fi
+fflag=
+while getopts 'F:' OPTION
+do
+  case $OPTION in 
+  F)    fflag=1
+                ;;
+  esac
+done
 
-
-ssh -p 3922 -q -o StrictHostKeyChecking=no -i $cert root@$domRIp "/root/firewall.sh $*"
+if [ -n "$fflag" ]
+then
+	ssh -p 3922 -q -o StrictHostKeyChecking=no -i $cert root@$domRIp "/root/firewall_rule.sh $*"
+else
+	ssh -p 3922 -q -o StrictHostKeyChecking=no -i $cert root@$domRIp "/root/firewall.sh $*"
+fi
 exit $?
 
 

From f5011189c87a32195245c7ea7632f27086c698b8 Mon Sep 17 00:00:00 2001
From: Naredula Janardhana Reddy <jana@cloud.com>
Date: Wed, 10 Aug 2011 18:15:07 +0530
Subject: [PATCH 15/77] bug 10561: code cleanup

---
 .../xen/resource/CitrixResourceBase.java      | 53 +++++++++----------
 1 file changed, 26 insertions(+), 27 deletions(-)

diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index a715dfa7663..098306736a8 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -6454,35 +6454,34 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
 	    return new Answer(cmd, success, "");
 	}
 	
-  protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
-	  String[] results = new String[cmd.getRules().length];
-	  String ret;
-	  Connection conn = getConnection();
-      String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
+	protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
+		String[] results = new String[cmd.getRules().length+1];
+		String callResult;
+		Connection conn = getConnection();
+		String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
 
-      if (routerIp == null) {
-        	 return new SetFirewallRulesAnswer(cmd, false, results);
-      }
+		if (routerIp == null) {
+			return new SetFirewallRulesAnswer(cmd, false, results);
+		}
 
-      String[][] rules = cmd.generateFwRules();
-      String args = "";
-      args +=  routerIp+" -F ";
-      StringBuilder sb = new StringBuilder();
-      String[] addRules = rules[0];
-      if (addRules.length > 0) {
-          for (int i = 0; i < addRules.length; i++) {
-                sb.append(addRules[i]).append(',');
-           }
-           args += " -a " + sb.toString();
-      }
+		String[][] rules = cmd.generateFwRules();
+		String args = "";
+		args += routerIp + " -F ";
+		StringBuilder sb = new StringBuilder();
+		String[] fwRules = rules[0];
+		if (fwRules.length > 0) {
+			for (int i = 0; i < fwRules.length; i++) {
+				sb.append(fwRules[i]).append(',');
+			}
+			args += " -a " + sb.toString();
+		}
 
-      ret = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args);
-   
-      if (ret == null || ret.isEmpty()) { 
-            return new SetFirewallRulesAnswer(cmd,false, results);
-      }
-      return new SetFirewallRulesAnswer(cmd, true, results);
+		callResult = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args);
 
-  }
-	
+		if (callResult == null || callResult.isEmpty()) {
+			results[cmd.getRules().length] = "failed";
+			return new SetFirewallRulesAnswer(cmd, false, results);
+		}
+		return new SetFirewallRulesAnswer(cmd, true, results);
+	}
 }

From 2a7a698a6478b766d6bc240235d7c741ea3fdd69 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 10:13:30 -0700
Subject: [PATCH 16/77] cloudStack - Elastic Load Balancer - IP address page -
 continue calling listPublicIpAddresses API instead of showing error when
 supportELB is "false".

---
 ui/scripts/cloud.core.ipaddress.js | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 9030c7b220e..7a0843d9714 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -71,8 +71,7 @@ function afterLoadIpJSP() {
     var tabContentArray = [$("#tab_content_details"), $("#tab_content_port_range"), $("#tab_content_port_forwarding"), $("#tab_content_load_balancer"), $("#tab_content_vpn")];
     var afterSwitchFnArray = [ipJsonToDetailsTab, ipJsonToPortRangeTab, ipJsonToPortForwardingTab, ipJsonToLoadBalancerTab, ipJsonToVPNTab];
     switchBetweenDifferentTabs(tabArray, tabContentArray, afterSwitchFnArray);       
-    //***** switch between different tabs (end) **********************************************************************
-        
+    //***** switch between different tabs (end) **********************************************************************  
     if(g_supportELB == "guest" || g_supportELB == "public") {
 		$("#tab_details,#tab_port_range,#tab_port_forwarding,#tab_load_balancer,#tab_vpn").hide();	
 				
@@ -1385,12 +1384,8 @@ function ipJsonToDetailsTab() {
 	else if(g_supportELB == "public") {
 		cmd = "command=listPublicIpAddresses&forvirtualnetwork=true&id="+publicipid;
 	}
-	else {
-		if(g_supportELB == null)
-	        alert("supportELB should be either guest or public. It should not be null.");
-	    else 
-	    	alert("supportELB should be either guest or public. It should not be " + g_supportELB);
-		return;
+	else { //g_supportELB == "false"
+		cmd = "command=listPublicIpAddresses&id="+publicipid;
 	}		
     
     $.ajax({

From 3f3c64025bb67446f4907f10164adbc3dcb6cf26 Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Wed, 10 Aug 2011 10:20:45 -0700
Subject: [PATCH 17/77] change it back to false since ui now handles false

---
 server/src/com/cloud/server/ManagementServerImpl.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/com/cloud/server/ManagementServerImpl.java b/server/src/com/cloud/server/ManagementServerImpl.java
index 36b8dad8e05..52c86402ae2 100755
--- a/server/src/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/com/cloud/server/ManagementServerImpl.java
@@ -4207,7 +4207,7 @@ public class ManagementServerImpl implements ManagementServer {
 
         boolean securityGroupsEnabled = false;
         boolean elasticLoadBalancerEnabled = false;
-        String supportELB = "public";
+        String supportELB = "false";
         List<DataCenterVO> dc = _dcDao.listSecurityGroupEnabledZones();
         if (dc != null && !dc.isEmpty()) {
             securityGroupsEnabled = true;

From 32b53351ff2b64f0da0d1eb0e45c92a9a81a93ad Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 10:47:45 -0700
Subject: [PATCH 18/77] Fixed response processing in createFirewallRule command

---
 .../commands/CreateIpForwardingRuleCmd.java   | 21 ++++++++++-----
 .../commands/CreateLoadBalancerRuleCmd.java   | 26 +++++++++++++++----
 .../commands/CreatePortForwardingRuleCmd.java | 23 ++++++++--------
 .../xen/resource/CitrixResourceBase.java      |  7 +++--
 .../cloud/network/rules/RulesManagerImpl.java |  2 +-
 5 files changed, 52 insertions(+), 27 deletions(-)

diff --git a/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java b/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
index 6d2ddc2ddd4..d6f2797fb5e 100644
--- a/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
+++ b/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
@@ -66,6 +66,9 @@ public class CreateIpForwardingRuleCmd extends BaseAsyncCreateCmd implements Sta
     @Parameter(name = ApiConstants.OPEN_FIREWALL, type = CommandType.BOOLEAN, description = "if true, firewall rule for source/end pubic port is automatically created; if false - firewall rule has to be created explicitely. Has value true by default")
     private Boolean openFirewall;
     
+    @Parameter(name = ApiConstants.CIDR_LIST, type = CommandType.LIST, collectionType = CommandType.STRING, description = "the cidr list to forward traffic from")
+    private List<String> cidrlist;
+    
 
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
@@ -102,6 +105,7 @@ public class CreateIpForwardingRuleCmd extends BaseAsyncCreateCmd implements Sta
 
     @Override
     public void execute() throws ResourceUnavailableException{ 
+        
         boolean result = true;
         FirewallRule rule = null;
         try {
@@ -127,15 +131,19 @@ public class CreateIpForwardingRuleCmd extends BaseAsyncCreateCmd implements Sta
 
 	@Override
 	public void create() {
-		StaticNatRule rule;
+	    
+	    //cidr list parameter is deprecated
+        if (cidrlist != null) {
+            throw new InvalidParameterValueException("Parameter cidrList is deprecated; if you need to open firewall rule for the specific cidr, please refer to createFirewallRule command");
+        }
+	    
         try {
-            rule = _rulesService.createStaticNatRule(this, getOpenFirewall());
+            StaticNatRule rule = _rulesService.createStaticNatRule(this, getOpenFirewall());
+            this.setEntityId(rule.getId());
         } catch (NetworkRuleConflictException e) {
-            s_logger.info("Unable to create Static Nat Rule due to " + e.getMessage());
+            s_logger.info("Unable to create Static Nat Rule due to ", e);
             throw new ServerApiException(BaseCmd.NETWORK_RULE_CONFLICT_ERROR, e.getMessage());
         }
-        
-        this.setEntityId(rule.getId());
 	}
 
     @Override
@@ -263,8 +271,7 @@ public class CreateIpForwardingRuleCmd extends BaseAsyncCreateCmd implements Sta
     public Integer getIcmpType() {
         return null;
     }
-
-    @Override
+    
     public List<String> getSourceCidrList() {
         return null;
     }
diff --git a/api/src/com/cloud/api/commands/CreateLoadBalancerRuleCmd.java b/api/src/com/cloud/api/commands/CreateLoadBalancerRuleCmd.java
index 0e639c1fc0b..334bad5edca 100644
--- a/api/src/com/cloud/api/commands/CreateLoadBalancerRuleCmd.java
+++ b/api/src/com/cloud/api/commands/CreateLoadBalancerRuleCmd.java
@@ -81,6 +81,9 @@ public class CreateLoadBalancerRuleCmd extends BaseAsyncCmd  /*implements LoadBa
     @Parameter(name=ApiConstants.DOMAIN_ID, type=CommandType.LONG, description="the domain ID associated with the load balancer")
     private Long domainId;
     
+    @Parameter(name = ApiConstants.CIDR_LIST, type = CommandType.LIST, collectionType = CommandType.STRING, description = "the cidr list to forward traffic from")
+    private List<String> cidrlist;
+    
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -125,6 +128,14 @@ public class CreateLoadBalancerRuleCmd extends BaseAsyncCmd  /*implements LoadBa
             return true;
         }
     }
+    
+    public List<String> getSourceCidrList() {
+        if (cidrlist != null) {
+            throw new InvalidParameterValueException("Parameter cidrList is deprecated; if you need to open firewall rule for the specific cidr, please refer to createFirewallRule command");
+        }
+        return null;
+    }
+    
 
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
@@ -137,9 +148,17 @@ public class CreateLoadBalancerRuleCmd extends BaseAsyncCmd  /*implements LoadBa
     
     @Override
     public void execute() throws ResourceAllocationException, ResourceUnavailableException {        
-        LoadBalancer result = null;
+        
+        //cidr list parameter is deprecated
+        if (cidrlist != null) {
+            throw new InvalidParameterValueException("Parameter cidrList is deprecated; if you need to open firewall rule for the specific cidr, please refer to createFirewallRule command");
+        }
+        
         try {
-            result = _lbService.createLoadBalancerRule(this, getOpenFirewall());
+            LoadBalancer result = _lbService.createLoadBalancerRule(this, getOpenFirewall());
+            LoadBalancerResponse response = _responseGenerator.createLoadBalancerResponse(result);
+            response.setResponseName(getCommandName());
+            this.setResponseObject(response);
         } catch (NetworkRuleConflictException e) {
             s_logger.warn("Exception: ", e);
             throw new ServerApiException(BaseCmd.NETWORK_RULE_CONFLICT_ERROR, e.getMessage());
@@ -147,9 +166,6 @@ public class CreateLoadBalancerRuleCmd extends BaseAsyncCmd  /*implements LoadBa
             s_logger.warn("Exception: ", e);
             throw new ServerApiException(BaseCmd.INSUFFICIENT_CAPACITY_ERROR, e.getMessage());
         }
-        LoadBalancerResponse response = _responseGenerator.createLoadBalancerResponse(result);
-        response.setResponseName(getCommandName());
-        this.setResponseObject(response);
     }
 
   
diff --git a/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java b/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java
index 42f9c93ca36..84a6a8f15e4 100644
--- a/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java
+++ b/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java
@@ -98,7 +98,10 @@ public class CreatePortForwardingRuleCmd extends BaseAsyncCreateCmd implements P
     }
 
     public List<String> getSourceCidrList() {
-        return cidrlist;
+        if (cidrlist != null) {
+            throw new InvalidParameterValueException("Parameter cidrList is deprecated; if you need to open firewall rule for the specific cidr, please refer to createFirewallRule command");
+        }
+        return null;
     }
     
     public Boolean getOpenFirewall() {
@@ -117,10 +120,6 @@ public class CreatePortForwardingRuleCmd extends BaseAsyncCreateCmd implements P
     public String getCommandName() {
         return s_name;
     }
-    
-    public void setSourceCidrList(List<String> cidrs){
-        cidrlist = cidrs;
-    }
 
     @Override
     public void execute() throws ResourceUnavailableException {
@@ -227,17 +226,17 @@ public class CreatePortForwardingRuleCmd extends BaseAsyncCreateCmd implements P
 
     @Override
     public void create() {
-        if (cidrlist != null)
-            for (String cidr: cidrlist){
-                if (!NetUtils.isValidCIDR(cidr)){
-                    throw new ServerApiException(BaseCmd.PARAM_ERROR, "Source cidrs formatting error " + cidr); 
-                }
-            }
+        
+        //cidr list parameter is deprecated
+        if (cidrlist != null) {
+            throw new InvalidParameterValueException("Parameter cidrList is deprecated; if you need to open firewall rule for the specific cidr, please refer to createFirewallRule command");
+        }
+        
         try {
             PortForwardingRule result = _rulesService.createPortForwardingRule(this, virtualMachineId, getOpenFirewall());
             setEntityId(result.getId());
         } catch (NetworkRuleConflictException ex) {
-            s_logger.info("Network rule conflict: " + ex.getMessage());
+            s_logger.info("Network rule conflict: " , ex);
             s_logger.trace("Network Rule Conflict: ", ex);
             throw new ServerApiException(BaseCmd.NETWORK_RULE_CONFLICT_ERROR, ex.getMessage());
         }
diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index 098306736a8..8a64e14310e 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -6455,7 +6455,7 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
 	}
 	
 	protected SetFirewallRulesAnswer execute(SetFirewallRulesCommand cmd) {
-		String[] results = new String[cmd.getRules().length+1];
+		String[] results = new String[cmd.getRules().length];
 		String callResult;
 		Connection conn = getConnection();
 		String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
@@ -6479,7 +6479,10 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
 		callResult = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args);
 
 		if (callResult == null || callResult.isEmpty()) {
-			results[cmd.getRules().length] = "failed";
+		    //FIXME - in the future we have to process each rule separately; now we temporarely set every rule to be false if single rule fails
+		    for (int i=0; i < results.length; i++) {
+		        results[i] = "Failed";
+		    }
 			return new SetFirewallRulesAnswer(cmd, false, results);
 		}
 		return new SetFirewallRulesAnswer(cmd, true, results);
diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java
index 4afe37eb0e3..2a044ec656b 100755
--- a/server/src/com/cloud/network/rules/RulesManagerImpl.java
+++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java
@@ -225,7 +225,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
             if (e instanceof NetworkRuleConflictException) {
                 throw (NetworkRuleConflictException) e;
             }
-            throw new CloudRuntimeException("Unable to add rule for the ip id=" + newRule.getSourceIpAddressId(), e);
+            throw new CloudRuntimeException("Unable to add rule for the ip id=" + ipAddrId, e);
         }
     }
 

From 6e0eeb132e3559d06b1b03f967efb5bc26d44d17 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Wed, 10 Aug 2011 12:01:38 -0700
Subject: [PATCH 19/77] bug 11045: Fix exception exit of CheckRouterTask

Catch all the exception and come back to work.

status 11045: resolved fixed
---
 .../VirtualNetworkApplianceManagerImpl.java   | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 661cb92cf46..9d345e9bb3b 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -828,15 +828,18 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
         
         @Override
         public void run() {
-            
-            final List<DomainRouterVO> routers = _routerDao.listVirtualUpByHostId(null);
-            s_logger.debug("Found " + routers.size() + " running routers. ");
+            try {
+                final List<DomainRouterVO> routers = _routerDao.listVirtualUpByHostId(null);
+                s_logger.debug("Found " + routers.size() + " running routers. ");
 
-            updateRoutersRedundantState(routers);
-            
-            /* FIXME assumed the a pair of redundant routers managed by same mgmt server,
-             * then the update above can get the latest status */
-            checkDuplicateMaster(routers);
+                updateRoutersRedundantState(routers);
+
+                /* FIXME assumed the a pair of redundant routers managed by same mgmt server,
+                 * then the update above can get the latest status */
+                checkDuplicateMaster(routers);
+            } catch (Exception ex) {
+                s_logger.error("Fail to complete the CheckRouterTask! ", ex);
+            }
         }
     }
 

From 0f33a2cdbca9d29eb7768ff13ca43eef02d9cec5 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 12:10:48 -0700
Subject: [PATCH 20/77] cloudStack - IP Address page - Port Forwarding tab -
 remove Source CIDR.

---
 ui/jsp/ipaddress.jsp               | 35 ++++++++++--------------------
 ui/scripts/cloud.core.ipaddress.js | 26 +++++-----------------
 2 files changed, 18 insertions(+), 43 deletions(-)

diff --git a/ui/jsp/ipaddress.jsp b/ui/jsp/ipaddress.jsp
index 428af847570..957643ec789 100644
--- a/ui/jsp/ipaddress.jsp
+++ b/ui/jsp/ipaddress.jsp
@@ -288,11 +288,7 @@ dictionary = {
         </div>        
         <div id="tab_container">
 	        <div class="grid_container" id="grid_container">
-	            <div class="grid_header">
-	                <div class="grid_header_cell" style="width: 25%; ">
-	                    <div class="grid_header_title">
-	                        <fmt:message key="label.cidr.list"/></div>
-	                </div>		            
+	            <div class="grid_header">	                          
 	                <div class="grid_header_cell" style="width: 15%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.public.port"/></div>
@@ -305,24 +301,20 @@ dictionary = {
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.protocol"/></div>
 	                </div>
-	                <div class="grid_header_cell" style="width: 15%;  border: none;">
+	                <div class="grid_header_cell" style="width: 30%;  border: none;">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.instance"/></div>
 	                </div>
-	                <div class="grid_header_cell" style="width: 5%; ">
+	                <div class="grid_header_cell" style="width: 10%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.state"/></div>
 	                </div>
-	                <div class="grid_header_cell" style="width: 10%; ">
+	                <div class="grid_header_cell" style="width: 15%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.actions"/></div>
 	                </div>
 	            </div>
-	            <div class="grid_rows even" id="create_port_forwarding_row">
-	                <div class="grid_row_cell" style="width: 25%; ">  
-	                    <input id="cidr" class="text" type="text" />
-	                    <div id="cidr_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
-	                </div>
+	            <div class="grid_rows even" id="create_port_forwarding_row">	               
 	                <div class="grid_row_cell" style="width: 15%; ">
 	                    <input id="public_port" class="text" style="width: 30%; " type="text" />
 	                    <div id="public_port_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
@@ -345,15 +337,15 @@ dictionary = {
 	                   <select class="select" id="protocol" style="width:70%;">	                    
 	                   </select>
 	                </div>
-	                <div class="grid_row_cell" style="width: 15%; ">                   
+	                <div class="grid_row_cell" style="width: 30%; ">                   
 	                    <select class="select" id="vm">
 	                    </select>
 	                    <div id="vm_errormsg" class="errormsg" style="display: none;"></div>	                    
 	                </div>
-	                <div class="grid_row_cell" style="width: 5%; ">   
+	                <div class="grid_row_cell" style="width: 10%; ">   
 	                    <div class="row_celltitles" id="state" style="padding:1px;"></div>
 	                </div>  
-	                <div class="grid_row_cell" style="width: 10%; ">
+	                <div class="grid_row_cell" style="width: 15%; ">
 	                    <div class="row_celltitles">
 	                        <a id="add_link" href="#"><fmt:message key="label.add"/></a></div>
 	                </div>
@@ -673,10 +665,7 @@ dictionary = {
 
 <!-- Port Forwarding template (begin) -->
 <div class="grid_rows odd" id="port_forwarding_template" style="display: none">    
-    <div id="row_container">
-        <div class="grid_row_cell" style="width: 25%; ">
-            <div class="row_celltitles" id="cidr" style="padding:1px;"></div>
-        </div>
+    <div id="row_container">       
         <div class="grid_row_cell" style="width: 15%; ">
             <div class="row_celltitles" id="public_port"></div>
         </div>
@@ -686,13 +675,13 @@ dictionary = {
         <div class="grid_row_cell" style="width: 10%; ">
             <div class="row_celltitles" id="protocol"></div>
         </div>
-        <div class="grid_row_cell" style="width: 15%; ">
+        <div class="grid_row_cell" style="width: 30%; ">
             <div class="row_celltitles" id="vm_name"></div>
         </div>   
-        <div class="grid_row_cell" style="width: 5%; ">
+        <div class="grid_row_cell" style="width: 10%; ">
             <div class="row_celltitles" id="state" style="padding:1px;"></div>
         </div>        
-        <div class="grid_row_cell" style="width: 10%; ">
+        <div class="grid_row_cell" style="width: 15%; ">
             <div class="row_celltitles">
                 <a id="delete_link" href="#" style="float:left;"><fmt:message key="label.delete"/> </a>                                
             </div>
diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 7a0843d9714..4d6032a7045 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -418,7 +418,7 @@ function afterLoadIpJSP() {
     $createPortForwardingRow.find("#add_link").bind("click", function(event){	        
 		var isValid = true;		
 	
-		isValid &= validateCIDRList("CIDR", $createPortForwardingRow.find("#cidr"), $createPortForwardingRow.find("#cidr_errormsg"), true); //optional		
+		//isValid &= validateCIDRList("CIDR", $createPortForwardingRow.find("#cidr"), $createPortForwardingRow.find("#cidr_errormsg"), true); //optional		
 				
 		isValid &= validateInteger("Public Port", $createPortForwardingRow.find("#public_port"), $createPortForwardingRow.find("#public_port_errormsg"), 1, 65535, false); //required
 		isValid &= validateInteger("Public End Port", $createPortForwardingRow.find("#public_end_port"), $createPortForwardingRow.find("#public_end_port_errormsg"), 1, 65535, true); //optional
@@ -426,17 +426,9 @@ function afterLoadIpJSP() {
 		isValid &= validateInteger("Private Port", $createPortForwardingRow.find("#private_port"), $createPortForwardingRow.find("#private_port_errormsg"), 1, 65535, false); //required		
 		isValid &= validateInteger("Private End Port", $createPortForwardingRow.find("#private_end_port"), $createPortForwardingRow.find("#private_end_port_errormsg"), 1, 65535, true); //optional				
 		
-			isValid &= validateCIDRList("CIDR", $createPortForwardingRow.find("#cidr"), $createPortForwardingRow.find("#cidr_errormsg"), true); //optional		
-					
-			isValid &= validateInteger("Public Port", $createPortForwardingRow.find("#public_port"), $createPortForwardingRow.find("#public_port_errormsg"), 1, 65535, false); //required
-			//isValid &= validateInteger("Public End Port", $createPortForwardingRow.find("#public_end_port"), $createPortForwardingRow.find("#public_end_port_errormsg"), 1, 65535, true); //optional
-			
-			isValid &= validateInteger("Private Port", $createPortForwardingRow.find("#private_port"), $createPortForwardingRow.find("#private_port_errormsg"), 1, 65535, false); //required		
-			//isValid &= validateInteger("Private End Port", $createPortForwardingRow.find("#private_end_port"), $createPortForwardingRow.find("#private_end_port_errormsg"), 1, 65535, true); //optional				
-			
-			isValid &= validateDropDownBox("Instance", $createPortForwardingRow.find("#vm"), $createPortForwardingRow.find("#vm_errormsg"));	
-			if (!isValid) 
-			    return;			
+	    isValid &= validateDropDownBox("Instance", $createPortForwardingRow.find("#vm"), $createPortForwardingRow.find("#vm_errormsg"));	
+		if (!isValid) 
+		    return;			
 		    
 		    var $template = $("#port_forwarding_template").clone();
 		    $("#tab_content_port_forwarding #grid_content").append($template.show());		
@@ -450,11 +442,7 @@ function afterLoadIpJSP() {
 				
 	        var array1 = [];
 	        array1.push("&ipaddressid="+ipObj.id);           
-	        
-	        var cidr = $createPortForwardingRow.find("#cidr").val();
-	        if(cidr != null && cidr.length > 0)
-	        	array1.push("&cidrlist="+cidr);
-	        
+	        	      
 		    var publicPort = $createPortForwardingRow.find("#public_port").val();
 		    array1.push("&publicport="+publicPort);	    
 		    var publicEndPort = $createPortForwardingRow.find("#public_end_port").val();
@@ -1718,9 +1706,7 @@ function ipClearPortForwardingTab() {
 
 function portForwardingJsonToTemplate(jsonObj, $template) {				        
     $template.attr("id", "portForwarding_" + fromdb(jsonObj.id)).data("portForwardingId", fromdb(jsonObj.id));	
-    
-    $template.find("#cidr").text(fromdb(jsonObj.cidrlist));
-    
+       
     var publicPort = fromdb(jsonObj.publicport);
     if(jsonObj.publicendport != null && jsonObj.publicendport.length > 0)
     	publicPort += (" - " + fromdb(jsonObj.publicendport));    

From b121665bb1f38f0299101d05256a463ade3aff78 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 12:24:06 -0700
Subject: [PATCH 21/77] cloudStack - IP Address page - Load Balancer tab -
 remove Source CIDR.

---
 ui/jsp/ipaddress.jsp               | 45 ++++++++++++------------------
 ui/scripts/cloud.core.ipaddress.js | 16 +++--------
 2 files changed, 22 insertions(+), 39 deletions(-)

diff --git a/ui/jsp/ipaddress.jsp b/ui/jsp/ipaddress.jsp
index 957643ec789..c5cce6eaeeb 100644
--- a/ui/jsp/ipaddress.jsp
+++ b/ui/jsp/ipaddress.jsp
@@ -369,49 +369,42 @@ dictionary = {
         <div id="tab_container">
 	        <div class="grid_container">
 	            <div class="grid_header">	            
+	                          
 	                <div class="grid_header_cell" style="width: 25%; ">
-	                    <div class="grid_header_title">
-	                        <fmt:message key="label.cidr.list"/></div>
-	                </div>		            
-	                <div class="grid_header_cell" style="width: 14%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.name"/></div>
 	                </div>
-	                <div class="grid_header_cell" style="width: 12%; ">
+	                <div class="grid_header_cell" style="width: 15%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.public.port"/></div>
 	                </div>
-	                <div class="grid_header_cell" style="width: 12%; ">
+	                <div class="grid_header_cell" style="width: 15%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.private.port"/></div>
 	                </div>
-	                <div class="grid_header_cell" style="width: 12%; ">
+	                <div class="grid_header_cell" style="width: 15%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.algorithm"/></div>
 	                </div>	                
-	                <div class="grid_header_cell" style="width: 6%; ">
+	                <div class="grid_header_cell" style="width: 10%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.state"/></div>
 	                </div>	                
-	                <div class="grid_header_cell" style="width: 17%; ">
+	                <div class="grid_header_cell" style="width: 15%; ">
 	                    <div class="grid_header_title">
 	                        <fmt:message key="label.actions"/></div>
 	                </div>
 	            </div>
-	            <div class="grid_rows even" id="create_load_balancer_row">	            
-	                <div class="grid_row_cell" style="width: 25%; ">  
-	                    <input id="cidr" class="text" type="text" />
-	                    <div id="cidr_errormsg" class="errormsg" style="display: none;"></div>
-	                </div>	            
-	                <div class="grid_row_cell" style="width: 14%; ">
+	            <div class="grid_rows even" id="create_load_balancer_row">	
+	                <div class="grid_row_cell" style="width: 25%; ">
 	                    <input id="name" class="text" style="width: 70%; " type="text" />
 	                    <div id="name_errormsg" class="errormsg" style="display: none;"></div>
 	                </div>
-	                <div class="grid_row_cell" style="width: 12%;">
+	                <div class="grid_row_cell" style="width: 15%;">
 	                    <input id="public_port" class="text" style="width: 70%; " type="text" />
 	                    <div id="public_port_errormsg" class="errormsg" style="display: none;"></div>
 	                </div>
-	                <div class="grid_row_cell" style="width: 12%;">
+	                <div class="grid_row_cell" style="width: 15%;">
 	                    <input id="private_port" class="text" style="width: 70%; " type="text" />
 	                    <div id="private_port_errormsg" class="errormsg" style="display: none;"></div>
 	                </div>
@@ -422,10 +415,10 @@ dictionary = {
 			                <option value='source'>source</option>    	                      
 	                    </select>
 	                </div>	                
-	                <div class="grid_row_cell" style="width: 6%;">	  
+	                <div class="grid_row_cell" style="width: 10%;">	  
                     	<div class="row_celltitles" style="padding:1px;"></div>         
 	                </div>	                
-	                <div class="grid_row_cell" style="width: 17%; ">
+	                <div class="grid_row_cell" style="width: 15%; ">
 	                    <div class="row_celltitles">
 	                        <a id="add_link" href="#"><fmt:message key="label.add"/></a></div>
 	                </div>
@@ -505,25 +498,23 @@ dictionary = {
 <!-- Load Balancer Template (begin) -->
 <div class="grid_rows odd" id="load_balancer_template" style="display:none">
     <div id="row_container">        
+              
         <div class="grid_row_cell" style="width: 25%; ">
-            <div class="row_celltitles" id="cidr" style="padding:1px;"></div>
-        </div>        
-        <div class="grid_row_cell" style="width: 14%; ">
             <div class="row_celltitles" id="name"></div>
         </div>
-        <div class="grid_row_cell" style="width: 12%; ">
+        <div class="grid_row_cell" style="width: 15%; ">
             <div class="row_celltitles" id="public_port"></div>
         </div>
-        <div class="grid_row_cell" style="width: 12%; ">
+        <div class="grid_row_cell" style="width: 15%; ">
             <div class="row_celltitles" id="private_port"></div>
         </div>
-        <div class="grid_row_cell" style="width: 12%; ">
+        <div class="grid_row_cell" style="width: 15%; ">
             <div class="row_celltitles" id="algorithm"></div>
         </div>        
-        <div class="grid_row_cell" style="width: 6%; ">
+        <div class="grid_row_cell" style="width: 10%; ">
             <div class="row_celltitles" id="state" style="padding:1px;"></div>
         </div>  
-        <div class="grid_row_cell" style="width: 17%; ">
+        <div class="grid_row_cell" style="width: 15%; ">
             <div class="row_celltitles">
                 <a id="manage_link" href="#" style="float:left;"><fmt:message key="label.manage"/></a>
                 <a id="edit_link" href="#" style="float:left; margin-left:15px;"><fmt:message key="label.edit"/></a>
diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 4d6032a7045..7334db0d396 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -533,7 +533,7 @@ function afterLoadIpJSP() {
     createLoadBalancerRow.find("#add_link").bind("click", function(event){		
 	    // validate values		    
 		var isValid = true;		
-		isValid &= validateCIDRList("CIDR", createLoadBalancerRow.find("#cidr"), createLoadBalancerRow.find("#cidr_errormsg"), true); //optional		
+		//isValid &= validateCIDRList("CIDR", createLoadBalancerRow.find("#cidr"), createLoadBalancerRow.find("#cidr_errormsg"), true); //optional		
 		isValid &= validateString("Name", createLoadBalancerRow.find("#name"), createLoadBalancerRow.find("#name_errormsg"));
 		isValid &= validateInteger("Public Port", createLoadBalancerRow.find("#public_port"), createLoadBalancerRow.find("#public_port_errormsg"), 1, 65535);
 		isValid &= validateInteger("Private Port", createLoadBalancerRow.find("#private_port"), createLoadBalancerRow.find("#private_port_errormsg"), 1, 65535);				
@@ -551,11 +551,7 @@ function afterLoadIpJSP() {
        	 	    
 	    var array1 = [];
         array1.push("&publicipid="+ipObj.id);  
-        
-        var cidr = createLoadBalancerRow.find("#cidr").val();
-        if(cidr != null && cidr.length > 0)
-        	array1.push("&cidrlist="+cidr);
-        
+       
         var name = createLoadBalancerRow.find("#name").val();  
         array1.push("&name="+todb(name));              
         
@@ -1848,10 +1844,7 @@ function ipClearLoadBalancerTab() {
 function loadBalancerJsonToTemplate(jsonObj, $template) {	
     var loadBalancerId = fromdb(jsonObj.id);	    
     $template.attr("id", "loadBalancer_" + loadBalancerId).data("loadBalancerId", loadBalancerId);		    
-       
-    $template.find("#row_container #cidr").text(fromdb(jsonObj.cidrlist));
-    $template.find("#row_container_edit #cidr").text(fromdb(jsonObj.cidrlist));
-        
+         
     $template.find("#row_container #name").text(fromdb(jsonObj.name));
     $template.find("#row_container_edit #name").val(fromdb(jsonObj.name));
     
@@ -2117,8 +2110,7 @@ function loadBalancerJsonToTemplate(jsonObj, $template) {
 }	
 
 function refreshCreateLoadBalancerRow() {
-    var createLoadBalancerRow = $("#tab_content_load_balancer #create_load_balancer_row");
-    createLoadBalancerRow.find("#cidr").val("");  
+    var createLoadBalancerRow = $("#tab_content_load_balancer #create_load_balancer_row");   
     createLoadBalancerRow.find("#name").val("");  
     createLoadBalancerRow.find("#public_port").val("");
     createLoadBalancerRow.find("#private_port").val("");

From 58a13c0d5acc2cfef61ff499d44ae90e636236de Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Wed, 10 Aug 2011 12:50:14 -0700
Subject: [PATCH 22/77] bug 11021: Add ReservationStrategy.Managed to prevent
 sourceNat from release

status 11021: resolved fixed
---
 api/src/com/cloud/vm/Nic.java                            | 2 +-
 server/src/com/cloud/network/guru/PublicNetworkGuru.java | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/api/src/com/cloud/vm/Nic.java b/api/src/com/cloud/vm/Nic.java
index de3491c9dd3..bc7cc6e08b2 100644
--- a/api/src/com/cloud/vm/Nic.java
+++ b/api/src/com/cloud/vm/Nic.java
@@ -83,7 +83,7 @@ public interface Nic {
     }
 
     public enum ReservationStrategy {
-        PlaceHolder, Create, Start;
+        PlaceHolder, Create, Start, Managed;
     }
 
     /**
diff --git a/server/src/com/cloud/network/guru/PublicNetworkGuru.java b/server/src/com/cloud/network/guru/PublicNetworkGuru.java
index e395b17bfc3..88d36928b8e 100644
--- a/server/src/com/cloud/network/guru/PublicNetworkGuru.java
+++ b/server/src/com/cloud/network/guru/PublicNetworkGuru.java
@@ -155,7 +155,7 @@ public class PublicNetworkGuru extends AdapterBase implements NetworkGuru {
         if (nic.getIp4Address() == null) {
             nic.setStrategy(ReservationStrategy.Start);
         } else {
-            nic.setStrategy(ReservationStrategy.Create);
+            nic.setStrategy(ReservationStrategy.Managed);
         }
 
         return nic;
@@ -182,7 +182,7 @@ public class PublicNetworkGuru extends AdapterBase implements NetworkGuru {
     @Override
     public void deallocate(Network network, NicProfile nic, VirtualMachineProfile<? extends VirtualMachine> vm) {
         IPAddressVO ip = _ipAddressDao.findByIpAndSourceNetworkId(nic.getNetworkId(), nic.getIp4Address());
-        if (ip != null) {
+        if (ip != null && nic.getReservationStrategy() != ReservationStrategy.Managed) {
             _networkMgr.markIpAsUnavailable(ip.getId());
             _ipAddressDao.unassignIpAddress(ip.getId());
         }

From fe3dd44bec0085b2fd564e9d7aa9635f417b65fc Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 12:16:50 -0700
Subject: [PATCH 23/77] ICMP protocol is supported in createFirewallRule
 command only; throw an error if specified in createPF/StaticNat/LB rule

---
 .../xen/resource/CitrixResourceBase.java         |  3 +--
 .../network/firewall/FirewallManagerImpl.java    | 16 ++++++++++------
 .../lb/LoadBalancingRulesManagerImpl.java        |  2 +-
 .../com/cloud/network/rules/FirewallManager.java |  3 ++-
 .../cloud/network/rules/RulesManagerImpl.java    |  4 ++--
 5 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index 8a64e14310e..b85517a5909 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -156,7 +156,6 @@ import com.cloud.agent.api.storage.CreatePrivateTemplateAnswer;
 import com.cloud.agent.api.storage.DestroyCommand;
 import com.cloud.agent.api.storage.PrimaryStorageDownloadAnswer;
 import com.cloud.agent.api.storage.PrimaryStorageDownloadCommand;
-import com.cloud.agent.api.to.FirewallRuleTO;
 import com.cloud.agent.api.to.IpAddressTO;
 import com.cloud.agent.api.to.NicTO;
 import com.cloud.agent.api.to.PortForwardingRuleTO;
@@ -6479,7 +6478,7 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
 		callResult = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args);
 
 		if (callResult == null || callResult.isEmpty()) {
-		    //FIXME - in the future we have to process each rule separately; now we temporarely set every rule to be false if single rule fails
+		    //FIXME - in the future we have to process each rule separately; now we temporarily set every rule to be false if single rule fails
 		    for (int i=0; i < results.length; i++) {
 		        results[i] = "Failed";
 		    }
diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index f02a29c73ca..b6cea06e7f7 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -115,12 +115,17 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
             throw new InvalidParameterValueException("Unable to create port forwarding rule; ip id=" + ipAddrId + " has static nat enabled");
         } 
         
-        validateFirewallRule(caller, ipAddress, portStart, portEnd, protocol);
+        validateFirewallRule(caller, ipAddress, portStart, portEnd, protocol, Purpose.Firewall);
 
+        //icmp code and icmp type can't be passed in for any other protocol rather than icmp
         if (!protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (icmpCode != null || icmpType != null)) {
             throw new InvalidParameterValueException("Can specify icmpCode and icmpType for ICMP protocol only");
         }
         
+        if (protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (portStart != null || portEnd != null)) {
+            throw new InvalidParameterValueException("Can't specify start/end port when protocol is ICMP");
+        }
+        
         Long networkId = ipAddress.getAssociatedWithNetworkId();
         Long accountId = ipAddress.getAccountId();
         Long domainId = ipAddress.getDomainId();
@@ -254,11 +259,8 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
                 if (newRule.getIcmpCode().longValue() == rule.getIcmpCode().longValue() || newRule.getIcmpType().longValue() == rule.getIcmpType().longValue() || newRule.getProtocol().equalsIgnoreCase(rule.getProtocol())) {
                     throw new InvalidParameterValueException("New rule conflicts with existing rule id=" + rule.getId());
                 }
-                
             }
-        }
-        
-        
+        }   
 
         if (s_logger.isDebugEnabled()) {
             s_logger.debug("No network rule conflicts detected for " + newRule + " against " + (rules.size() - 1) + " existing rules");
@@ -267,7 +269,7 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
 
     
     @Override
-    public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer portStart, Integer portEnd, String proto) {
+    public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer portStart, Integer portEnd, String proto, Purpose purpose) {
         // Validate ip address
         _accountMgr.checkAccess(caller, ipAddress);
 
@@ -297,6 +299,8 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         String supportedProtocols = firewallCapabilities.get(Capability.SupportedProtocols).toLowerCase();
         if (!supportedProtocols.contains(proto.toLowerCase())) {
             throw new InvalidParameterValueException("Protocol " + proto + " is not supported in zone " + network.getDataCenterId());
+        } else if (proto.equalsIgnoreCase(NetUtils.ICMP_PROTO) && purpose != Purpose.Firewall) {
+            throw new InvalidParameterValueException("Protocol " + proto + " is currently supported only for rules with purpose " + Purpose.Firewall);
         }
     }
     
diff --git a/server/src/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java b/server/src/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
index 41bce78d820..aeeaf3ef8a8 100755
--- a/server/src/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
+++ b/server/src/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
@@ -396,7 +396,7 @@ public class LoadBalancingRulesManagerImpl implements LoadBalancingRulesManager,
             throw new InvalidParameterValueException("Unable to create load balancer rule, invalid IP address id" + ipId);
         }
         
-        _firewallMgr.validateFirewallRule(caller.getCaller(), ipAddr, srcPortStart, srcPortEnd, lb.getProtocol());
+        _firewallMgr.validateFirewallRule(caller.getCaller(), ipAddr, srcPortStart, srcPortEnd, lb.getProtocol(), Purpose.LoadBalancing);
 
         
          networkId = ipAddr.getAssociatedWithNetworkId();
diff --git a/server/src/com/cloud/network/rules/FirewallManager.java b/server/src/com/cloud/network/rules/FirewallManager.java
index c7faf66b6ac..6367c482c29 100644
--- a/server/src/com/cloud/network/rules/FirewallManager.java
+++ b/server/src/com/cloud/network/rules/FirewallManager.java
@@ -7,6 +7,7 @@ import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.IPAddressVO;
 import com.cloud.network.IpAddress;
 import com.cloud.network.firewall.FirewallService;
+import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.user.Account;
 
 public interface FirewallManager extends FirewallService{
@@ -29,7 +30,7 @@ public interface FirewallManager extends FirewallService{
      */    
     void detectRulesConflict(FirewallRule newRule, IpAddress ipAddress) throws NetworkRuleConflictException;
     
-    void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer portStart, Integer portEnd, String proto);
+    void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer portStart, Integer portEnd, String proto, Purpose purpose);
     
     boolean applyRules(List<? extends FirewallRule> rules, boolean continueOnError) throws ResourceUnavailableException;
 
diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java
index 2a044ec656b..972d7816e51 100755
--- a/server/src/com/cloud/network/rules/RulesManagerImpl.java
+++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java
@@ -165,7 +165,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
             throw new InvalidParameterValueException("Unable to create port forwarding rule; ip id=" + ipAddrId + " has static nat enabled");
         } 
         
-        _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol());
+        _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), Purpose.PortForwarding);
         
         Long networkId = ipAddress.getAssociatedWithNetworkId();
         Long accountId = ipAddress.getAccountId();
@@ -245,7 +245,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
             throw new NetworkRuleConflictException("Can't do static nat on ip address: " + ipAddress.getAddress());
         } 
         
-        _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol());
+        _firewallMgr.validateFirewallRule(caller, ipAddress, rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), Purpose.StaticNat);
         
         Long networkId = ipAddress.getAssociatedWithNetworkId();
         Long accountId = ipAddress.getAccountId();

From 956445960a21beba01f9068efe2a0bf08e43d508 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 12:44:34 -0700
Subject: [PATCH 24/77] Throw ResourceUnavailableException when rules/ips fail
 to apply on the backend

---
 .../router/VirtualNetworkApplianceManagerImpl.java  | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 9d345e9bb3b..ff186874e4f 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -2066,6 +2066,12 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                 s_logger.warn("Unable to associate ip addresses, virtual router is not in the right state " + router.getState());
                 throw new ResourceUnavailableException("Unable to assign ip addresses, domR is not in right state " + router.getState(), DataCenter.class, network.getDataCenterId());
             }
+            
+            //If rules fail to apply on one domR, no need to proceed with the rest
+            if (!result) {
+                throw new ResourceUnavailableException("Unable to apply firewall rules on router ", VirtualRouter.class, router.getId());
+            }
+            
         }
         return result;
     }
@@ -2103,6 +2109,12 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                         result = false;
                     }
                 }
+                
+                //If rules fail to apply on one domR, no need to proceed with the rest
+                if (!result) {
+                    throw new ResourceUnavailableException("Unable to apply firewall rules on router ", VirtualRouter.class, router.getId());
+                }
+                
             } else if (router.getState() == State.Stopped || router.getState() == State.Stopping) {
                 s_logger.debug("Router is in " + router.getState() + ", so not sending apply firewall rules commands to the backend");
             } else {
@@ -2110,6 +2122,7 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                 throw new ResourceUnavailableException("Unable to apply firewall rules, virtual router is not in the right state", VirtualRouter.class, router.getId());
             }
         }
+        
         return result;
     }
 

From bcf5058edae6db530fba26e5164df6ee5c3b1057 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Wed, 10 Aug 2011 13:23:10 -0700
Subject: [PATCH 25/77] Clean up VirtualRouterElement.restart()

---
 .../network/element/VirtualRouterElement.java  | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/server/src/com/cloud/network/element/VirtualRouterElement.java b/server/src/com/cloud/network/element/VirtualRouterElement.java
index dd6d737a8b6..2456ead776e 100644
--- a/server/src/com/cloud/network/element/VirtualRouterElement.java
+++ b/server/src/com/cloud/network/element/VirtualRouterElement.java
@@ -150,27 +150,21 @@ public class VirtualRouterElement extends DhcpElement implements NetworkElement,
 
         /* Get the host_id in order to find the cluster */
         long host_id = 0;
-        boolean result = true;
-        boolean ret = true;
         for (DomainRouterVO router : routers) {
             host_id = router.getHostId();
+            /* TODO it's not completely safe to ignore these failure, but we would try to push on now */
             if (_routerMgr.stopRouter(router.getId(), false) == null) {
-                s_logger.warn("Failed to stop virtual router element " + router + " as a part of netowrk " + network + " restart");
-                ret = false;
+                s_logger.warn("Failed to stop virtual router element " + router + " as a part of network " + network + " restart");
             }
-            result = _routerMgr.destroyRouter(router.getId());
-            if (!result) {
-                s_logger.warn("Failed to destroy virtual router element " + router + " as a part of netowrk " + network + " restart");
-                ret = false;
+            if (!_routerMgr.destroyRouter(router.getId())) {
+                s_logger.warn("Failed to destroy virtual router element " + router + " as a part of network " + network + " restart");
             }
-           
         }
         
-        
+        /* The cluster here is only used to determine hypervisor type, not the real deployment */
         Cluster cluster = _configMgr.getCluster(_hostDao.findById(host_id).getClusterId());
         dest = new DeployDestination(dc, null, cluster, null);
-        implement(network, networkOffering, dest, context);
-        return ret;
+        return implement(network, networkOffering, dest, context);
     }
 
     @Override

From 18f2df44a15504a1584e75d995e7f56dc91e8512 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Wed, 10 Aug 2011 15:02:08 -0700
Subject: [PATCH 26/77] Clean up restart Network

---
 .../src/com/cloud/network/NetworkManagerImpl.java  | 14 ++++++++++++--
 .../network/element/VirtualRouterElement.java      |  2 +-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/server/src/com/cloud/network/NetworkManagerImpl.java b/server/src/com/cloud/network/NetworkManagerImpl.java
index 47bed8bf04e..e30225f3a69 100755
--- a/server/src/com/cloud/network/NetworkManagerImpl.java
+++ b/server/src/com/cloud/network/NetworkManagerImpl.java
@@ -2408,13 +2408,23 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
             s_logger.debug("Restarting network elements for the network " + network);
             for (NetworkElement element : _networkElements) {
                 // stop and start the network element
-                if (!element.restart(network, context)) {
-                    s_logger.warn("Failed to restart network element(s) as a part of network id" + networkId + " restart");
+                try {
+                    boolean supported = element.restart(network, context);
+                    if (!supported) {
+                        s_logger.trace("Network element(s) " + element.getName() + " doesn't support network id" + networkId + " restart");
+                    }
+                } catch (Exception ex) {
+                    s_logger.warn("Failed to restart network element" + element.getName() + " as a part of network id" + networkId + " restart", ex);
                     success = false;
                 }
+
             }
         }
 
+        if (!success) {
+            return false;
+        }
+
         // associate all ip addresses
         if (!applyIpAssociations(network, false)) {
             s_logger.warn("Failed to apply ip addresses as a part of network id" + networkId + " restart");
diff --git a/server/src/com/cloud/network/element/VirtualRouterElement.java b/server/src/com/cloud/network/element/VirtualRouterElement.java
index 2456ead776e..d4bfa290c99 100644
--- a/server/src/com/cloud/network/element/VirtualRouterElement.java
+++ b/server/src/com/cloud/network/element/VirtualRouterElement.java
@@ -152,7 +152,7 @@ public class VirtualRouterElement extends DhcpElement implements NetworkElement,
         long host_id = 0;
         for (DomainRouterVO router : routers) {
             host_id = router.getHostId();
-            /* TODO it's not completely safe to ignore these failure, but we would try to push on now */
+            /* FIXME it's not completely safe to ignore these failure, but we would try to push on now */
             if (_routerMgr.stopRouter(router.getId(), false) == null) {
                 s_logger.warn("Failed to stop virtual router element " + router + " as a part of network " + network + " restart");
             }

From 1bb057d113b20416473333f4def1bb7c3ad661fb Mon Sep 17 00:00:00 2001
From: keshav <keshav@cloud.com>
Date: Wed, 10 Aug 2011 15:56:01 -0700
Subject: [PATCH 27/77] Added configuration parameter to enable/disable the
 firewall rule UI.

---
 server/src/com/cloud/configuration/Config.java        |  2 +-
 .../src/com/cloud/upgrade/dao/Upgrade229to2210.java   | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/server/src/com/cloud/configuration/Config.java b/server/src/com/cloud/configuration/Config.java
index 67fae82f481..2ce461857b6 100755
--- a/server/src/com/cloud/configuration/Config.java
+++ b/server/src/com/cloud/configuration/Config.java
@@ -75,7 +75,7 @@ public enum Config {
 	SecurityGroupWorkCleanupInterval("Network", ManagementServer.class, Integer.class, "network.securitygroups.work.cleanup.interval", "120", "Time interval (seconds) in which finished work is cleaned up from the work table", null),
 	SecurityGroupWorkerThreads("Network", ManagementServer.class, Integer.class, "network.securitygroups.workers.pool.size", "50", "Number of worker threads processing the security group update work queue", null),
 	SecurityGroupWorkGlobalLockTimeout("Network", ManagementServer.class, Integer.class, "network.securitygroups.work.lock.timeout", "300", "Lock wait timeout (seconds) while updating the security group work queue", null),
-
+	FirewallRuleUiEnabled("Network", ManagementServer.class, Boolean.class, "firewall.rule.ui.enabled", "true", "enable/disable UI that separates firewall rules from NAT/LB rules", null),
 	
 	//VPN
 	RemoteAccessVpnPskLength("Network", AgentManager.class, Integer.class, "remote.access.vpn.psk.length", "24", "The length of the ipsec preshared key (minimum 8, maximum 256)", null),
diff --git a/server/src/com/cloud/upgrade/dao/Upgrade229to2210.java b/server/src/com/cloud/upgrade/dao/Upgrade229to2210.java
index a554154fa32..d457c833861 100644
--- a/server/src/com/cloud/upgrade/dao/Upgrade229to2210.java
+++ b/server/src/com/cloud/upgrade/dao/Upgrade229to2210.java
@@ -19,6 +19,8 @@ package com.cloud.upgrade.dao;
 
 import java.io.File;
 import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.SQLException;
 
 import org.apache.log4j.Logger;
 
@@ -55,6 +57,15 @@ public class Upgrade229to2210 implements DbUpgrade {
 
     @Override
     public void performDataMigration(Connection conn) {
+        PreparedStatement pstmt;
+        try {
+            pstmt = conn.prepareStatement("INSERT IGNORE INTO `cloud`.`configuration` (category, instance, name, value, description) VALUES ('Network', 'DEFAULT', 'firewall.rule.ui.enabled', 'true', 'enable/disable UI that separates firewall rules from NAT/LB rules')");
+            pstmt.execute();
+            
+            pstmt.close();
+        } catch (SQLException e) {
+            throw new CloudRuntimeException("Unable to perform data migration", e);
+        }
     }
 
     @Override

From 3c29f00de175e6aa7ba8329e345998e0df668ff3 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 16:00:12 -0700
Subject: [PATCH 28/77] bug 11013: Basic zone setup - pass domRs from other
 pods to addVirtualMachineToNetwork() method only when
 network.dns.basiczone.updates is set to "all" status 11013: resolved fixed

---
 .../cloud/network/element/DhcpElement.java    | 12 ++++++-
 .../VirtualNetworkApplianceManager.java       |  3 +-
 .../VirtualNetworkApplianceManagerImpl.java   | 32 +++++++++++--------
 3 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/server/src/com/cloud/network/element/DhcpElement.java b/server/src/com/cloud/network/element/DhcpElement.java
index a164b0f54d5..97dff205318 100644
--- a/server/src/com/cloud/network/element/DhcpElement.java
+++ b/server/src/com/cloud/network/element/DhcpElement.java
@@ -120,7 +120,17 @@ public class DhcpElement extends AdapterBase implements NetworkElement, Password
             VirtualMachineProfile<UserVm> uservm = (VirtualMachineProfile<UserVm>)vm;
             Map<VirtualMachineProfile.Param, Object> params = new HashMap<VirtualMachineProfile.Param, Object>(1);
             params.put(VirtualMachineProfile.Param.RestartNetwork, true);
-            List<DomainRouterVO> routers = _routerMgr.deployDhcp(network, dest, _accountMgr.getAccount(network.getAccountId()), uservm.getParameters());                                                                                                                        
+            List<DomainRouterVO> routers = _routerMgr.deployDhcp(network, dest, _accountMgr.getAccount(network.getAccountId()), uservm.getParameters());
+            
+            //for Basic zone, add all Running routers - we have to send Dhcp/vmData/password info to them when network.dns.basiczone.updates is set to "all"
+            Long podId = dest.getPod().getId();
+            DataCenter dc = dest.getDataCenter();
+            boolean isPodBased = (dc.getNetworkType() == NetworkType.Basic || network.isSecurityGroupEnabled()) && network.getTrafficType() == TrafficType.Guest;
+            if (isPodBased && _routerMgr.getDnsBasicZoneUpdate().equalsIgnoreCase("all")) {
+                List<DomainRouterVO> allRunningRoutersOutsideThePod = _routerDao.findByNetworkOutsideThePod(network.getId(), podId, State.Running);
+                routers.addAll(allRunningRoutersOutsideThePod);
+            }
+            
             List<VirtualRouter> rets = _routerMgr.addVirtualMachineIntoNetwork(network, nic, uservm, dest, context, routers);                                                                                                                      
             return (rets != null) && (!rets.isEmpty());
         } else {
diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java
index c4d41d70cec..2fc0902d21f 100644
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java
@@ -72,7 +72,6 @@ public interface VirtualNetworkApplianceManager extends Manager, VirtualNetworkA
 	
 	List<DomainRouterVO> deployDhcp(Network guestNetwork, DeployDestination dest, Account owner, Map<VirtualMachineProfile.Param, Object> params) throws InsufficientCapacityException, ResourceUnavailableException, ConcurrentOperationException;
 	
-
 	List<VirtualRouter> addVirtualMachineIntoNetwork(Network config, NicProfile nic, VirtualMachineProfile<UserVm> vm, DeployDestination dest, ReservationContext context, List<DomainRouterVO> routers) throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException;
 	
     boolean startRemoteAccessVpn(Network network, RemoteAccessVpn vpn) throws ResourceUnavailableException;
@@ -88,4 +87,6 @@ public interface VirtualNetworkApplianceManager extends Manager, VirtualNetworkA
     String[] applyVpnUsers(Network network, List<? extends VpnUser> users) throws ResourceUnavailableException;
     
     VirtualRouter stop(VirtualRouter router, boolean forced, User callingUser, Account callingAccount) throws ConcurrentOperationException, ResourceUnavailableException;
+
+    String getDnsBasicZoneUpdate();
 }
diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index ff186874e4f..51cb9c8ec37 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -78,7 +78,6 @@ import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.HostPodVO;
 import com.cloud.dc.dao.AccountVlanMapDao;
 import com.cloud.dc.dao.DataCenterDao;
-import com.cloud.dc.dao.DcDetailsDaoImpl;
 import com.cloud.dc.dao.HostPodDao;
 import com.cloud.dc.dao.VlanDao;
 import com.cloud.deploy.DataCenterDeployment;
@@ -1068,11 +1067,6 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
             }
 
             if (!routers.isEmpty()) {
-                //for Basic zone, add all Running routers - we have to send Dhcp/vmData/password info to them when network.dns.basiczone.updates is set to "all"
-                if (isPodBased) {
-                    List<DomainRouterVO> allRunningRoutersOutsideThePod = _routerDao.findByNetworkOutsideThePod(guestNetwork.getId(), podId, State.Running);
-                    routers.addAll(allRunningRoutersOutsideThePod);
-                }
                 return routers;
             }
 
@@ -1128,6 +1122,7 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                 _networkDao.releaseFromLockTable(network.getId());
             }
         }
+        
         return routers;
     }
 
@@ -1587,21 +1582,27 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
             throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException {
 
         List<VirtualRouter> rets = new ArrayList<VirtualRouter>(routers.size());
+        
+        boolean sendPasswordAndVmData = true;
+        boolean sendDnsDhcpData = true;
+        _userVmDao.loadDetails((UserVmVO) profile.getVirtualMachine());
+        
+        DataCenter dc = dest.getDataCenter();
+        String serviceOffering = _serviceOfferingDao.findByIdIncludingRemoved(profile.getServiceOfferingId()).getDisplayText();
+        String zoneName = _dcDao.findById(network.getDataCenterId()).getName();
+        boolean isZoneBasic = (dc.getNetworkType() == NetworkType.Basic);
 
         for (DomainRouterVO router : routers) {
             if (router.getState() != State.Running) {
                 s_logger.warn("Unable to add virtual machine " + profile.getVirtualMachine() + " to the router " + router + " as the router is not in Running state");
                 continue;
             }
-            boolean sendPasswordAndVmData = true;
-            boolean sendDnsDhcpData = true;
-            _userVmDao.loadDetails((UserVmVO) profile.getVirtualMachine());
             
             //for basic zone: 
             //1) send vm data/password information only to the dhcp in the same pod
             //2) send dhcp/dns information to all routers in the cloudstack only when _dnsBasicZoneUpdates is set to "all" value
-            DataCenter dc = dest.getDataCenter();
-            if (dc.getNetworkType() == NetworkType.Basic) {
+           
+            if (isZoneBasic) {
                 Long podId = dest.getPod().getId();
                 if (router.getPodIdToDeployIn().longValue() != podId.longValue()) {
                     sendPasswordAndVmData = false;
@@ -1650,8 +1651,7 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                     cmds.addCommand("password", cmd);
                 }
 
-                String serviceOffering = _serviceOfferingDao.findByIdIncludingRemoved(profile.getServiceOfferingId()).getDisplayText();
-                String zoneName = _dcDao.findById(network.getDataCenterId()).getName();
+                
 
                 cmds.addCommand(
                         "vmdata",
@@ -2184,4 +2184,10 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
         // Send commands to router
         return sendCommandsToRouter(router, cmds);
     }
+    
+    @Override
+    public String getDnsBasicZoneUpdate() {
+        return _dnsBasicZoneUpdates;
+    }
+    
 }

From fde6e7d80179586791253b1d3a9d3f02759e98c9 Mon Sep 17 00:00:00 2001
From: Edison Su <edison@cloud.com>
Date: Wed, 10 Aug 2011 16:16:31 -0700
Subject: [PATCH 29/77] bug 11064: add setfirewallrule for kvm

---
 .../VirtualRoutingResource.java               | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java b/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
index 79cc808be7d..f8ff6766ecb 100755
--- a/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
+++ b/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
@@ -52,6 +52,8 @@ import com.cloud.agent.api.routing.IpAssocAnswer;
 import com.cloud.agent.api.routing.LoadBalancerConfigCommand;
 import com.cloud.agent.api.routing.NetworkElementCommand;
 import com.cloud.agent.api.routing.SavePasswordCommand;
+import com.cloud.agent.api.routing.SetFirewallRulesAnswer;
+import com.cloud.agent.api.routing.SetFirewallRulesCommand;
 import com.cloud.agent.api.routing.SetPortForwardingRulesAnswer;
 import com.cloud.agent.api.routing.SetPortForwardingRulesCommand;
 import com.cloud.agent.api.routing.SetStaticNatRulesAnswer;
@@ -121,6 +123,8 @@ public class VirtualRoutingResource implements Manager {
                 return execute ((VmDataCommand)cmd);
             } else if (cmd instanceof CheckRouterCommand) {
                 return execute ((CheckRouterCommand)cmd);
+            } else if (cmd instanceof SetFirewallRulesCommand) {
+                return execute((SetFirewallRulesCommand)cmd);
             } else {
                 return Answer.createUnsupportedCommandAnswer(cmd);
             }
@@ -129,6 +133,40 @@ public class VirtualRoutingResource implements Manager {
         }
     }
 
+    private Answer execute(SetFirewallRulesCommand cmd) {
+        String[] results = new String[cmd.getRules().length];
+        for (int i =0; i < cmd.getRules().length; i++) {
+            results[i] = "Failed";
+        }
+        String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
+
+        if (routerIp == null) {
+            return new SetFirewallRulesAnswer(cmd, false, results);
+        }
+
+        String[][] rules = cmd.generateFwRules();
+        final Script command = new Script(_firewallPath, _timeout, s_logger);
+        command.add(routerIp);
+        command.add("-F");
+        
+        StringBuilder sb = new StringBuilder();
+        String[] fwRules = rules[0];
+        if (fwRules.length > 0) {
+            for (int i = 0; i < fwRules.length; i++) {
+                sb.append(fwRules[i]).append(',');
+            }
+            command.add("-a", sb.toString());
+        }
+       
+        String result = command.execute();
+        if (result != null) {
+            return new SetFirewallRulesAnswer(cmd, false, results);
+        }
+        return new SetFirewallRulesAnswer(cmd, true, null);
+        
+        
+    }
+
     private Answer execute(SetPortForwardingRulesCommand cmd) {
         String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
         String[] results = new String[cmd.getRules().length];

From 1a1b8d7ad14b96d2a56199033061b7400a0ae3b0 Mon Sep 17 00:00:00 2001
From: frank <frank@cloud.com>
Date: Wed, 10 Aug 2011 16:23:29 -0700
Subject: [PATCH 30/77] sync ipmi changes from master

---
 scripts/util/ipmi.py | 256 ++++++++++++++++++++++---------------------
 1 file changed, 133 insertions(+), 123 deletions(-)

diff --git a/scripts/util/ipmi.py b/scripts/util/ipmi.py
index 40ff2153837..7385f1e39da 100644
--- a/scripts/util/ipmi.py
+++ b/scripts/util/ipmi.py
@@ -27,134 +27,144 @@ from os.path import exists
 TOOl_PATH = "/usr/bin/ipmitool"
 
 try:
-	from subprocess import check_call
-	from subprocess import CalledProcessError
+    from subprocess import check_call
+    from subprocess import CalledProcessError
 except ImportError:
-	def check_call(*popenargs, **kwargs):
-		import subprocess
-		retcode = subprocess.call(*popenargs, **kwargs)
-		cmd = kwargs.get("args")
-		if cmd is None: cmd = popenargs[0]
-		if retcode: raise CalledProcessError(retcode, cmd)
-		return retcode
+    def check_call(*popenargs, **kwargs):
+        import subprocess
+        retcode = subprocess.call(*popenargs, **kwargs)
+        cmd = kwargs.get("args")
+        if cmd is None: cmd = popenargs[0]
+        if retcode: raise CalledProcessError(retcode, cmd)
+        return retcode
 
-	class CalledProcessError(Exception):
-		def __init__(self, returncode, cmd):
-			self.returncode = returncode ; self.cmd = cmd
-		def __str__(self): return "Command '%s' returned non-zero exit status %d" % (self.cmd, self.returncode)
+    class CalledProcessError(Exception):
+        def __init__(self, returncode, cmd):
+            self.returncode = returncode ; self.cmd = cmd
+        def __str__(self): return "Command '%s' returned non-zero exit status %d" % (self.cmd, self.returncode)
 
 class Command:
-	def __init__(self,name,parent=None):
-		self.__name = name
-		self.__parent = parent
-	def __getattr__(self,name):
-		if name == "_print": name = "print"
-		return Command(name,self)
-	def __call__(self,*args):
-		class CommandOutput:
-			def __init__(self,ret,stdout,stderr):
-				self.stdout = stdout
-				self.stderr = stderr
-				self.ret = ret
+    def __init__(self,name,parent=None):
+        self.__name = name
+        self.__parent = parent
+    def __getattr__(self,name):
+        if name == "_print": name = "print"
+        return Command(name,self)
+    def __call__(self,*args):
+        class CommandOutput:
+            def __init__(self,ret,stdout,stderr):
+                self.stdout = stdout
+                self.stderr = stderr
+                self.ret = ret
 
-		cmd = self.__get_recursive_name() + list(args)
-		#print "	",cmd
-		popen = subprocess.Popen(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
-		m = popen.communicate()
-		ret = popen.wait()
-		return CommandOutput(ret,*m)
-	def __get_recursive_name(self,sep=None):
-		m = self
-		l = []
-		while m is not None:
-			l.append(m.__name)
-			m = m.__parent
-		l.reverse()
-		if sep: return sep.join(l)
-		else: return l
-	def __str__(self):
-		return '<Command %r>'%self.__get_recursive_name(sep=" ")
-		
-	def __repr__(self): return self.__str__()
+        cmd = self.__get_recursive_name() + list(args)
+        #print "    ",cmd
+        popen = subprocess.Popen(cmd,stdout=subprocess.PIPE,stderr=subprocess.PIPE)
+        m = popen.communicate()
+        ret = popen.wait()
+        return CommandOutput(ret,*m)
+    def __get_recursive_name(self,sep=None):
+        m = self
+        l = []
+        while m is not None:
+            l.append(m.__name)
+            m = m.__parent
+        l.reverse()
+        if sep: return sep.join(l)
+        else: return l
+    def __str__(self):
+        return '<Command %r>'%self.__get_recursive_name(sep=" ")
+        
+    def __repr__(self): return self.__str__()
 
 
 ipmitool = Command("ipmitool")
 
 def check_tool():
-	if exists(TOOl_PATH) == False:
-		print "Can not find ipmitool"
-		return False
+    if exists(TOOl_PATH) == False:
+        print "Can not find ipmitool"
+        return False
 
 def ping(args):
-	hostname = args.get("hostname")
-	usrname = args.get("usrname")
-	password = args.get("password")
+    hostname = args.get("hostname")
+    usrname = args.get("usrname")
+    password = args.get("password")
 
-	if hostname == None:
-		print "No hostname"
-		return 1
+    if hostname == None:
+        print "No hostname"
+        return 1
 
-	o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", "status")
-	if o.ret:
-		print o.stderr
-		return 1
-	else:
-		print o.stdout
-		return 0
+    o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", "status")
+    if o.ret:
+        print o.stderr
+        return 1
+    else:
+        print o.stdout
+        return 0
 
 def boot_dev(args):
-	hostname = args.get("hostname")
-	usrname = args.get("usrname")
-	password = args.get("password")
-	dev = args.get("dev")
+    hostname = args.get("hostname")
+    usrname = args.get("usrname")
+    password = args.get("password")
+    dev = args.get("dev")
 
-	if hostname == None:
-		print "No hostname"
-		return 1
+    if hostname == None:
+        print "No hostname"
+        return 1
 
-	if dev == None:
-		print "No boot device specified"
-		return 1
+    if dev == None:
+        print "No boot device specified"
+        return 1
 
-	o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "bootdev", dev)
-	if o.ret:
-		print o.stderr
-		return 1
-	else:
-		return 0
+    o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "bootdev", dev)
+    if o.ret:
+        print o.stderr
+        return 1
+    else:
+        return 0
 
 def reboot(args):
-	hostname = args.get("hostname")
-	usrname = args.get("usrname")
-	password = args.get("password")
+    hostname = args.get("hostname")
+    usrname = args.get("usrname")
+    password = args.get("password")
 
-	if hostname == None:
-		print "No hostname"
-		return 1
+    if hostname == None:
+        print "No hostname"
+        return 1
 
-	o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", "reset")
-	if o.ret:
-		print o.stderr
-		return 1
-	else:
-		return 0
+    o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", "status")
+    if o.ret:
+        print o.stderr
+        return 1
+    
+
+    if "is on" in o.stdout:
+        o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", "cycle")
+    else:
+        o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", "reset")
+        
+    if o.ret:
+        print o.stderr
+        return 1
+    else:
+        return 0
 
 def power(args):
-	hostname = args.get("hostname")
-	usrname = args.get("usrname")
-	password = args.get("password")
-	action = args.get("action")
+    hostname = args.get("hostname")
+    usrname = args.get("usrname")
+    password = args.get("password")
+    action = args.get("action")
 
-	if hostname == None:
-		print "No hostname"
-		return 1
+    if hostname == None:
+        print "No hostname"
+        return 1
 
-	o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", action)
-	if o.ret:
-		print o.stderr
-		return 1
-	else:
-		return 0
+    o = ipmitool("-H", hostname, "-U", usrname, "-P", password, "chassis", "power", action)
+    if o.ret:
+        print o.stderr
+        return 1
+    else:
+        return 0
 
 def boot_or_reboot(args):
     hostname = args.get("hostname")
@@ -166,39 +176,39 @@ def boot_or_reboot(args):
         return 1
     
     if "is on" in o.stdout:
-        args["action"] = "reset"
+        return reboot(args)
     elif "is off" in o.stdout:
         args["action"] = "on"
+        return power(args)
     else:
         print "unknown power status:" + o.stdout
         return 1
     
-    return power(args)
 
 call_table = {"ping":ping, "boot_dev":boot_dev, "reboot":reboot, "power":power, "boot_or_reboot":boot_or_reboot}
 def dispatch(args):
-	cmd = args[1]
-	params = args[2:]
-	func_params = {}
+    cmd = args[1]
+    params = args[2:]
+    func_params = {}
 
-	if call_table.has_key(cmd) == False:
-		print "No function %s" % cmd
-		return 1
+    if call_table.has_key(cmd) == False:
+        print "No function %s" % cmd
+        return 1
 
-	for p in params:
-		pairs = p.split("=")
-		if len(pairs) != 2:
-			print "Invalid parameter %s" % p
-			return 1
-		func_params[pairs[0]] = pairs[1]
+    for p in params:
+        pairs = p.split("=")
+        if len(pairs) != 2:
+            print "Invalid parameter %s" % p
+            return 1
+        func_params[pairs[0]] = pairs[1]
 
-	func = call_table[cmd]
-	return func(func_params)
+    func = call_table[cmd]
+    return func(func_params)
 
 if __name__ == "__main__":
-	if check_tool() == False:
-		sys.exit(1)
-	if len(sys.argv) < 2:
-		print "Not enough arguments, at least one"
-		sys.exit(1)
-	sys.exit(dispatch(sys.argv))
+    if check_tool() == False:
+        sys.exit(1)
+    if len(sys.argv) < 2:
+        print "Not enough arguments, at least one"
+        sys.exit(1)
+    sys.exit(dispatch(sys.argv))

From dc116d99a85a189ae52b348080b84020e276666b Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 16:38:53 -0700
Subject: [PATCH 31/77] Get ipAddress info not from the rule, but from the
 request parameter ipAddressId

---
 .../com/cloud/api/commands/CreateIpForwardingRuleCmd.java   | 2 +-
 .../com/cloud/api/commands/CreatePortForwardingRuleCmd.java | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java b/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
index d6f2797fb5e..e2798eafea9 100644
--- a/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
+++ b/api/src/com/cloud/api/commands/CreateIpForwardingRuleCmd.java
@@ -112,7 +112,7 @@ public class CreateIpForwardingRuleCmd extends BaseAsyncCreateCmd implements Sta
             UserContext.current().setEventDetails("Rule Id: "+ getEntityId());
             
             if (getOpenFirewall()) {
-                result = result && _firewallService.applyFirewallRules(rule.getSourceIpAddressId(), UserContext.current().getCaller());
+                result = result && _firewallService.applyFirewallRules(ipAddressId, UserContext.current().getCaller());
             }
             
             result = result && _rulesService.applyStaticNatRules(ipAddressId, UserContext.current().getCaller());
diff --git a/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java b/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java
index 84a6a8f15e4..f0d390ad2f4 100644
--- a/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java
+++ b/api/src/com/cloud/api/commands/CreatePortForwardingRuleCmd.java
@@ -125,15 +125,15 @@ public class CreatePortForwardingRuleCmd extends BaseAsyncCreateCmd implements P
     public void execute() throws ResourceUnavailableException {
         UserContext callerContext = UserContext.current();
         boolean success = true;
-        PortForwardingRule rule = _entityMgr.findById(PortForwardingRule.class, getEntityId());
+        PortForwardingRule rule = null;
         try {
             UserContext.current().setEventDetails("Rule Id: " + getEntityId());
             
             if (getOpenFirewall()) {
-                success = success && _firewallService.applyFirewallRules(rule.getSourceIpAddressId(), callerContext.getCaller());
+                success = success && _firewallService.applyFirewallRules(ipAddressId, callerContext.getCaller());
             }
             
-            success = success && _rulesService.applyPortForwardingRules(rule.getSourceIpAddressId(), callerContext.getCaller());
+            success = success && _rulesService.applyPortForwardingRules(ipAddressId, callerContext.getCaller());
 
             // State is different after the rule is applied, so get new object here
             rule = _entityMgr.findById(PortForwardingRule.class, getEntityId());

From 02049d4cd48932a3fd02208fdf032eec26b8a8ff Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Wed, 10 Aug 2011 17:11:38 -0700
Subject: [PATCH 32/77] Fix dhcp_entry.sh fail on redundant router

And don't worry about "chkconfig dnsmasq off", because keepalived script should
take care of it.
---
 .../debian/config/etc/init.d/cloud-early-config    |  2 +-
 .../debian/config/opt/cloud/bin/patchsystemvm.sh   |  3 ++-
 patches/systemvm/debian/config/root/edithosts.sh   | 14 ++++++++++++--
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index 2785816331d..69c1daa8dc4 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -325,7 +325,7 @@ setup_redundant_router() {
     sed -i "s/\[ETH2IP\]/$ETH2_IP/g" /root/redundant_router/enable_pubip.sh
     sed -i "s/\[GATEWAY\]/$GW/g" /root/redundant_router/enable_pubip.sh
     sed -i "s/--exec\ \$DAEMON;/--exec\ \$DAEMON\ --\ --vrrp;/g" /etc/init.d/keepalived
-    grep "sleep 10;" /etc/init.d/keepalived > /dev/null
+    #grep "sleep 10;" /etc/init.d/keepalived > /dev/null
     if [ $? -ne 0 ]
     then
         sed -i "s/if\ start-stop-daemon\ --start/sleep\ 10;if\ start-stop-daemon\ --start/g" /etc/init.d/keepalived
diff --git a/patches/systemvm/debian/config/opt/cloud/bin/patchsystemvm.sh b/patches/systemvm/debian/config/opt/cloud/bin/patchsystemvm.sh
index 7d95d8bc12d..8adcca49a96 100755
--- a/patches/systemvm/debian/config/opt/cloud/bin/patchsystemvm.sh
+++ b/patches/systemvm/debian/config/opt/cloud/bin/patchsystemvm.sh
@@ -72,15 +72,16 @@ routing_svcs() {
    chkconfig cloud off
    chkconfig cloud-passwd-srvr on ; 
    chkconfig haproxy on ; 
-   chkconfig dnsmasq on
    chkconfig ssh on
    chkconfig nfs-common off
    chkconfig portmap off
    if [ $RROUTER -eq 0 ]
    then
+       chkconfig dnsmasq off
        chkconfig postinit on
        echo "postinit" > /var/cache/cloud/enabled_svcs
    else
+       chkconfig dnsmasq on
        chkconfig keepalived off
        chkconfig conntrackd off
    fi
diff --git a/patches/systemvm/debian/config/root/edithosts.sh b/patches/systemvm/debian/config/root/edithosts.sh
index ae4fcfb598b..478ce4ba552 100755
--- a/patches/systemvm/debian/config/root/edithosts.sh
+++ b/patches/systemvm/debian/config/root/edithosts.sh
@@ -25,6 +25,9 @@
 # $2 : the associated ip address
 # $3 : the hostname
 
+grep "redundant_router=1" /var/cache/cloud/cmdline > /dev/null
+no_redundant=$?
+
 wait_for_dnsmasq () {
   local _pid=$(pidof dnsmasq)
   for i in 0 1 2 3 4 5 6 7 8 9 10
@@ -34,10 +37,12 @@ wait_for_dnsmasq () {
     [ "$_pid" != "" ] && break;
   done
   [ "$_pid" != "" ] && return 0;
-  echo "edithosts: timed out waiting for dnsmasq to start"
+  logger -t cloud "edithosts: timed out waiting for dnsmasq to start"
   return 1
 }
 
+logger -t cloud "edithosts: update $1 $2 $3 to hosts"
+
 [ ! -f /etc/dhcphosts.txt ] && touch /etc/dhcphosts.txt
 [ ! -f /var/lib/misc/dnsmasq.leases ] && touch /var/lib/misc/dnsmasq.leases
 
@@ -68,7 +73,12 @@ if [ "$pid" != "" ]
 then
   service dnsmasq restart
 else
-  wait_for_dnsmasq
+  if [ $no_redundant -eq 1 ]
+  then
+      wait_for_dnsmasq
+  else
+      logger -t cloud "edithosts: skip wait dnsmasq due to redundant virtual router"
+  fi
 fi
 
 exit $?

From 3a2790abdcbe3a3e0c3f55ffd6f4e0e5f34ce1e2 Mon Sep 17 00:00:00 2001
From: anthony <anthony@cloud.com>
Date: Wed, 10 Aug 2011 17:36:24 -0700
Subject: [PATCH 33/77] bug 10504: what is happening is, MS use vdi-copy to
 create template from volume, then get physical size from XAPI, the physical
 size might be wrong , SR-SCAN is needed before getting physical size to make
 XenServer pick the new physical size.

status 10504: resolved fixed
---
 .../com/cloud/hypervisor/xen/resource/CitrixResourceBase.java  | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index b85517a5909..0a720014021 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -5644,7 +5644,8 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
 
             // copy volume to template SR
             VDI tmpltVDI = cloudVDIcopy(conn, volume, tmpltSR);
-            
+            // scan makes XenServer pick up VDI physicalSize
+            tmpltSR.scan(conn);
             if (userSpecifiedName != null) {
                 tmpltVDI.setNameLabel(conn, userSpecifiedName);
             }

From 8c70e065726ce1949871b565ceb3cfb9c5318f96 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Wed, 10 Aug 2011 18:07:00 -0700
Subject: [PATCH 34/77] Fix existed single router network after enable
 redundant router feature

---
 .../network/router/VirtualNetworkApplianceManagerImpl.java | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 51cb9c8ec37..bf60675a1ee 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -867,6 +867,13 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                 routerCount = 2;
             }
 
+            /* If it is the single router network, then keep it untouched */
+            for (DomainRouterVO router : routers) {
+                if (!router.getIsRedundantRouter()) {
+                    routerCount = 1;
+                }
+            }
+
             if (routers.size() == routerCount) {
                 return routers;
             }

From 13a9c1d589b91a9c116d2b1a2ebf50006ee02ab3 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 18:22:47 -0700
Subject: [PATCH 35/77] Fixed capability check in rule validation

---
 .../network/firewall/FirewallManagerImpl.java | 22 ++++++++++++++-----
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index b6cea06e7f7..93514ced6d6 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -295,13 +295,23 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         }
         
         // Verify that the network guru supports the protocol specified
-        Map<Network.Capability, String> firewallCapabilities = _networkMgr.getServiceCapabilities(network.getDataCenterId(), network.getNetworkOfferingId(), Service.Firewall);
-        String supportedProtocols = firewallCapabilities.get(Capability.SupportedProtocols).toLowerCase();
-        if (!supportedProtocols.contains(proto.toLowerCase())) {
-            throw new InvalidParameterValueException("Protocol " + proto + " is not supported in zone " + network.getDataCenterId());
-        } else if (proto.equalsIgnoreCase(NetUtils.ICMP_PROTO) && purpose != Purpose.Firewall) {
-            throw new InvalidParameterValueException("Protocol " + proto + " is currently supported only for rules with purpose " + Purpose.Firewall);
+        Map<Network.Capability, String> protocolCapabilities = null;
+        
+        if (purpose == Purpose.LoadBalancing) {
+            protocolCapabilities = _networkMgr.getServiceCapabilities(network.getDataCenterId(), network.getNetworkOfferingId(), Service.Lb);
+        } else {
+            protocolCapabilities = _networkMgr.getServiceCapabilities(network.getDataCenterId(), network.getNetworkOfferingId(), Service.Firewall);
         }
+        
+        if (protocolCapabilities != null) {
+            String supportedProtocols = protocolCapabilities.get(Capability.SupportedProtocols).toLowerCase();
+            if (!supportedProtocols.contains(proto.toLowerCase())) {
+                throw new InvalidParameterValueException("Protocol " + proto + " is not supported in zone " + network.getDataCenterId());
+            } else if (proto.equalsIgnoreCase(NetUtils.ICMP_PROTO) && purpose != Purpose.Firewall) {
+                throw new InvalidParameterValueException("Protocol " + proto + " is currently supported only for rules with purpose " + Purpose.Firewall);
+            }
+        }
+        
     }
     
     @Override

From d29b01ca7f2c9c9e9d7c78b73b9cd18951197549 Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Wed, 10 Aug 2011 18:06:43 -0700
Subject: [PATCH 36/77] bug 10561: backend rules for firewall

---
 .../api/routing/SetFirewallRulesCommand.java  |   2 +-
 .../debian/config/root/firewall_rule.sh       | 189 +++++++++++-------
 2 files changed, 114 insertions(+), 77 deletions(-)

diff --git a/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java b/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
index f5842d1bead..cfc5455e8d8 100644
--- a/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
+++ b/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
@@ -55,7 +55,7 @@ public class SetFirewallRulesCommand extends NetworkElementCommand {
 			
 			List<String> cidr;
 			StringBuilder sb = new StringBuilder();
-			sb.append(fwTO.getProtocol()).append(":");
+			sb.append(fwTO.getSrcIp()).append(":").append(fwTO.getProtocol()).append(":");
 			if ("icmp".compareTo(fwTO.getProtocol()) == 0)
 			{
 				sb.append(fwTO.getIcmpType()).append(":").append(fwTO.getIcmpCode()).append(":");
diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index 84d670873a8..960b8fd3ca2 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -1,83 +1,86 @@
 #!/usr/bin/env bash
- 
-# $Id: firewall.sh 9947 2010-06-25 19:34:24Z manuel $ $HeadURL: svn://svn.lab.vmops.com/repos/vmdev/java/patches/xenserver/root/loadbalancer.sh $
+#
+# Copyright (C) 2010 Cloud.com, Inc.  All rights reserved.
+# 
+# This software is licensed under the GNU General Public License v3 or later.
+# 
+# It is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or any later version.
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+# 
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# firewall_rule.sh -- allow some ports / protocols to vm instances
 #
 #
 # @VERSION@
-echo $* >> /tmp/jana.log
+ 
 usage() {
-  printf "Usage: %s: -F  -a <added public ip address protocol:startport:endport:sourcecidr>  \n" $(basename $0) >&2
-# scourcecidrs format:  n1-n2-n3-n4
+  printf "Usage: %s:  -a <public ip address:protocol:startport:endport:sourcecidrs>  \n" $(basename $0) >&2
+  printf "sourcecidrs format:  cidr1-cidr2-cidr3-...\n"
 }
 
-# set -x
-
 #FIXME: eating up the error code during execution of iptables
 fw_remove_backup() {
-  for vif in $VIF_LIST; do 
-    sudo iptables -F back_firewall_rules_$vif 2> /dev/null
-    sudo iptables -D INPUT -i $vif  -j back_firewall_rules_$vif 2> /dev/null
-    sudo iptables -X back_firewall_rules_$vif 2> /dev/null
-  done
+  local pubIp=$1
+  sudo iptables -t mangle -F _FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -D PREROUTING   -j _FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -X _FIREWALL_$pubIp 2> /dev/null
 }
+
 fw_restore() {
-  for vif in $VIF_LIST; do 
-    sudo iptables -F firewall_rules_$vif 2> /dev/null
-    sudo iptables -D INPUT -i $vif   -j firewall_rules_$vif 2> /dev/null
-    sudo iptables -X firewall_rules_$vif 2> /dev/null
-    sudo iptables -E back_firewall_rules_$vif firewall_rules_$vif 2> /dev/null
-  done
+  local pubIp=$1
+  sudo iptables -t mangle -F FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -D PREROUTING   -j FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -X FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -E _FIREWALL_$pubIp FIREWALL_$pubIp 2> /dev/null
 }
-# firewall entry to ensure that haproxy can receive on specified port
-fw_entry() {
-  local added=$1
-  
-  if [ "$added" == "none" ]
-  then
-  	added=""
-  fi
-  
-  
-  local a=$(echo $added | cut -d, -f1- --output-delimiter=" ")
 
-# back up the iptable rules by renaming before creating new. 
-  for vif in $VIF_LIST; do 
-    sudo iptables -E firewall_rules_$vif back_firewall_rules_$vif 2> /dev/null
-    sudo iptables -N firewall_rules_$vif 2> /dev/null
-    sudo iptables -A INPUT -i $vif -j firewall_rules_$vif
-  done
+fw_chain_for_ip () {
+  local pubIp=$1
+  sudo iptables -t mangle -E FIREWALL_$pubIp _FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -N FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -A FIREWALL_$pubIp -j DROP> /dev/null
+  sudo iptables -t mangle -I PREROUTING -d $pubIp -j FIREWALL_$pubIp
+}
 
-  for i in $a
+fw_entry_for_public_ip() {
+  local rules=$1
+
+  local pubIp=$(echo $rules | cut -d: -f1)
+  local prot=$(echo $rules | cut -d: -f2)
+  local sport=$(echo $rules | cut -d: -f3)    
+  local eport=$(echo $rules | cut -d: -f4)    
+  local scidrs=$(echo $rules | cut -d: -f5 | sed 's/-/ /g')
+  
+  logger -t cloud "$(basename $0): enter apply firewall rules for public ip $pubIp:$prot:$sport:$eport:$scidrs"  
+
+
+  for src in $scidrs
   do
-    local prot=$(echo $i | cut -d: -f1)
-    local sport=$(echo $i | cut -d: -f2)    
-    local eport=$(echo $i | cut -d: -f3)    
-    local scidrs=$(echo $i | cut -d: -f4 | sed 's/-/,/g')
- 
-    
-    for vif in $VIF_LIST; do 
-      if [ "$prot" == "icmp" ]
+    if [ "$prot" == "icmp" ]
+    then
+    # TODO  icmp code need to be implemented
+    # sport is icmpType , dport is icmpcode 
+      if [ "$sport" == "-1" ]
       then
-# TODO  icmp code need to be implemented
-# sport is icmpType , dport is icmpcode 
-	 if [ "$sport" == "-1" ]
-         then
-             sudo iptables -A firewall_rules_$vif -s $scidrs -p $prot  -j ACCEPT
-         else
-             sudo iptables -A firewall_rules_$vif -s $scidrs -p $prot --icmp-type $sport  -j ACCEPT
-         fi
-      else
-         sudo iptables -A firewall_rules_$vif -s $scidrs -p $prot --dport $sport:$eport -j ACCEPT
-      fi
-      
-      if [ $? -gt 0 ]
-      then
-        return 1
-      fi
-    done      
+           sudo iptables -t mangle -I FIREWALL_$pubIp -s $src -p $prot  -j RETURN
+       else
+           sudo iptables -t mangle -I FIREWALL_$pubIp -s $src -p $prot --icmp-type $sport  -j RETURN
+       fi
+    else
+       sudo iptables -t mangle -I FIREWALL_$pubIp -s $src -p $prot --dport $sport:$eport -j RETURN
+  fi
   done
- 
-  return 0
+  result=$?
+      
+  logger -t cloud "$(basename $0): exit apply firewall rules for public ip $pubIp"  
+  return $result
 }
 
 get_vif_list() {
@@ -99,6 +102,7 @@ get_vif_list() {
 }
 
 shift 
+rules=
 while getopts 'a:' OPTION
 do
   case $OPTION in
@@ -118,21 +122,54 @@ then
   rules="none"
 fi
 
-# iptables entry to ensure that haproxy receives traffic
-fw_entry $rules 
-  	
-if [ $? -gt 0 ]
-then
-  logger -t cloud "Reverting firewall config"
-  # Revert iptables rules on DomR
-  fw_restore
+#-a 172.16.92.44:tcp:80:80:0.0.0.0/0:,172.16.92.44:tcp:220:220:0.0.0.0/0:,172.16.92.44:tcp:222:222:192.168.10.0/24-75.57.23.0/22-88.100.33.1/32
 
-  exit 1
-else
-  # Remove backedup iptable rules
-  fw_remove_backup
+
+success=0
+publicIps=
+rules_list=$(echo $rules | cut -d, -f1- --output-delimiter=" ")
+for r in $rules_list
+do
+  pubIp=$(echo $r | cut -d: -f1)
+  publicIps="$pubIp $publicIps"
+done
+
+unique_ips=$(echo $publicIps| tr " " "\n" | sort | uniq | tr "\n" " ")
+
+for u in $unique_ips
+do
+  fw_chain_for_ip $u
+done
+
+for r in $rules_list
+do
+  pubIp=$(echo $r | cut -d: -f1)
+  fw_entry_for_public_ip $r
+  success=$?
+  if [ $success -gt 0 ]
+  then
+    logger -t cloud "$(basename $0): failure to apply fw rules for ip $pubIp"
+    break
+  else
+    logger -t cloud "$(basename $0): successful in applying fw rules for ip $pubIp"
+  fi
+done
+
+if [ $success -gt 0 ]
+then
+    for p in $unique_ips
+    do
+      logger -t cloud "$(basename $0): restoring from backup for ip: $p"
+      fw_restore $p
+    done
+else 
+    for p in $unique_ips
+    do
+      logger -t cloud "$(basename $0): deleting backup for ip: $p"
+      fw_remove_backup $p
+    done
 fi
- 
+
 exit 0
   	
 

From 0805dbd3fbfe80de4c2209069ea0aed373f09fd9 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 19:11:12 -0700
Subject: [PATCH 37/77] Fixed rule validation for ICMP protocol

---
 .../src/com/cloud/network/firewall/FirewallManagerImpl.java   | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index 93514ced6d6..f47e6f3d4af 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -220,8 +220,6 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         List<FirewallRuleVO> rules = _firewallDao.listByIpAndPurposeAndNotRevoked(newRule.getSourceIpAddressId(), null);
         assert (rules.size() >= 1) : "For network rules, we now always first persist the rule and then check for network conflicts so we should at least have one rule at this point.";
 
-        
-        
         for (FirewallRuleVO rule : rules) {
             if (rule.getId() == newRule.getId()) {
                 continue; // Skips my own rule.
@@ -256,7 +254,7 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
             }
             
             if (newRule.getProtocol().equalsIgnoreCase(NetUtils.ICMP_PROTO) && newRule.getProtocol().equalsIgnoreCase(rule.getProtocol())) {
-                if (newRule.getIcmpCode().longValue() == rule.getIcmpCode().longValue() || newRule.getIcmpType().longValue() == rule.getIcmpType().longValue() || newRule.getProtocol().equalsIgnoreCase(rule.getProtocol())) {
+                if (newRule.getIcmpCode().longValue() == rule.getIcmpCode().longValue() && newRule.getIcmpType().longValue() == rule.getIcmpType().longValue() && newRule.getProtocol().equalsIgnoreCase(rule.getProtocol())) {
                     throw new InvalidParameterValueException("New rule conflicts with existing rule id=" + rule.getId());
                 }
             }

From 8ea68aa196f4703604bd41dc30b367a55b4d7369 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 12:32:48 -0700
Subject: [PATCH 38/77] cloudStack - IP Address page - port forwarding, port
 range - remove protocol option "ICMP".

---
 ui/scripts/cloud.core.ipaddress.js | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 7334db0d396..8e76a0eed5a 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -795,8 +795,10 @@ function ipJsonToPortRangeTab() {
                 var protocols = supportedProtocolsCapabilityObj.value.toUpperCase();  //e.g. "tcp,udp" => "TCP,UDP"         
                 var array1 = protocols.split(",");
                 var $protocolField = $("#create_port_range_row").find("#protocol").empty();
-                for(var i=0; i<array1.length; i++)
-                    $protocolField.append("<option value='"+array1[i]+"'>"+array1[i]+"</option>")
+                for(var i=0; i<array1.length; i++) {
+                	if(array1[i] != "ICMP")
+                        $protocolField.append("<option value='"+array1[i]+"'>"+array1[i]+"</option>")
+                }
             }  
         }
     }  
@@ -849,8 +851,10 @@ function ipJsonToPortForwardingTab() {
                 var protocols = supportedProtocolsCapabilityObj.value.toUpperCase();  //e.g. "tcp,udp" => "TCP,UDP"         
                 var array1 = protocols.split(",");
                 var $protocolField = $("#create_port_forwarding_row").find("#protocol").empty();
-                for(var i=0; i<array1.length; i++)
-                    $protocolField.append("<option value='"+array1[i]+"'>"+array1[i]+"</option>")
+                for(var i=0; i<array1.length; i++) {
+                	if(array1[i] != "ICMP")
+                        $protocolField.append("<option value='"+array1[i]+"'>"+array1[i]+"</option>")
+                }
             }  
         }
     }  

From 007c4a8d8ea325eaee2001bc92ebd746a6bd359e Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 19:20:08 -0700
Subject: [PATCH 39/77] cloudStack - add new localization labels.

---
 client/WEB-INF/classes/resources/messages.properties       | 3 +++
 client/WEB-INF/classes/resources/messages_es.properties    | 3 +++
 client/WEB-INF/classes/resources/messages_ja.properties    | 3 +++
 client/WEB-INF/classes/resources/messages_zh_CN.properties | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/client/WEB-INF/classes/resources/messages.properties b/client/WEB-INF/classes/resources/messages.properties
index 929d752b411..a78694a1550 100644
--- a/client/WEB-INF/classes/resources/messages.properties
+++ b/client/WEB-INF/classes/resources/messages.properties
@@ -4,6 +4,9 @@
 
 
 #Labels
+ICMP.type=ICMP Type
+ICMP.code=ICMP Code
+
 image.directory=Image Directory
 
 label.action.create.template.from.vm=Create Template from VM
diff --git a/client/WEB-INF/classes/resources/messages_es.properties b/client/WEB-INF/classes/resources/messages_es.properties
index 0895551cf0c..248dc748b81 100644
--- a/client/WEB-INF/classes/resources/messages_es.properties
+++ b/client/WEB-INF/classes/resources/messages_es.properties
@@ -4,6 +4,9 @@
 
 
 #Labels
+ICMP.type=Tipo ICMP
+ICMP.code=ICMP Código
+
 image.directory=Directorio de la imagen
 
 label.action.create.template.from.vm=Crear plantilla de VM
diff --git a/client/WEB-INF/classes/resources/messages_ja.properties b/client/WEB-INF/classes/resources/messages_ja.properties
index 23cbf984189..623da86ac8c 100644
--- a/client/WEB-INF/classes/resources/messages_ja.properties
+++ b/client/WEB-INF/classes/resources/messages_ja.properties
@@ -4,6 +4,9 @@
 
 
 #Labels
+ICMP.type=ICMPタイプ
+ICMP.code=ICMPコード
+
 image.directory=画像ディレクトリ
 
 label.action.create.template.from.vm=VMからのテンプレートを作成する
diff --git a/client/WEB-INF/classes/resources/messages_zh_CN.properties b/client/WEB-INF/classes/resources/messages_zh_CN.properties
index 7827a075f4b..a4b3dc4be66 100644
--- a/client/WEB-INF/classes/resources/messages_zh_CN.properties
+++ b/client/WEB-INF/classes/resources/messages_zh_CN.properties
@@ -4,6 +4,9 @@
 
 
 #Labels
+ICMP.type=ICMP类型
+ICMP.code=ICMP代码
+
 image.directory=图片目录
 
 label.action.create.template.from.vm=创建虚拟机模板

From 522d49062780e66be30cfefe50813aa840b669fb Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 19:20:43 -0700
Subject: [PATCH 40/77] cloudStack - IP Address page - add a new tab
 "Firewall".

---
 ui/jsp/ipaddress.jsp               | 123 ++++++++++-
 ui/scripts/cloud.core.ipaddress.js | 314 ++++++++++++++++++++++++++++-
 2 files changed, 428 insertions(+), 9 deletions(-)

diff --git a/ui/jsp/ipaddress.jsp b/ui/jsp/ipaddress.jsp
index c5cce6eaeeb..150ce9e31cc 100644
--- a/ui/jsp/ipaddress.jsp
+++ b/ui/jsp/ipaddress.jsp
@@ -33,7 +33,9 @@ dictionary = {
     </div>
     <div class="tabbox" style="margin-top: 15px;">
         <div class="content_tabs on" id="tab_details" style="display: none">
-            <fmt:message key="label.details"/></div>	            
+            <fmt:message key="label.details"/></div>	
+        <div class="content_tabs off" id="tab_firewall" style="display: none">
+            <fmt:message key="label.firewall"/></div>	
         <div class="content_tabs off" id="tab_port_range" style="display: none">
             <fmt:message key="label.port.range"/></div>            	
 		<div class="content_tabs off" id="tab_port_forwarding" style="display: none">
@@ -43,6 +45,8 @@ dictionary = {
 		<div class="content_tabs off" id="tab_vpn" style="display: none">
             <fmt:message key="label.vpn"/></div>
     </div>  
+    
+    <!-- Details starts here-->
     <div id="tab_content_details" style="display: none">
     	<div id="tab_spinning_wheel" class="rightpanel_mainloader_panel" style="display: none;">
 	        <div class="rightpanel_mainloaderbox">
@@ -215,6 +219,86 @@ dictionary = {
         </div>        
     </div>
     <!-- Details ends here-->
+    
+    <!-- Firewall start here-->
+    <div id="tab_content_firewall" style="display:none">
+    	<div id="tab_spinning_wheel" class="rightpanel_mainloader_panel" style="display: none;">
+            <div class="rightpanel_mainloaderbox">
+                <div class="rightpanel_mainloader_animatedicon">
+                </div>
+                <p>
+                    <fmt:message key="label.loading"/> &hellip;</p>
+            </div>
+        </div>        
+        <div id="tab_container">
+	        <div class="grid_container" id="grid_container">
+	            <div class="grid_header">	                
+	                <div class="grid_header_cell" style="width: 30%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="label.cidr.list"/></div>
+	                </div>	 
+	                <div class="grid_header_cell" style="width: 10%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="label.start.port"/></div>
+	                </div>
+	                <div class="grid_header_cell" style="width: 10%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="label.end.port"/></div>
+	                </div>
+	                <div class="grid_header_cell" style="width: 15%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="label.protocol"/></div>
+	                </div>		                
+	                <div class="grid_header_cell" style="width: 10%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="ICMP.type"/></div>
+	                </div>
+	                 <div class="grid_header_cell" style="width: 10%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="ICMP.code"/></div>
+	                </div>
+	                <div class="grid_header_cell" style="width: 10%; ">
+	                    <div class="grid_header_title">
+	                        <fmt:message key="label.actions"/></div>
+	                </div>
+	            </div>
+	            <div class="grid_rows even" id="create_firewall_row">	            
+	                <div class="grid_row_cell" style="width: 30%; ">  
+	                    <input id="cidr" class="text" type="text" />
+	                    <div id="cidr_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
+	                </div>	            
+	                <div class="grid_row_cell" style="width: 10%; ">
+	                    <input id="start_port" class="text" style="width: 70%;" type="text" disabled="disabled" />
+	                    <div id="start_port_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
+	                </div>
+	                <div class="grid_row_cell" style="width: 10%; ">
+	                    <input id="end_port" class="text" style="width: 70%;" type="text" disabled="disabled" />
+	                    <div id="end_port_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
+	                </div>
+	                <div class="grid_row_cell" style="width: 15%; ">  
+	                   <select class="select" id="protocol" style="width:70%;">	                  
+	                   </select>
+	                </div>	 	                
+	                <div class="grid_row_cell" style="width: 10%; ">
+	                    <input id="ICMP_type" class="text" style="width: 70%;" type="text" disabled="disabled" />
+	                    <div id="ICMP_type_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
+	                </div>
+	                <div class="grid_row_cell" style="width: 10%; ">
+	                    <input id="ICMP_code" class="text" style="width: 70%;" type="text" disabled="disabled" />
+	                    <div id="ICMP_code_errormsg" class="errormsg" style="display: none;">Error msg will appear here</div>
+	                </div>
+	                <div class="grid_row_cell" style="width: 10%; ">
+	                    <div class="row_celltitles">
+	                        <a id="add_link" href="#"><fmt:message key="label.add"/></a></div>
+	                </div>
+	            </div>              
+	            <div id="grid_content">
+	            </div>            
+	        </div>
+        </div>      
+    </div>
+    <!-- Firewall ends here-->
+    
     <!-- Port Range start here-->
     <div id="tab_content_port_range" style="display:none">
     	<div id="tab_spinning_wheel" class="rightpanel_mainloader_panel" style="display: none;">
@@ -495,6 +579,43 @@ dictionary = {
 </div>
 <!--  top buttons (end) -->
 
+<!-- Firewall template (begin) -->
+<div class="grid_rows odd" id="firewall_template" style="display: none">    
+    <div id="row_container">        
+        <div class="grid_row_cell" style="width: 30%; ">
+           <div class="row_celltitles" id="cidr" style="padding:1px;"></div>
+        </div>        
+        <div class="grid_row_cell" style="width: 10%; ">
+            <div class="row_celltitles" id="start_port" style="padding:1px;"></div>
+        </div>
+        <div class="grid_row_cell" style="width: 10%; ">
+            <div class="row_celltitles" id="end_port" style="padding:1px;"></div>
+        </div>
+        <div class="grid_row_cell" style="width: 15%; ">
+            <div class="row_celltitles" id="protocol"></div>
+        </div>  
+        <div class="grid_row_cell" style="width: 10%; ">
+            <div class="row_celltitles" id="ICMP_type" style="padding:1px;"></div>
+        </div>
+         <div class="grid_row_cell" style="width: 10%; ">
+            <div class="row_celltitles" id="ICMP_code" style="padding:1px;"></div>
+        </div>
+        <div class="grid_row_cell" style="width: 10%; ">
+            <div class="row_celltitles">
+                <a id="delete_link" href="#" style="float:left;"><fmt:message key="label.delete"/> </a>                            
+            </div>
+        </div>
+        <div class="gridrow_loaderbox" style="display: none;" id="spinning_wheel">
+            <div class="gridrow_loader">
+            </div>
+            <p id="description">
+                <fmt:message key="label.waiting"/>  &hellip;
+            </p>
+        </div>
+    </div>    
+</div>
+<!-- Firewall template (end) -->
+
 <!-- Load Balancer Template (begin) -->
 <div class="grid_rows odd" id="load_balancer_template" style="display:none">
     <div id="row_container">        
diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 8e76a0eed5a..c8a1915565d 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -65,15 +65,16 @@ function ipGetSearchParams() {
 	return moreCriteria.join("");          
 }
 
+var firewallTabIsShown = true;
 function afterLoadIpJSP() {
     //***** switch between different tabs (begin) ********************************************************************
-    var tabArray = [$("#tab_details"), $("#tab_port_range"), $("#tab_port_forwarding"), $("#tab_load_balancer"), $("#tab_vpn")];
-    var tabContentArray = [$("#tab_content_details"), $("#tab_content_port_range"), $("#tab_content_port_forwarding"), $("#tab_content_load_balancer"), $("#tab_content_vpn")];
-    var afterSwitchFnArray = [ipJsonToDetailsTab, ipJsonToPortRangeTab, ipJsonToPortForwardingTab, ipJsonToLoadBalancerTab, ipJsonToVPNTab];
+    var tabArray = [$("#tab_details"), $("#tab_firewall"), $("#tab_port_range"), $("#tab_port_forwarding"), $("#tab_load_balancer"), $("#tab_vpn")];
+    var tabContentArray = [$("#tab_content_details"), $("#tab_content_firewall"), $("#tab_content_port_range"), $("#tab_content_port_forwarding"), $("#tab_content_load_balancer"), $("#tab_content_vpn")];
+    var afterSwitchFnArray = [ipJsonToDetailsTab, ipJsonToFirewallTab, ipJsonToPortRangeTab, ipJsonToPortForwardingTab, ipJsonToLoadBalancerTab, ipJsonToVPNTab];
     switchBetweenDifferentTabs(tabArray, tabContentArray, afterSwitchFnArray);       
     //***** switch between different tabs (end) **********************************************************************  
     if(g_supportELB == "guest" || g_supportELB == "public") {
-		$("#tab_details,#tab_port_range,#tab_port_forwarding,#tab_load_balancer,#tab_vpn").hide();	
+		$("#tab_details,#tab_firewall,#tab_port_range,#tab_port_forwarding,#tab_load_balancer,#tab_vpn").hide();	
 				
 		$("#tab_content_details").hide();
 				
@@ -128,6 +129,9 @@ function afterLoadIpJSP() {
 			        var algorithm = $thisDialog.find("#algorithm_select").val();  
 			        array1.push("&algorithm="+algorithm);
 			       
+			        if(firewallTabIsShown == true)
+			        	array1.push("&openfirewall=false");
+			        
 			        var $midmenuItem1 = beforeAddingMidMenuItem() ;	
 			        $.ajax({
 				        data: createURL("command=createLoadBalancerRule"+array1.join("")),
@@ -209,6 +213,11 @@ function afterLoadIpJSP() {
     else { 
     	$("#tab_details,#tab_content_details").show();
     	
+    	if(firewallTabIsShown == true)
+    	    $("#tab_firewall").show();
+    	else
+    		$("#tab_firewall").hide();
+    	
 	    //dialogs
 	    initDialog("dialog_acquire_public_ip", 325);
 		initDialog("dialog_enable_vpn");
@@ -293,6 +302,141 @@ function afterLoadIpJSP() {
 		});
 	    //*** Acquire New IP (end) ***
 	    
+	    //*** Firewall tab (begin) ***
+	    var $createFirewallRow = $("#tab_content_firewall").find("#create_firewall_row");     
+	  
+	    $createFirewallRow.find("#protocol").bind("click", function(event) {	    	
+	    	var protocol = $(this).val().toLowerCase();	    
+	    	if(protocol == "tcp" || protocol == "udp") {
+	    		$createFirewallRow.find("#start_port,#end_port").removeAttr("disabled");
+	    		$createFirewallRow.find("#ICMP_type,#ICMP_code").attr("disabled", "disabled");
+	    		$createFirewallRow.find("#ICMP_type,#ICMP_code").val("")
+	    	}
+	    	else { //protocol == icmp
+	    		$createFirewallRow.find("#ICMP_type,#ICMP_code").removeAttr("disabled");
+	    		$createFirewallRow.find("#start_port,#end_port").attr("disabled", "disabled");
+	    		$createFirewallRow.find("#start_port,#end_port").val("");
+	    	}	    	
+	    	return true;
+	    });
+	    	    
+	    $createFirewallRow.find("#add_link").bind("click", function(event){	  	 	
+	    	var isValid = true;		
+			isValid &= validateCIDRList("Source CIDR", $createFirewallRow.find("#cidr"), $createFirewallRow.find("#cidr_errormsg"), true); //optional								
+			if($createFirewallRow.find("#start_port").attr("disabled") == false)
+			    isValid &= validateInteger("Start Port", $createFirewallRow.find("#start_port"), $createFirewallRow.find("#start_port_errormsg"), 1, 65535);
+			if($createFirewallRow.find("#end_port").attr("disabled") == false)
+			    isValid &= validateInteger("End Port", $createFirewallRow.find("#end_port"), $createFirewallRow.find("#end_port_errormsg"), 1, 65535);				
+			if($createFirewallRow.find("#ICMP_type").attr("disabled") == false) 
+				isValid &= validateInteger("ICMP type", $createFirewallRow.find("#ICMP_type"), $createFirewallRow.find("#ICMP_type_errormsg"), null, null);
+			if($createFirewallRow.find("#ICMP_code").attr("disabled") == false) 
+				isValid &= validateInteger("ICMP code", $createFirewallRow.find("#ICMP_code"), $createFirewallRow.find("#ICMP_code_errormsg"), null, null);
+			if (!isValid) 
+			    return;			
+		    
+		    var $template = $("#firewall_template").clone();
+		    $("#tab_content_firewall #grid_content").append($template.show());		
+		    
+		    var $spinningWheel = $template.find("#row_container").find("#spinning_wheel");	
+		    $spinningWheel.find("#description").text(g_dictionary["label.adding.processing"]);	
+	        $spinningWheel.show();   
+		    	    
+		    var $midmenuItem1 = $("#right_panel_content").data("$midmenuItem1");       
+	        var ipObj = $midmenuItem1.data("jsonObj");          	        
+				   	    
+		    var array1 = [];
+		    array1.push("&ipaddressid="+ipObj.id);    
+		    
+		    var cidr = $createFirewallRow.find("#cidr").val();
+	        if(cidr != null && cidr.length > 0)
+	        	array1.push("&cidrlist="+cidr);
+		    
+	        if($createFirewallRow.find("#start_port").attr("disabled") == false) {
+		        var startPort = $createFirewallRow.find("#start_port").val();       
+		        array1.push("&startPort="+startPort);
+	        }
+	        
+	        if($createFirewallRow.find("#end_port").attr("disabled") == false) {
+		        var endPort = $createFirewallRow.find("#end_port").val();
+		        array1.push("&endPort="+endPort);
+	        }
+	        
+	        var protocol = $createFirewallRow.find("#protocol").val();
+	        array1.push("&protocol="+protocol);
+	         
+	        if($createFirewallRow.find("#ICMP_type").attr("disabled") == false) {
+		        var ICMPType = $createFirewallRow.find("#ICMP_type").val();       
+		        array1.push("&icmptype="+ICMPType);
+	        }
+	        if($createFirewallRow.find("#ICMP_code").attr("disabled") == false) {
+		        var ICMPCode = $createFirewallRow.find("#ICMP_code").val();       
+		        array1.push("&icmpcode="+ICMPCode);
+	        }
+	        
+	        $.ajax({
+	            data: createURL("command=createFirewallRule"+array1.join("")),
+	            dataType: "json",           
+	            success: function(json) {                      
+	                var jobId = json.createfirewallruleresponse.jobid;                  			                        
+	                var timerKey = "asyncJob_" + jobId;					                       
+	                $("body").everyTime(
+	                    10000,
+	                    timerKey,
+	                    function() {
+	                        $.ajax({
+	                            data: createURL("command=queryAsyncJobResult&jobId="+jobId),
+		                        dataType: "json",									                    					                    
+		                        success: function(json) {		                                              							                       
+			                        var result = json.queryasyncjobresultresponse;										                   
+			                        if (result.jobstatus == 0) {
+				                        return; //Job has not completed
+			                        } else {											                    
+				                        $("body").stopTime(timerKey);				                        
+				                        $spinningWheel.hide();  			                                 		                       
+				                        if (result.jobstatus == 1) { // Succeeded 					                       		                            
+		                                    var item = json.queryasyncjobresultresponse.jobresult.firewallrule;		       	        	
+		                                    firewallJsonToTemplate(item, $template);
+		                                    $spinningWheel.hide();   
+		                                    refreshCreateFirewallRow();			 
+				                        } else if (result.jobstatus == 2) { // Failed			                            
+					                        $template.slideUp("slow", function() {
+						                        $(this).remove();
+					                        });
+					                        var errorMsg = g_dictionary["label.failed"] + " - " + fromdb(result.jobresult.errortext);	
+		                                    $("#dialog_error").text(errorMsg).dialog("open");
+				                        }											                    
+			                        }
+		                        },
+		                        error: function(XMLHttpResponse) {	                  
+			                        $("body").stopTime(timerKey);	
+									handleError(XMLHttpResponse, function() {
+						                $template.slideUp("slow", function() {
+							                $(this).remove();
+						                });
+						                var errorMsg = parseXMLHttpResponse(XMLHttpResponse);				
+			                            $("#dialog_error").text(fromdb(errorMsg)).dialog("open");
+					                });								
+		                        }
+	                        });
+                        },
+	                    0
+	                );
+	            },
+	            error: function(XMLHttpResponse) {	
+	                handleError(XMLHttpResponse, function() {
+		                $template.slideUp("slow", function() {
+			                $(this).remove();
+		                });
+		                var errorMsg = parseXMLHttpResponse(XMLHttpResponse);				
+	                    $("#dialog_error").text(fromdb(errorMsg)).dialog("open");
+	                });		
+	            }
+	        });    	    
+		    
+		    return false;
+		});
+	    //*** Firewall tab (end) ***
+	    
 	    //*** Port Range tab (begin) ***
 	    var $createPortRangeRow = $("#tab_content_port_range").find("#create_port_range_row");     
 	  
@@ -322,7 +466,10 @@ function afterLoadIpJSP() {
 	        array1.push("&startPort="+startPort);
 	        array1.push("&endPort="+endPort);
 	        array1.push("&protocol="+protocol);
-	                
+	           
+	        if(firewallTabIsShown == true)
+	        	array1.push("&openfirewall=false");
+	        
 	        $.ajax({
 	            data: createURL("command=createIpForwardingRule"+array1.join("")),
 	            dataType: "json",           
@@ -461,6 +608,9 @@ function afterLoadIpJSP() {
 		    var virtualMachineId = $createPortForwardingRow.find("#vm").val();	
 	        array1.push("&virtualmachineid=" + virtualMachineId);
 	        
+	        if(firewallTabIsShown == true)
+	        	array1.push("&openfirewall=false");
+	        
 	        $.ajax({
 	            data: createURL("command=createPortForwardingRule"+array1.join("")),
 	            dataType: "json",           
@@ -563,7 +713,10 @@ function afterLoadIpJSP() {
         
         var algorithm = createLoadBalancerRow.find("#algorithm_select").val();  
         array1.push("&algorithm="+algorithm);
-               
+        
+        if(firewallTabIsShown == true)
+        	array1.push("&openfirewall=false");
+        
         $.ajax({
 	        data: createURL("command=createLoadBalancerRule"+array1.join("")),
 			dataType: "json",
@@ -768,6 +921,61 @@ function ipToRightPanel($midmenuItem1) {
     }        
 }
 
+function ipJsonToFirewallTab() {   
+    var $midmenuItem1 = $("#right_panel_content").data("$midmenuItem1");
+   
+    if($midmenuItem1 == null) {
+        ipClearFirewallTab();
+        return;    
+    }
+        
+    var ipObj = $midmenuItem1.data("jsonObj");
+    if(ipObj == null) {
+        ipClearFirewallTab();
+        return;   
+    }
+    
+    var $thisTab = $("#right_panel_content #tab_content_firewall");  
+	$thisTab.find("#tab_container").hide(); 
+    $thisTab.find("#tab_spinning_wheel").show();   		
+    
+    var networkObj = $midmenuItem1.data("networkObj");   
+    if(networkObj != null) {
+        var firewallServiceObj = ipFindNetworkServiceByName("Firewall", networkObj);
+        if(firewallServiceObj != null) {
+	        var supportedProtocolsCapabilityObj = ipFindCapabilityByName("SupportedProtocols", firewallServiceObj);    
+            if(supportedProtocolsCapabilityObj != null) {
+                var protocols = supportedProtocolsCapabilityObj.value.toUpperCase();  //e.g. "tcp,udp" => "TCP,UDP"         
+                var array1 = protocols.split(",");
+                var $protocolField = $("#create_firewall_row").find("#protocol").empty();
+                for(var i=0; i<array1.length; i++) {
+                	$protocolField.append("<option value='"+array1[i]+"'>"+array1[i]+"</option>")
+                }
+            }  
+        }
+    }  
+ 
+    refreshCreateFirewallRow();         
+           		
+    $.ajax({
+        data: createURL("command=listFirewallRules&ipaddressid=" + ipObj.id),
+        dataType: "json",        
+        success: function(json) {	    
+            var items = json.listfirewallrulesresponse.firewallrule;              
+            var $grid = $thisTab.find("#grid_content").empty();                       		    		      	    		
+            if (items != null && items.length > 0) {				        			        
+                for (var i = 0; i < items.length; i++) {
+	                var $template = $("#firewall_template").clone(true);
+	                firewallJsonToTemplate(items[i], $template); 
+	                $grid.append($template.show());						   
+                }			    
+            } 	
+            $thisTab.find("#tab_spinning_wheel").hide();    
+            $thisTab.find("#tab_container").show();           	      		    						
+        }
+    });      
+}
+
 function ipJsonToPortRangeTab() {   
     var $midmenuItem1 = $("#right_panel_content").data("$midmenuItem1");
    
@@ -948,9 +1156,17 @@ function showEnableVPNDialog($thisTab) {
 			
 			var $midmenuItem1 = $("#right_panel_content").data("$midmenuItem1");	
 			var ipObj = $midmenuItem1.data("jsonObj");
-						
+			
+			var array1 = [];			
+			array1.push("&publicipid="+ipObj.id);
+			array1.push("&account="+ipObj.account);
+			array1.push("&domainid="+ipObj.domainid);
+			array1.push("&zoneid="+ipObj.zoneid);	
+			if(firewallTabIsShown == true)
+		        array1.push("&openfirewall=false");
+			
 			$.ajax({
-				data: createURL("command=createRemoteAccessVpn&publicipid="+ipObj.id+"&account="+ipObj.account+"&domainid="+ipObj.domainid+"&zoneid="+ipObj.zoneid),
+				data: createURL("command=createRemoteAccessVpn"+array1.join("")),
 				dataType: "json",
 				success: function(json) {
 					var jobId = json.createremoteaccessvpnresponse.jobid;
@@ -1622,6 +1838,88 @@ function ipSetRuleState(stateValue, $stateField) {
         $stateField.removeClass("status_red status_green").addClass("status_gray");
 }
 
+//***** Firewall tab (begin) ********************************************************************************************************
+function ipClearFirewallTab() {
+   $("#tab_firewall #grid_content").empty(); 
+    refreshCreateFirewallRow(); 
+}    
+
+function firewallJsonToTemplate(jsonObj, $template) {	     
+    $template.attr("id", "firewall_" + fromdb(jsonObj.id)).data("firewallId", fromdb(jsonObj.id));    	    
+    $template.find("#row_container #cidr").text(fromdb(jsonObj.cidrlist));     
+    $template.find("#row_container #start_port").text(fromdb(jsonObj.startport));        
+    $template.find("#row_container #end_port").text(fromdb(jsonObj.endport));        
+    $template.find("#row_container #protocol").text(fromdb(jsonObj.protocol)); 
+    $template.find("#row_container #ICMP_type").text(fromdb(jsonObj.icmptype));        
+    $template.find("#row_container #ICMP_code").text(fromdb(jsonObj.icmpcode));    
+               
+    $template.find("#delete_link").unbind("click").bind("click", function(event){   		                    
+        var $spinningWheel = $template.find("#row_container").find("#spinning_wheel");		
+        $spinningWheel.find("#description").text(g_dictionary["label.deleting.processing"]);	
+        $spinningWheel.show();   
+             
+        $.ajax({
+            data: createURL("command=deleteFirewallRule&id="+fromdb(jsonObj.id)),
+            dataType: "json",           
+            success: function(json) {	                                  	                        
+                var jobId = json.deletefirewallruleresponse.jobid;                  			                        
+                var timerKey = "asyncJob_" + jobId;					                       
+                $("body").everyTime(
+                    10000,
+                    timerKey,
+                    function() {
+                        $.ajax({
+                            data: createURL("command=queryAsyncJobResult&jobId="+jobId),
+	                        dataType: "json",									                    					                    
+	                        success: function(json) {		                                                     							                       
+		                        var result = json.queryasyncjobresultresponse;										                   
+		                        if (result.jobstatus == 0) {
+			                        return; //Job has not completed
+		                        } else {
+			                        $("body").stopTime(timerKey);
+			                        $spinningWheel.hide();   
+									if (result.jobstatus == 1) { // Succeeded										   
+										$template.slideUp("slow", function() {
+											$(this).remove();													
+										});									
+									} else if (result.jobstatus == 2) { // Failed	
+									     var errorMsg = g_dictionary["label.deleting.failed"] + " - " + fromdb(result.jobresult.errortext);		
+									    $("#dialog_error").text(errorMsg).dialog("open");											
+									}							                    
+		                        }
+	                        },
+	                        error: function(XMLHttpResponse) {	 
+		                        $("body").stopTime(timerKey);
+								$spinningWheel.hide();   
+								handleError(XMLHttpResponse);		         
+	                        }
+                        });
+                    },
+                    0
+                );
+            },
+            error: function(XMLHttpResponse) {				
+				$spinningWheel.hide();   
+				handleError(XMLHttpResponse);				
+            }
+        });    
+                 
+        return false;
+    }); 
+}	  
+
+function refreshCreateFirewallRow() {  
+	var $createFirewallRow = $("#tab_content_firewall").find("#create_firewall_row");    
+	$createFirewallRow.find("#cidr").text("");     
+	$createFirewallRow.find("#start_port").text("");           
+	$createFirewallRow.find("#end_port").text("");    
+	$createFirewallRow.find("#ICMP_type").text("");          
+	$createFirewallRow.find("#ICMP_code").text("");    
+	$createFirewallRow.find("#protocol").click();
+}
+
+//***** Firewall tab (end) **********************************************************************************************************
+
 //***** Port Range tab (begin) ********************************************************************************************************
 function ipClearPortRangeTab() {
    $("#tab_content_port_range #grid_content").empty(); 

From e87410983993d24e514133d67107eb7d589a066a Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Wed, 10 Aug 2011 19:24:04 -0700
Subject: [PATCH 41/77] bug 11071: when elb service is enabled, don't check
 supported protocols as the provider is NULL in data_center table status
 11071: resolved fixed

---
 .../cloud/network/firewall/FirewallManagerImpl.java  | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index f47e6f3d4af..a358cda5804 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -10,6 +10,8 @@ import javax.naming.ConfigurationException;
 import org.apache.log4j.Logger;
 
 import com.cloud.api.commands.ListFirewallRulesCmd;
+import com.cloud.configuration.Config;
+import com.cloud.configuration.dao.ConfigurationDao;
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
@@ -72,6 +74,10 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
     NetworkManager _networkMgr;
     @Inject 
     UsageEventDao _usageEventDao;
+    @Inject
+    ConfigurationDao _configDao;
+    
+    private boolean _elbEnabled=false;
     
     
     @Override
@@ -92,6 +98,8 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
     @Override
     public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
         _name = name;
+        String elbEnabledString = _configDao.getValue(Config.ElasticLoadBalancerEnabled.key());
+        _elbEnabled = Boolean.parseBoolean(elbEnabledString);
         return true;
     }
     
@@ -296,7 +304,9 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         Map<Network.Capability, String> protocolCapabilities = null;
         
         if (purpose == Purpose.LoadBalancing) {
-            protocolCapabilities = _networkMgr.getServiceCapabilities(network.getDataCenterId(), network.getNetworkOfferingId(), Service.Lb);
+            if (!_elbEnabled) {
+                protocolCapabilities = _networkMgr.getServiceCapabilities(network.getDataCenterId(), network.getNetworkOfferingId(), Service.Lb);
+            }
         } else {
             protocolCapabilities = _networkMgr.getServiceCapabilities(network.getDataCenterId(), network.getNetworkOfferingId(), Service.Firewall);
         }

From e39a9eca7db84b3aa4eea98a146dfd7ea638b555 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 19:53:30 -0700
Subject: [PATCH 42/77] bug 11065: cloudStack - cluster page - remove action
 "Manage Cluster" and "Unmanage Cluster".

---
 ui/scripts/cloud.core.cluster.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ui/scripts/cloud.core.cluster.js b/ui/scripts/cloud.core.cluster.js
index fe103f38e7d..de832fdf357 100644
--- a/ui/scripts/cloud.core.cluster.js
+++ b/ui/scripts/cloud.core.cluster.js
@@ -94,10 +94,12 @@ function clusterBuildActionMenu(jsonObj) {
     else if(jsonObj.allocationstate == "Enabled")  
         buildActionLinkForTab("label.action.disable.cluster", clusterActionMap, $actionMenu, $midmenuItem1, $thisTab); 
     
+    /*
     if(jsonObj.managedstate == "Managed")
     	buildActionLinkForTab("label.action.unmanage.cluster", clusterActionMap, $actionMenu, $midmenuItem1, $thisTab); 
     else //PrepareUnmanaged , PrepareUnmanagedError, Unmanaged 
     	buildActionLinkForTab("label.action.manage.cluster", clusterActionMap, $actionMenu, $midmenuItem1, $thisTab); 
+    */
     
     buildActionLinkForTab("label.action.delete.cluster", clusterActionMap, $actionMenu, $midmenuItem1, $thisTab);  	
 }

From 25407543b0e47c6339d8cd3ce66b8eb419168b48 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Wed, 10 Aug 2011 20:06:03 -0700
Subject: [PATCH 43/77] bug 11016: cloudStack - Host page - add "host tags" in
 grid.

---
 ui/jsp/host.jsp               | 26 ++++++++++++++++++--------
 ui/scripts/cloud.core.host.js |  5 +++--
 2 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/ui/jsp/host.jsp b/ui/jsp/host.jsp
index 593bd7ae6f7..e81d95cb0b4 100644
--- a/ui/jsp/host.jsp
+++ b/ui/jsp/host.jsp
@@ -111,8 +111,18 @@ dictionary = {
 	                    <div class="row_celltitles" id="state">
 	                    </div>
 	                </div>
-	            </div>
+	            </div>	            
 	            <div class="grid_rows even">
+	                <div class="grid_row_cell" style="width: 20%;">
+	                    <div class="row_celltitles">
+	                        <fmt:message key="label.host.tags"/>:</div>
+	                </div>
+	                <div class="grid_row_cell" style="width: 79%;">
+	                    <div class="row_celltitles" id="hosttags">
+	                    </div>
+	                </div>
+	            </div>
+	            <div class="grid_rows odd">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.type"/>:</div>
@@ -122,7 +132,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows odd">
+	            <div class="grid_rows even">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.zone"/>:</div>
@@ -132,7 +142,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows even">
+	            <div class="grid_rows odd">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.pod"/>:</div>
@@ -142,7 +152,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows odd">
+	            <div class="grid_rows even">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.cluster"/>:</div>
@@ -152,7 +162,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows even">
+	            <div class="grid_rows odd">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.ip.address"/>:</div>
@@ -162,7 +172,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows odd">
+	            <div class="grid_rows even">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.version"/>:</div>
@@ -172,7 +182,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows even">
+	            <div class="grid_rows odd">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.os.preference"/>:</div>
@@ -182,7 +192,7 @@ dictionary = {
 	                    </div>
 	                </div>
 	            </div>
-	            <div class="grid_rows odd">
+	            <div class="grid_rows even">
 	                <div class="grid_row_cell" style="width: 20%;">
 	                    <div class="row_celltitles">
 	                        <fmt:message key="label.last.disconnected"/>:</div>
diff --git a/ui/scripts/cloud.core.host.js b/ui/scripts/cloud.core.host.js
index 9dbea475c20..25ac7f9c8c3 100644
--- a/ui/scripts/cloud.core.host.js
+++ b/ui/scripts/cloud.core.host.js
@@ -127,8 +127,9 @@ function hostJsonToDetailsTab() {
                 
     $thisTab.find("#id").text(fromdb(jsonObj.id));
     $thisTab.find("#grid_header_title").text(fromdb(jsonObj.name));
-    $thisTab.find("#name").text(fromdb(jsonObj.name));
-        
+    $thisTab.find("#name").text(fromdb(jsonObj.name));
+    $thisTab.find("#hosttags").text(fromdb(jsonObj.hosttags));    
+    
     setHostStateInRightPanel(fromdb(jsonObj.state), $thisTab.find("#state"));
     
     

From 375da4da1aad99936b0ffdf24fab61360eb138ef Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Wed, 10 Aug 2011 20:39:37 -0700
Subject: [PATCH 44/77] bug 11072: icky icky icky

---
 .../cloud/agent/api/routing/LoadBalancerConfigCommand.java  | 2 +-
 .../cloud/network/lb/ElasticLoadBalancerManagerImpl.java    | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/api/src/com/cloud/agent/api/routing/LoadBalancerConfigCommand.java b/api/src/com/cloud/agent/api/routing/LoadBalancerConfigCommand.java
index fe0c146b85d..7cbfa0d7cf2 100644
--- a/api/src/com/cloud/agent/api/routing/LoadBalancerConfigCommand.java
+++ b/api/src/com/cloud/agent/api/routing/LoadBalancerConfigCommand.java
@@ -25,7 +25,7 @@ import com.cloud.agent.api.to.LoadBalancerTO;
  */
 public class LoadBalancerConfigCommand extends NetworkElementCommand {
     LoadBalancerTO[] loadBalancers;
-    public String lbStatsVisibility;
+    public String lbStatsVisibility = "guest-network";
     public String lbStatsIp; /* load balancer listen on this ip for stats */
     public String lbStatsPort = "8081"; /*load balancer listen on this port for stats */
     public String lbStatsSrcCidrs = "0/0" ; /* TODO : currently there is no filtering based on the source ip */
diff --git a/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java b/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java
index e97dbfaec55..1541a11b0df 100644
--- a/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java
+++ b/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java
@@ -293,6 +293,12 @@ public class ElasticLoadBalancerManagerImpl implements
                 elbVm.getPrivateIpAddress());
         cmd.setAccessDetail(NetworkElementCommand.ROUTER_NAME,
                 elbVm.getInstanceName());
+        //FIXME: why are we setting attributes directly? Ick!! There should be accessors and
+        //the constructor should set defaults.
+        cmd.lbStatsVisibility = _configDao.getValue(Config.NetworkLBHaproxyStatsVisbility.key());
+        cmd.lbStatsUri = _configDao.getValue(Config.NetworkLBHaproxyStatsUri.key());
+        cmd.lbStatsAuth = _configDao.getValue(Config.NetworkLBHaproxyStatsAuth.key());
+        cmd.lbStatsPort = _configDao.getValue(Config.NetworkLBHaproxyStatsPort.key());
         cmds.addCommand(cmd);
 
     }

From b33f08053c51980ecc8e8d1a8ec95f481638b972 Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Wed, 10 Aug 2011 22:04:21 -0700
Subject: [PATCH 45/77] bug 11072: one more

---
 .../src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java b/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java
index 1541a11b0df..61b01f3d2a3 100644
--- a/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java
+++ b/server/src/com/cloud/network/lb/ElasticLoadBalancerManagerImpl.java
@@ -299,6 +299,7 @@ public class ElasticLoadBalancerManagerImpl implements
         cmd.lbStatsUri = _configDao.getValue(Config.NetworkLBHaproxyStatsUri.key());
         cmd.lbStatsAuth = _configDao.getValue(Config.NetworkLBHaproxyStatsAuth.key());
         cmd.lbStatsPort = _configDao.getValue(Config.NetworkLBHaproxyStatsPort.key());
+        cmd.lbStatsIp = elbVm.getGuestIpAddress();
         cmds.addCommand(cmd);
 
     }

From 17a82341402118607c05259779c32c54c3025bf1 Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Wed, 10 Aug 2011 22:53:07 -0700
Subject: [PATCH 46/77] should be able to apply firewall rules to static natted
 ips

---
 server/src/com/cloud/network/firewall/FirewallManagerImpl.java | 2 --
 1 file changed, 2 deletions(-)

diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index a358cda5804..ea9712e33cb 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -119,8 +119,6 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
         // Validate ip address
         if (ipAddress == null) {
             throw new InvalidParameterValueException("Unable to create port forwarding rule; ip id=" + ipAddrId + " doesn't exist in the system");
-        } else if (ipAddress.isOneToOneNat()) {
-            throw new InvalidParameterValueException("Unable to create port forwarding rule; ip id=" + ipAddrId + " has static nat enabled");
         } 
         
         validateFirewallRule(caller, ipAddress, portStart, portEnd, protocol, Purpose.Firewall);

From 35e67bbfdfdc5061a8a8766621d630b72a59dcbf Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Wed, 10 Aug 2011 23:14:26 -0700
Subject: [PATCH 47/77] bug 10561: ensure outgoing connections work

---
 patches/systemvm/debian/config/root/firewall_rule.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index 960b8fd3ca2..84c1fba981d 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -45,7 +45,10 @@ fw_chain_for_ip () {
   local pubIp=$1
   sudo iptables -t mangle -E FIREWALL_$pubIp _FIREWALL_$pubIp 2> /dev/null
   sudo iptables -t mangle -N FIREWALL_$pubIp 2> /dev/null
+  # drop if no rules match (this will be the last rule in the chain)
   sudo iptables -t mangle -A FIREWALL_$pubIp -j DROP> /dev/null
+  # ensure outgoing connections are maintained (first rule in chain)
+  sudo iptables -t mangle -I FIREWALL_$pubIp -m state --state RELATED,ESTABLISHED -j ACCEPT> /dev/null
   sudo iptables -t mangle -I PREROUTING -d $pubIp -j FIREWALL_$pubIp
 }
 
@@ -61,6 +64,7 @@ fw_entry_for_public_ip() {
   logger -t cloud "$(basename $0): enter apply firewall rules for public ip $pubIp:$prot:$sport:$eport:$scidrs"  
 
 
+  # note that rules are inserted after the RELATED,ESTABLISHED rule but before the DROP rule
   for src in $scidrs
   do
     if [ "$prot" == "icmp" ]
@@ -69,12 +73,12 @@ fw_entry_for_public_ip() {
     # sport is icmpType , dport is icmpcode 
       if [ "$sport" == "-1" ]
       then
-           sudo iptables -t mangle -I FIREWALL_$pubIp -s $src -p $prot  -j RETURN
+           sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot  -j RETURN
        else
-           sudo iptables -t mangle -I FIREWALL_$pubIp -s $src -p $prot --icmp-type $sport  -j RETURN
+           sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport  -j RETURN
        fi
     else
-       sudo iptables -t mangle -I FIREWALL_$pubIp -s $src -p $prot --dport $sport:$eport -j RETURN
+       sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --dport $sport:$eport -j RETURN
   fi
   done
   result=$?

From 699b197a3c775c30d8a1d0319eca92315cb8475e Mon Sep 17 00:00:00 2001
From: Naredula Janardhana Reddy <jana@cloud.com>
Date: Thu, 11 Aug 2011 16:50:35 +0530
Subject: [PATCH 48/77] bug 10561:   changes to the create/delete firewall rule
 backend script:     1) changes to the return value     2) added a FIXME to
 one the leak.

---
 .../debian/config/root/firewall_rule.sh       | 32 ++++++++++---------
 scripts/network/domr/call_firewall.sh         |  1 -
 2 files changed, 17 insertions(+), 16 deletions(-)

diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index 84c1fba981d..a4179b6c751 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -19,30 +19,30 @@
 #
 #
 # @VERSION@
- 
+echo $* >> /tmp/jana.log 
 usage() {
   printf "Usage: %s:  -a <public ip address:protocol:startport:endport:sourcecidrs>  \n" $(basename $0) >&2
   printf "sourcecidrs format:  cidr1-cidr2-cidr3-...\n"
 }
-
+#set -x
 #FIXME: eating up the error code during execution of iptables
 fw_remove_backup() {
   local pubIp=$1
   sudo iptables -t mangle -F _FIREWALL_$pubIp 2> /dev/null
-  sudo iptables -t mangle -D PREROUTING   -j _FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -D PREROUTING   -j _FIREWALL_$pubIp -d $pubIp 2> /dev/null
   sudo iptables -t mangle -X _FIREWALL_$pubIp 2> /dev/null
 }
 
 fw_restore() {
   local pubIp=$1
   sudo iptables -t mangle -F FIREWALL_$pubIp 2> /dev/null
-  sudo iptables -t mangle -D PREROUTING   -j FIREWALL_$pubIp 2> /dev/null
+  sudo iptables -t mangle -D PREROUTING   -j FIREWALL_$pubIp -d  $pubIp 2> /dev/null
   sudo iptables -t mangle -X FIREWALL_$pubIp 2> /dev/null
   sudo iptables -t mangle -E _FIREWALL_$pubIp FIREWALL_$pubIp 2> /dev/null
 }
-
 fw_chain_for_ip () {
   local pubIp=$1
+  fw_remove_backup $1
   sudo iptables -t mangle -E FIREWALL_$pubIp _FIREWALL_$pubIp 2> /dev/null
   sudo iptables -t mangle -N FIREWALL_$pubIp 2> /dev/null
   # drop if no rules match (this will be the last rule in the chain)
@@ -128,6 +128,11 @@ fi
 
 #-a 172.16.92.44:tcp:80:80:0.0.0.0/0:,172.16.92.44:tcp:220:220:0.0.0.0/0:,172.16.92.44:tcp:222:222:192.168.10.0/24-75.57.23.0/22-88.100.33.1/32
 
+#FIXME: rule leak: when there are multiple ip address, there will chance that entry will be left over if the ipadress  does not appear in the current execution when compare to old one 
+# example :  In the below first transaction have 2 ip's whereas in second transaction it having one ip, so after the second trasaction 200.1.2.3 ip will have rules in mangle table.
+#  1)  -a 172.16.92.44:tcp:80:80:0.0.0.0/0:,200.16.92.44:tcp:220:220:0.0.0.0/0:,
+#  2)  -a 172.16.92.44:tcp:80:80:0.0.0.0/0:,172.16.92.44:tcp:220:220:0.0.0.0/0:,
+
 
 success=0
 publicIps=
@@ -166,14 +171,11 @@ then
       logger -t cloud "$(basename $0): restoring from backup for ip: $p"
       fw_restore $p
     done
-else 
-    for p in $unique_ips
-    do
-      logger -t cloud "$(basename $0): deleting backup for ip: $p"
-      fw_remove_backup $p
-    done
-fi
-
-exit 0
-  	
+fi 
+for p in $unique_ips
+do
+   logger -t cloud "$(basename $0): deleting backup for ip: $p"
+   fw_remove_backup $p
+done
+exit $success
 
diff --git a/scripts/network/domr/call_firewall.sh b/scripts/network/domr/call_firewall.sh
index c9e6147cef0..f2bb437036f 100755
--- a/scripts/network/domr/call_firewall.sh
+++ b/scripts/network/domr/call_firewall.sh
@@ -24,7 +24,6 @@
 # firewall.sh -- allow some ports / protocols to vm instances
 #
 #
-echo $* >> /tmp/jana.log
 usage() {
   printf "Usage for Firewall rule  : %s: <domR eth1 ip> -F " $(basename $0) >&2
   printf "Usage for other purposes : %s: <domR eth1 ip> (-A|-D) -i <domR eth1 ip>  -r <target-instance-ip> -P protocol (-p port_range | -t icmp_type_code)  -l <public ip address> -d <target port> [-f <firewall ip> -u <firewall user> -y <firewall password> -z <firewall enable password> ] \n" $(basename $0) >&2

From 7c2395e68486ce6da4e790c0550422152dbafdc5 Mon Sep 17 00:00:00 2001
From: Naredula Janardhana Reddy <jana@cloud.com>
Date: Thu, 11 Aug 2011 19:01:36 +0530
Subject: [PATCH 49/77] bug 10561: fix: last entry in the firewall rules unable
 to delete

---
 .../api/routing/SetFirewallRulesCommand.java      | 15 ++++++++++++++-
 .../systemvm/debian/config/root/firewall_rule.sh  | 15 +++++++++++++--
 scripts/network/domr/call_firewall.sh             |  2 +-
 3 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java b/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
index cfc5455e8d8..f1c584c978b 100644
--- a/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
+++ b/api/src/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
@@ -51,7 +51,19 @@ public class SetFirewallRulesCommand extends NetworkElementCommand {
 
 		
 		for (FirewallRuleTO fwTO: rules) {
-			if (fwTO.revoked() == true) continue;
+		/* example  :  172.16.92.44:tcp:80:80:0.0.0.0/0:,200.16.92.44:tcp:220:220:0.0.0.0/0:, 
+		 *  each entry format      <ip>:protocol:srcport:destport:scidr:
+		 *  reverted entry format  <ip>:reverted:0:0:0:
+		 */
+			if (fwTO.revoked() == true) 
+			{
+				StringBuilder sb = new StringBuilder();
+				/* This entry is added just to make sure atleast there will one entry in the list to get the ipaddress */
+				sb.append(fwTO.getSrcIp()).append(":reverted:0:0:0:"); 
+				String fwRuleEntry = sb.toString();
+				toAdd.add(fwRuleEntry);
+				continue;
+			}
 			
 			List<String> cidr;
 			StringBuilder sb = new StringBuilder();
@@ -64,6 +76,7 @@ public class SetFirewallRulesCommand extends NetworkElementCommand {
 				sb.append("0:0").append(":");
 			else
 			    sb.append(fwTO.getStringSrcPortRange()).append(":");
+			
 			cidr = fwTO.getSourceCidrList();
 			if (cidr == null || cidr.isEmpty())
 			{
diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index a4179b6c751..c38befbebaf 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -67,6 +67,10 @@ fw_entry_for_public_ip() {
   # note that rules are inserted after the RELATED,ESTABLISHED rule but before the DROP rule
   for src in $scidrs
   do
+    if [ "$prot" == "reverted" ]
+    then
+      continue;
+    fi
     if [ "$prot" == "icmp" ]
     then
     # TODO  icmp code need to be implemented
@@ -75,7 +79,12 @@ fw_entry_for_public_ip() {
       then
            sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot  -j RETURN
        else
-           sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport  -j RETURN
+           if ["$eport" == "-1"]
+           then
+               sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport  -j RETURN
+           else
+               sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport/$eport  -j RETURN
+           fi
        fi
     else
        sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --dport $sport:$eport -j RETURN
@@ -127,7 +136,9 @@ then
 fi
 
 #-a 172.16.92.44:tcp:80:80:0.0.0.0/0:,172.16.92.44:tcp:220:220:0.0.0.0/0:,172.16.92.44:tcp:222:222:192.168.10.0/24-75.57.23.0/22-88.100.33.1/32
-
+#    if any entry is reverted , entry will be in the format <ip>:reverted:0:0:0
+# example : 172.16.92.44:tcp:80:80:0.0.0.0/0:,172.16.92.44:tcp:220:220:0.0.0.0/0:,200.1.1.2:reverted:0:0:0 
+# The reverted entries will fix the following partially 
 #FIXME: rule leak: when there are multiple ip address, there will chance that entry will be left over if the ipadress  does not appear in the current execution when compare to old one 
 # example :  In the below first transaction have 2 ip's whereas in second transaction it having one ip, so after the second trasaction 200.1.2.3 ip will have rules in mangle table.
 #  1)  -a 172.16.92.44:tcp:80:80:0.0.0.0/0:,200.16.92.44:tcp:220:220:0.0.0.0/0:,
diff --git a/scripts/network/domr/call_firewall.sh b/scripts/network/domr/call_firewall.sh
index f2bb437036f..922b69a80ae 100755
--- a/scripts/network/domr/call_firewall.sh
+++ b/scripts/network/domr/call_firewall.sh
@@ -29,7 +29,7 @@ usage() {
   printf "Usage for other purposes : %s: <domR eth1 ip> (-A|-D) -i <domR eth1 ip>  -r <target-instance-ip> -P protocol (-p port_range | -t icmp_type_code)  -l <public ip address> -d <target port> [-f <firewall ip> -u <firewall user> -y <firewall password> -z <firewall enable password> ] \n" $(basename $0) >&2
 }
 
- set -x
+# set -x
 
 # check if gateway domain is up and running
 check_gw() {

From 278f2a401f677d2551004d3b027e6c994165b33a Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Thu, 11 Aug 2011 10:14:23 -0700
Subject: [PATCH 50/77] bug 10561: intermediate checkin for
 enable/disableStaticNat.

1) On enableStaticNat command we actually send the command to the backend (we used to just upgrade the DB in the past). The backend command carries sourceIp and destIp, and creates IP to IP mapping on the domR.
2) On disableStaticNat for the Ip address in addition to cleaning up port ranges, we also delete IP to IP mapping on the domR.
---
 .../api/routing/SetStaticNatRulesAnswer.java  |  4 +-
 .../cloud/agent/api/to/StaticNatRuleTO.java   |  4 +-
 .../api/commands/DisableStaticNatCmd.java     |  2 +-
 .../api/commands/EnableStaticNatCmd.java      |  2 +-
 .../cloud/network/element/NetworkElement.java | 10 +++
 .../com/cloud/network/rules/RulesService.java |  4 +-
 .../com/cloud/network/rules/StaticNat.java    | 35 +++++++++
 .../VirtualRoutingResource.java               | 10 ++-
 .../xen/resource/CitrixResourceBase.java      | 15 +++-
 .../src/com/cloud/network/NetworkManager.java |  3 +
 .../com/cloud/network/NetworkManagerImpl.java | 26 +++++++
 .../cloud/network/element/DhcpElement.java    |  6 ++
 .../element/ElasticLoadBalancerElement.java   |  6 ++
 .../com/cloud/network/element/OvsElement.java |  6 ++
 .../network/element/VirtualRouterElement.java | 18 +++++
 .../network/firewall/FirewallManagerImpl.java |  2 +-
 .../VirtualNetworkApplianceManager.java       |  4 +
 .../VirtualNetworkApplianceManagerImpl.java   | 63 +++++++++++++++-
 .../com/cloud/network/rules/RulesManager.java |  2 +
 .../cloud/network/rules/RulesManagerImpl.java | 73 ++++++++++++++++++-
 .../cloud/network/rules/StaticNatImpl.java    | 71 ++++++++++++++++++
 .../src/com/cloud/vm/UserVmManagerImpl.java   |  2 +-
 22 files changed, 347 insertions(+), 21 deletions(-)
 create mode 100644 api/src/com/cloud/network/rules/StaticNat.java
 create mode 100644 server/src/com/cloud/network/rules/StaticNatImpl.java

diff --git a/api/src/com/cloud/agent/api/routing/SetStaticNatRulesAnswer.java b/api/src/com/cloud/agent/api/routing/SetStaticNatRulesAnswer.java
index d7942e0cf7a..f393e8d31de 100644
--- a/api/src/com/cloud/agent/api/routing/SetStaticNatRulesAnswer.java
+++ b/api/src/com/cloud/agent/api/routing/SetStaticNatRulesAnswer.java
@@ -25,8 +25,8 @@ public class SetStaticNatRulesAnswer extends Answer {
         super();
     }
     
-    public SetStaticNatRulesAnswer(SetStaticNatRulesCommand cmd, String[] results) {
-        super(cmd, true, null);
+    public SetStaticNatRulesAnswer(SetStaticNatRulesCommand cmd, String[] results, Boolean success) {
+        super(cmd, success, null);
         
         assert(cmd.getRules().length == results.length) : "Shouldn't the results match the commands?";
         this.results = results;
diff --git a/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java b/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java
index c0359dbb0d7..a4845989d7f 100644
--- a/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java
+++ b/api/src/com/cloud/agent/api/to/StaticNatRuleTO.java
@@ -41,8 +41,8 @@ public class StaticNatRuleTO extends FirewallRuleTO{
     }
     
     
-    protected StaticNatRuleTO(long id, String srcIp, int srcPortStart, int srcPortEnd, String dstIp, int dstPortStart, int dstPortEnd, String protocol, boolean revoked, boolean brandNew) {
-        super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, brandNew, FirewallRule.Purpose.StaticNat, null,0,0);
+    public StaticNatRuleTO(long id, String srcIp, Integer srcPortStart, Integer srcPortEnd, String dstIp, Integer dstPortStart, Integer dstPortEnd, String protocol, boolean revoked, boolean alreadyAdded) {
+        super(id, srcIp, protocol, srcPortStart, srcPortEnd, revoked, alreadyAdded, FirewallRule.Purpose.StaticNat, null,0,0);
         this.dstIp = dstIp;
     }
 
diff --git a/api/src/com/cloud/api/commands/DisableStaticNatCmd.java b/api/src/com/cloud/api/commands/DisableStaticNatCmd.java
index 258cbd6b021..afc68cd7d66 100644
--- a/api/src/com/cloud/api/commands/DisableStaticNatCmd.java
+++ b/api/src/com/cloud/api/commands/DisableStaticNatCmd.java
@@ -76,7 +76,7 @@ public class DisableStaticNatCmd extends BaseAsyncCmd {
     
     @Override
     public void execute() throws ResourceUnavailableException {
-        boolean result = _rulesService.disableOneToOneNat(ipAddressId);
+        boolean result = _rulesService.disableStaticNat(ipAddressId);
         
         if (result) {
             SuccessResponse response = new SuccessResponse(getCommandName());
diff --git a/api/src/com/cloud/api/commands/EnableStaticNatCmd.java b/api/src/com/cloud/api/commands/EnableStaticNatCmd.java
index 3b6262b8259..e8f1879e7ab 100644
--- a/api/src/com/cloud/api/commands/EnableStaticNatCmd.java
+++ b/api/src/com/cloud/api/commands/EnableStaticNatCmd.java
@@ -80,7 +80,7 @@ public class EnableStaticNatCmd extends BaseCmd{
     @Override
     public void execute(){ 
         try {
-            boolean result = _rulesService.enableOneToOneNat(ipAddressId, virtualMachineId);
+            boolean result = _rulesService.enableStaticNat(ipAddressId, virtualMachineId);
             if (result) {
                 SuccessResponse response = new SuccessResponse(getCommandName());
                 this.setResponseObject(response);
diff --git a/api/src/com/cloud/network/element/NetworkElement.java b/api/src/com/cloud/network/element/NetworkElement.java
index c14b06db9b6..a4f42dffd9d 100644
--- a/api/src/com/cloud/network/element/NetworkElement.java
+++ b/api/src/com/cloud/network/element/NetworkElement.java
@@ -35,6 +35,7 @@ import com.cloud.network.Network.Provider;
 import com.cloud.network.Network.Service;
 import com.cloud.network.PublicIpAddress;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.utils.component.Adapter;
 import com.cloud.vm.NicProfile;
@@ -132,5 +133,14 @@ public interface NetworkElement extends Adapter {
      * @throws ResourceUnavailableException
      */
     boolean applyRules(Network network, List<? extends FirewallRule> rules) throws ResourceUnavailableException;
+    
+    /**
+     * Creates static nat rule (public IP to private IP mapping) on the network element
+     * @param config
+     * @param rules
+     * @return
+     * @throws ResourceUnavailableException
+     */
+    boolean applyStaticNats(Network config, List<? extends StaticNat> rules) throws ResourceUnavailableException;
 
 }
diff --git a/api/src/com/cloud/network/rules/RulesService.java b/api/src/com/cloud/network/rules/RulesService.java
index 7af02a291fd..61e912ae5e0 100644
--- a/api/src/com/cloud/network/rules/RulesService.java
+++ b/api/src/com/cloud/network/rules/RulesService.java
@@ -54,9 +54,9 @@ public interface RulesService {
 
     boolean applyPortForwardingRules(long ipAdddressId, Account caller) throws ResourceUnavailableException;
     
-    boolean enableOneToOneNat(long ipAddressId, long vmId) throws NetworkRuleConflictException;
+    boolean enableStaticNat(long ipAddressId, long vmId) throws NetworkRuleConflictException;
     
-    boolean disableOneToOneNat(long ipAddressId) throws ResourceUnavailableException;
+    boolean disableStaticNat(long ipAddressId) throws ResourceUnavailableException;
     
     PortForwardingRule getPortForwardigRule(long ruleId);
     FirewallRule getFirewallRule(long ruleId);
diff --git a/api/src/com/cloud/network/rules/StaticNat.java b/api/src/com/cloud/network/rules/StaticNat.java
new file mode 100644
index 00000000000..430eaf42094
--- /dev/null
+++ b/api/src/com/cloud/network/rules/StaticNat.java
@@ -0,0 +1,35 @@
+/**
+ *  Copyright (C) 2010 Cloud.com, Inc.  All rights reserved.
+ * 
+ * This software is licensed under the GNU General Public License v3 or later.
+ * 
+ * It is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * 
+ */
+
+package com.cloud.network.rules;
+
+
+public interface StaticNat{
+    
+    long getAccountId();
+    
+    long getDomainId();
+    
+    long getNetworkId();
+    
+    long getSourceIpAddressId();
+
+    String getDestIpAddress();
+
+    boolean isForRevoke();
+}
diff --git a/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java b/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
index f8ff6766ecb..d51ca001c1e 100755
--- a/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
+++ b/core/src/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
@@ -193,6 +193,7 @@ public class VirtualRoutingResource implements Manager {
         String routerIp = cmd.getAccessDetail(NetworkElementCommand.ROUTER_IP);
         String[] results = new String[cmd.getRules().length];
         int i = 0;
+        boolean endResult = true;
         for (StaticNatRuleTO rule : cmd.getRules()) {
             String result = null;
             final Script command = new Script(_firewallPath, _timeout, s_logger);
@@ -207,10 +208,15 @@ public class VirtualRoutingResource implements Manager {
             command.add(" -G ") ;
             
             result = command.execute();
-            results[i++] = (!(result == null || result.isEmpty())) ? "Failed" : null;
+            if (result == null || result.isEmpty()) {
+                results[i++] = "Failed";
+                endResult = false;
+            } else {
+                results[i++] = null;
+            }
         }
 
-        return new SetStaticNatRulesAnswer(cmd, results);
+        return new SetStaticNatRulesAnswer(cmd, results, endResult);
     }
     
 
diff --git a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
index 0a720014021..a5fcc203484 100644
--- a/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
+++ b/core/src/com/cloud/hypervisor/xen/resource/CitrixResourceBase.java
@@ -1269,6 +1269,7 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
         //String args = routerIp;
         String[] results = new String[cmd.getRules().length];
         int i = 0;
+        boolean endResult = true;
         for (StaticNatRuleTO rule : cmd.getRules()) {
             //1:1 NAT needs instanceip;publicip;domrip;op
             StringBuilder args = new StringBuilder();
@@ -1276,15 +1277,23 @@ public abstract class CitrixResourceBase implements ServerResource, HypervisorRe
             args.append(rule.revoked() ? " -D " : " -A ");
             args.append(" -l ").append(rule.getSrcIp());
             args.append(" -r ").append(rule.getDstIp());
-            args.append(" -P ").append(rule.getProtocol().toLowerCase());
+            if (rule.getProtocol() != null) {
+                args.append(" -P ").append(rule.getProtocol().toLowerCase());
+            }
+           
             args.append(" -d ").append(rule.getStringSrcPortRange());
             args.append(" -G ");
            
             String result = callHostPlugin(conn, "vmops", "setFirewallRule", "args", args.toString());
-            results[i++] = (result == null || result.isEmpty()) ? "Failed" : null;
+            if (result == null || result.isEmpty()) {
+                results[i++] = "Failed";
+                endResult = false;
+            } else {
+                results[i++] = null;
+            }
         }
 
-        return new SetStaticNatRulesAnswer(cmd, results);
+        return new SetStaticNatRulesAnswer(cmd, results, endResult);
     }
 
     protected Answer execute(final LoadBalancerConfigCommand cmd) {
diff --git a/server/src/com/cloud/network/NetworkManager.java b/server/src/com/cloud/network/NetworkManager.java
index c46f2b6728e..163c428cc10 100644
--- a/server/src/com/cloud/network/NetworkManager.java
+++ b/server/src/com/cloud/network/NetworkManager.java
@@ -35,6 +35,7 @@ import com.cloud.network.Networks.TrafficType;
 import com.cloud.network.addr.PublicIp;
 import com.cloud.network.guru.NetworkGuru;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.network.vpn.PasswordResetElement;
 import com.cloud.network.vpn.RemoteAccessVpnElement;
 import com.cloud.offerings.NetworkOfferingVO;
@@ -210,4 +211,6 @@ public interface NetworkManager extends NetworkService {
     String getGlobalGuestDomainSuffix();
     
     String getStartIpAddress(long networkId);
+    
+    boolean applyStaticNats(List<? extends StaticNat> staticNats, boolean continueOnError) throws ResourceUnavailableException;
 }
diff --git a/server/src/com/cloud/network/NetworkManagerImpl.java b/server/src/com/cloud/network/NetworkManagerImpl.java
index e30225f3a69..3cb30dea9af 100755
--- a/server/src/com/cloud/network/NetworkManagerImpl.java
+++ b/server/src/com/cloud/network/NetworkManagerImpl.java
@@ -102,6 +102,7 @@ import com.cloud.network.guru.NetworkGuru;
 import com.cloud.network.lb.LoadBalancingRulesManager;
 import com.cloud.network.rules.FirewallManager;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.network.rules.FirewallRuleVO;
 import com.cloud.network.rules.RulesManager;
@@ -3190,4 +3191,29 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
         
         return startIP;
     }
+    
+    @Override
+    public boolean applyStaticNats(List<? extends StaticNat> staticNats, boolean continueOnError) throws ResourceUnavailableException {
+        if (staticNats == null || staticNats.size() == 0) {
+            s_logger.debug("There are no static nat rules for the network elements");
+            return true;
+        }
+
+        boolean success = true;
+        Network network = _networksDao.findById(staticNats.get(0).getNetworkId());
+        for (NetworkElement ne : _networkElements) {
+            try {
+                boolean handled = ne.applyStaticNats(network, staticNats);
+                s_logger.debug("Static Nat for network " + network.getId() + " were " + (handled ? "" : " not") + " handled by " + ne.getName());
+            } catch (ResourceUnavailableException e) {
+                if (!continueOnError) {
+                    throw e;
+                }
+                s_logger.warn("Problems with " + ne.getName() + " but pushing on", e);
+                success = false;
+            }
+        }
+
+        return success;
+    }
 }
diff --git a/server/src/com/cloud/network/element/DhcpElement.java b/server/src/com/cloud/network/element/DhcpElement.java
index 97dff205318..42efc838cad 100644
--- a/server/src/com/cloud/network/element/DhcpElement.java
+++ b/server/src/com/cloud/network/element/DhcpElement.java
@@ -45,6 +45,7 @@ import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.router.VirtualNetworkApplianceManager;
 import com.cloud.network.router.VirtualRouter;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.network.vpn.PasswordResetElement;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.user.AccountManager;
@@ -245,4 +246,9 @@ public class DhcpElement extends AdapterBase implements NetworkElement, Password
  
         return _routerMgr.savePasswordToRouter(network, nic, uservm);
     }
+    
+    @Override
+    public boolean applyStaticNats(Network config, List<? extends StaticNat> rules) throws ResourceUnavailableException {
+        return false;
+    }
 }
diff --git a/server/src/com/cloud/network/element/ElasticLoadBalancerElement.java b/server/src/com/cloud/network/element/ElasticLoadBalancerElement.java
index 63824448330..c096325814d 100644
--- a/server/src/com/cloud/network/element/ElasticLoadBalancerElement.java
+++ b/server/src/com/cloud/network/element/ElasticLoadBalancerElement.java
@@ -42,6 +42,7 @@ import com.cloud.network.PublicIpAddress;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.lb.ElasticLoadBalancerManager;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.offerings.dao.NetworkOfferingDao;
 import com.cloud.utils.component.AdapterBase;
@@ -166,4 +167,9 @@ public class ElasticLoadBalancerElement extends AdapterBase implements NetworkEl
         }
         return true;
     }
+    
+    @Override
+    public boolean applyStaticNats(Network config, List<? extends StaticNat> rules) throws ResourceUnavailableException {
+        return false;
+    }
 }
diff --git a/server/src/com/cloud/network/element/OvsElement.java b/server/src/com/cloud/network/element/OvsElement.java
index ed51c0291bc..4cfe1ef50e2 100644
--- a/server/src/com/cloud/network/element/OvsElement.java
+++ b/server/src/com/cloud/network/element/OvsElement.java
@@ -38,6 +38,7 @@ import com.cloud.network.element.NetworkElement;
 import com.cloud.network.ovs.OvsNetworkManager;
 import com.cloud.network.ovs.OvsTunnelManager;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.utils.component.AdapterBase;
 import com.cloud.utils.component.Inject;
@@ -142,5 +143,10 @@ public class OvsElement extends AdapterBase implements NetworkElement {
 			throws ConcurrentOperationException, ResourceUnavailableException {
 		return true;
 	}
+	
+   @Override
+    public boolean applyStaticNats(Network config, List<? extends StaticNat> rules) throws ResourceUnavailableException {
+        return false;
+    }
 
 }
diff --git a/server/src/com/cloud/network/element/VirtualRouterElement.java b/server/src/com/cloud/network/element/VirtualRouterElement.java
index d4bfa290c99..f7fe4354b53 100644
--- a/server/src/com/cloud/network/element/VirtualRouterElement.java
+++ b/server/src/com/cloud/network/element/VirtualRouterElement.java
@@ -49,6 +49,7 @@ import com.cloud.network.router.VirtualNetworkApplianceManager;
 import com.cloud.network.router.VirtualRouter;
 import com.cloud.network.rules.FirewallRule;
 import com.cloud.network.rules.RulesManager;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.network.vpn.RemoteAccessVpnElement;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.offerings.dao.NetworkOfferingDao;
@@ -284,4 +285,21 @@ public class VirtualRouterElement extends DhcpElement implements NetworkElement,
         
         return capabilities;
     }
+    
+    @Override
+    public boolean applyStaticNats(Network config, List<? extends StaticNat> rules) throws ResourceUnavailableException {
+        DataCenter dc = _configMgr.getZone(config.getDataCenterId());
+        if (canHandle(config.getGuestType(),dc)) {
+            long networkId = config.getId();
+            List<DomainRouterVO> routers = _routerDao.findByNetwork(networkId);
+            if (routers == null || routers.isEmpty()) {
+                s_logger.debug("Virtual router elemnt doesn't need to apply static nat on the backend; virtual router doesn't exist in the network " + config.getId());
+                return true;
+            }
+            
+            return _routerMgr.applyStaticNats(config, rules);
+        } else {
+            return true;
+        }
+    }
 }
diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index ea9712e33cb..d6105b65d79 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -317,7 +317,6 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
                 throw new InvalidParameterValueException("Protocol " + proto + " is currently supported only for rules with purpose " + Purpose.Firewall);
             }
         }
-        
     }
     
     @Override
@@ -516,4 +515,5 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
 
         return rules.size() == 0;
     }
+    
 }
diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java
index 2fc0902d21f..dbae1f1e4a3 100644
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManager.java
@@ -30,6 +30,7 @@ import com.cloud.network.RemoteAccessVpn;
 import com.cloud.network.VirtualNetworkApplianceService;
 import com.cloud.network.VpnUser;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.user.Account;
 import com.cloud.user.User;
 import com.cloud.uservm.UserVm;
@@ -89,4 +90,7 @@ public interface VirtualNetworkApplianceManager extends Manager, VirtualNetworkA
     VirtualRouter stop(VirtualRouter router, boolean forced, User callingUser, Account callingAccount) throws ConcurrentOperationException, ResourceUnavailableException;
 
     String getDnsBasicZoneUpdate();
+    
+    boolean applyStaticNats(Network network, List<? extends StaticNat> rules) throws ResourceUnavailableException;
+
 }
diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index bf60675a1ee..90a40472733 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -135,6 +135,7 @@ import com.cloud.network.rules.FirewallRule;
 import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.network.rules.PortForwardingRule;
 import com.cloud.network.rules.RulesManager;
+import com.cloud.network.rules.StaticNat;
 import com.cloud.network.rules.StaticNatRule;
 import com.cloud.network.rules.dao.PortForwardingRulesDao;
 import com.cloud.offering.NetworkOffering;
@@ -2087,8 +2088,8 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
     public boolean applyFirewallRules(Network network, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
         List<DomainRouterVO> routers = _routerDao.findByNetwork(network.getId());
         if (routers == null || routers.isEmpty()) {
-            s_logger.warn("Unable to apply lb rules, virtual router doesn't exist in the network " + network.getId());
-            throw new ResourceUnavailableException("Unable to apply lb rules", DataCenter.class, network.getDataCenterId());
+            s_logger.warn("Unable to apply firewall rules, virtual router doesn't exist in the network " + network.getId());
+            throw new ResourceUnavailableException("Unable to apply firewall rules", DataCenter.class, network.getDataCenterId());
         }
 
         boolean result = true;
@@ -2197,4 +2198,62 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
         return _dnsBasicZoneUpdates;
     }
     
+    
+    @Override
+    public boolean applyStaticNats(Network network, List<? extends StaticNat> rules) throws ResourceUnavailableException {
+        List<DomainRouterVO> routers = _routerDao.findByNetwork(network.getId());
+        if (routers == null || routers.isEmpty()) {
+            s_logger.warn("Unable to create static nat, virtual router doesn't exist in the network " + network.getId());
+            throw new ResourceUnavailableException("Unable to create static nat", DataCenter.class, network.getDataCenterId());
+        }
+
+        boolean result = true;
+        for (DomainRouterVO router : routers) {
+            if (router.getState() == State.Running) {
+                s_logger.debug("Applying " + rules.size() + " static nat in network " + network);
+                result = applyStaticNat(router, rules);
+                
+                //If rules fail to apply on one domR, no need to proceed with the rest
+                if (!result) {
+                    throw new ResourceUnavailableException("Unable to apply static nat on router ", VirtualRouter.class, router.getId());
+                }
+                
+            } else if (router.getState() == State.Stopped || router.getState() == State.Stopping) {
+                s_logger.debug("Router is in " + router.getState() + ", so not sending apply firewall rules commands to the backend");
+            } else {
+                s_logger.warn("Unable to apply static nat, virtual router is not in the right state " + router.getState());
+                throw new ResourceUnavailableException("Unable to apply static nat, virtual router is not in the right state", VirtualRouter.class, router.getId());
+            }
+        }
+        
+        return result;
+    }
+    
+    
+    protected boolean applyStaticNat(DomainRouterVO router, List<? extends StaticNat> rules) throws ResourceUnavailableException {
+        Commands cmds = new Commands(OnError.Continue);
+        createApplyStaticNatCommands(rules, router, cmds);
+        // Send commands to router
+        return sendCommandsToRouter(router, cmds);
+    }
+    
+    private void createApplyStaticNatCommands(List<? extends StaticNat> rules, DomainRouterVO router, Commands cmds) {
+        List<StaticNatRuleTO> rulesTO = null;
+        if (rules != null) {
+            rulesTO = new ArrayList<StaticNatRuleTO>();
+            for (StaticNat rule : rules) {
+                IpAddress sourceIp = _networkMgr.getIp(rule.getSourceIpAddressId());
+                StaticNatRuleTO ruleTO = new StaticNatRuleTO(0, sourceIp.getAddress().addr(), null, null, rule.getDestIpAddress(), null, null, null, rule.isForRevoke(), false);
+                rulesTO.add(ruleTO);
+            }
+        }
+
+        SetStaticNatRulesCommand cmd = new SetStaticNatRulesCommand(rulesTO);
+        cmd.setAccessDetail(NetworkElementCommand.ROUTER_IP, router.getPrivateIpAddress());
+        cmd.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, router.getGuestIpAddress());
+        cmd.setAccessDetail(NetworkElementCommand.ROUTER_NAME, router.getInstanceName());
+        DataCenterVO dcVo = _dcDao.findById(router.getDataCenterIdToDeployIn());
+        cmd.setAccessDetail(NetworkElementCommand.ZONE_NETWORK_TYPE, dcVo.getNetworkType().toString());
+        cmds.addCommand(cmd);
+    }
 }
diff --git a/server/src/com/cloud/network/rules/RulesManager.java b/server/src/com/cloud/network/rules/RulesManager.java
index 8872d2c1b95..1f83b1ca320 100644
--- a/server/src/com/cloud/network/rules/RulesManager.java
+++ b/server/src/com/cloud/network/rules/RulesManager.java
@@ -66,6 +66,8 @@ public interface RulesManager extends RulesService {
 	boolean releasePorts(long ipId, String protocol, FirewallRule.Purpose purpose, int... ports);
 	
 	List<PortForwardingRuleVO> listByNetworkId(long networkId);
+
+    boolean applyStaticNat(long sourceIpId, boolean continueOnError, Account caller, boolean forRevoke);
 	
 	
 }
diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java
index 972d7816e51..d1130dad42b 100755
--- a/server/src/com/cloud/network/rules/RulesManagerImpl.java
+++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java
@@ -291,7 +291,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
     }
 
     @Override
-    public boolean enableOneToOneNat(long ipId, long vmId) throws NetworkRuleConflictException {
+    public boolean enableStaticNat(long ipId, long vmId) throws NetworkRuleConflictException {
 
         Account caller = UserContext.current().getCaller();
 
@@ -351,7 +351,22 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
 
         ipAddress.setOneToOneNat(true);
         ipAddress.setAssociatedWithVmId(vmId);
-        return _ipAddressDao.update(ipAddress.getId(), ipAddress);
+        if (_ipAddressDao.update(ipAddress.getId(), ipAddress)) {
+            //enable static nat on the backend
+            s_logger.trace("Enabling static nat for ip address " + ipAddress + " and vm id=" + vmId + " on the backend");
+            if (applyStaticNat(ipId, false, caller, false)) {
+                return true;
+            } else {
+                ipAddress.setOneToOneNat(false);
+                ipAddress.setAssociatedWithVmId(null);
+                _ipAddressDao.update(ipAddress.getId(), ipAddress);
+                s_logger.warn("Failed to enable static nat rule for ip address " + ipId + " on the backend");
+                return false;
+            }
+        } else {
+            s_logger.warn("Failed to update ip address " + ipAddress + " in the DB as a part of enableStaticNat");
+            return false;
+        }
     }
 
 
@@ -797,10 +812,14 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
             s_logger.debug("Releasing " + staticNatRules.size() + " static nat rules for ip id=" + ipId);
         }
 
+        
         for (FirewallRuleVO rule : staticNatRules) {
             // Mark all static nat rules as Revoke, but don't revoke them yet
             revokeStaticNatRuleInternal(rule.getId(), caller, userId, false);
         }
+        
+        //revoke static nat for the ip address
+        boolean staticNatRevoked = applyStaticNat(ipId, false, caller, true);
 
         // revoke all port forwarding rules
         applyPortForwardingRules(ipId, true, caller);
@@ -816,7 +835,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
             s_logger.debug("Successfully released rules for ip id=" + ipId + " and # of rules now = " + rules.size());
         }
 
-        return rules.size() == 0;
+        return (rules.size() == 0 && staticNatRevoked);
     }
 
     @Override
@@ -955,7 +974,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
     }
 
     @Override
-    public boolean disableOneToOneNat(long ipId) throws ResourceUnavailableException {
+    public boolean disableStaticNat(long ipId) throws ResourceUnavailableException {
         boolean success = true;
 
         Account caller = UserContext.current().getCaller();
@@ -1007,4 +1026,50 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         return new StaticNatRuleImpl(ruleVO, guestNic.getIp4Address());
     }
     
+    @Override
+    public boolean applyStaticNat(long sourceIpId, boolean continueOnError, Account caller, boolean forRevoke) {
+        
+        List<StaticNat> staticNats = new ArrayList<StaticNat>();
+        IpAddress sourceIp = _ipAddressDao.findById(sourceIpId);
+        
+        Long networkId = sourceIp.getAssociatedWithNetworkId();
+        if (networkId == null) {
+            throw new CloudRuntimeException("Ip address is not associated with any network");
+        }
+        
+        UserVmVO vm = _vmDao.findById(sourceIp.getAssociatedWithVmId());
+        Network network = _networkMgr.getNetwork(networkId);
+        if (network == null) {
+            throw new CloudRuntimeException("Unable to find ip address to map to in vm id=" + vm.getId());
+        }
+
+        if (!sourceIp.isOneToOneNat()) {
+            s_logger.debug("Source ip id=" + sourceIpId + " is not one to one nat");
+            return true;
+        }
+        
+        if (caller != null) {
+            _accountMgr.checkAccess(caller, sourceIp);
+        }
+
+        //create new static nat rule
+        // Get nic IP4 address
+        Nic guestNic = _networkMgr.getNicInNetwork(sourceIp.getAssociatedWithVmId(), networkId);
+        assert (guestNic != null && guestNic.getIp4Address() != null) : "Vm doesn't belong to network associated with ipAddress or ip4 address is null...how is it possible?";
+        String dstIp = guestNic.getIp4Address();
+        StaticNatImpl staticNat = new StaticNatImpl(sourceIp.getAccountId(), sourceIp.getDomainId(), networkId, sourceIpId, dstIp, forRevoke);
+        staticNats.add(staticNat);
+        
+        try {
+            if (!_networkMgr.applyStaticNats(staticNats, continueOnError)) {
+                return false;
+            }
+        } catch (ResourceUnavailableException ex) {
+            s_logger.warn("Failed to create static nat rule due to ", ex);
+            return false;
+        }
+
+        return true;
+    }
+    
 }
diff --git a/server/src/com/cloud/network/rules/StaticNatImpl.java b/server/src/com/cloud/network/rules/StaticNatImpl.java
new file mode 100644
index 00000000000..b8ebf2a002e
--- /dev/null
+++ b/server/src/com/cloud/network/rules/StaticNatImpl.java
@@ -0,0 +1,71 @@
+/**
+ *  Copyright (C) 2010 Cloud.com, Inc.  All rights reserved.
+ * 
+ * This software is licensed under the GNU General Public License v3 or later.
+ * 
+ * It is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * 
+ */
+
+package com.cloud.network.rules;
+
+public class StaticNatImpl implements StaticNat{
+    long accountId;
+    long domainId;
+    long networkId;
+    long sourceIpAddressId;
+    String destIpAddress;
+    boolean forRevoke;
+
+    
+
+    public StaticNatImpl(long accountId, long domainId, long networkId, long sourceIpAddressId, String destIpAddress, boolean forRevoke) {
+        super();
+        this.accountId = accountId;
+        this.domainId = domainId;
+        this.networkId = networkId;
+        this.sourceIpAddressId = sourceIpAddressId;
+        this.destIpAddress = destIpAddress;
+        this.forRevoke = forRevoke;
+    }
+
+    @Override
+    public long getAccountId() {
+        return accountId;
+    }
+
+    @Override
+    public long getDomainId() {
+        return domainId;
+    }
+
+    @Override
+    public long getNetworkId() {
+        return networkId;
+    }
+
+    @Override
+    public long getSourceIpAddressId() {
+        return sourceIpAddressId;
+    }
+
+    @Override
+    public String getDestIpAddress() {
+        return destIpAddress;
+    }
+
+    @Override
+    public boolean isForRevoke() {
+        return forRevoke;
+    }
+    
+}
diff --git a/server/src/com/cloud/vm/UserVmManagerImpl.java b/server/src/com/cloud/vm/UserVmManagerImpl.java
index a9cd7c16841..9866e252e80 100755
--- a/server/src/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/com/cloud/vm/UserVmManagerImpl.java
@@ -1254,7 +1254,7 @@ public class UserVmManagerImpl implements UserVmManager, UserVmService, Manager
         IPAddressVO ip = _ipAddressDao.findByAssociatedVmId(vmId);
         try {
             if (ip != null) {
-                if (_rulesMgr.disableOneToOneNat(ip.getId())) {
+                if (_rulesMgr.disableStaticNat(ip.getId())) {
                     s_logger.debug("Disabled 1-1 nat for ip address " + ip + " as a part of vm id=" + vmId + " expunge");
                 } else {
                     s_logger.warn("Failed to disable static nat for ip address " + ip + " as a part of vm id=" + vmId + " expunge");

From 1079a77024531fef5f9f65a2e3178887a59f61ae Mon Sep 17 00:00:00 2001
From: Alex Huang <alex@cloud.com>
Date: Thu, 11 Aug 2011 10:25:10 -0700
Subject: [PATCH 51/77] bug 11043: rverted the bad fix

---
 .../exception/CloudExecutionException.java    |  63 +++++++++
 api/src/com/cloud/exception/ErrorCode.java    |  54 ++++++++
 .../com/cloud/network/guru/NetworkGuru.java   |  51 ++++---
 .../cloud/vm/VirtualMachineManagerImpl.java   | 124 ++++++++----------
 .../src/com/cloud/utils/SerialVersionUID.java |   1 +
 5 files changed, 208 insertions(+), 85 deletions(-)
 create mode 100755 api/src/com/cloud/exception/CloudExecutionException.java
 create mode 100755 api/src/com/cloud/exception/ErrorCode.java

diff --git a/api/src/com/cloud/exception/CloudExecutionException.java b/api/src/com/cloud/exception/CloudExecutionException.java
new file mode 100755
index 00000000000..979043289e4
--- /dev/null
+++ b/api/src/com/cloud/exception/CloudExecutionException.java
@@ -0,0 +1,63 @@
+/**
+ * Copyright (C) 2011 Citrix Systems, Inc.  All rights reserved
+ * 
+ * This software is licensed under the GNU General Public License v3 or later.
+ * 
+ * It is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * 
+ */
+package com.cloud.exception;
+
+import java.util.HashMap;
+
+import com.cloud.utils.SerialVersionUID;
+
+/**
+ * CloudExecutionException is a generic exception thrown by components in
+ * CloudStack. It indicates an error in the execution of the business logic. 
+ * When using this exception, it is important to give detail information 
+ * about the error. At the entry points, this exception is caught but the
+ * stack trace is not logged so the information has to be detail enough 
+ * that one can find out what the error is simply by reading the error message.
+ * 
+ */
+public class CloudExecutionException extends RuntimeException {
+    private final static long serialVersionUID = SerialVersionUID.CloudExecutionException;
+    
+    private final ErrorCode code;
+    private final HashMap<String, Object> details;
+
+    public CloudExecutionException(ErrorCode code, String message, Throwable cause) {
+        super(message, cause);
+        this.code = code;
+        details = new HashMap<String, Object>();
+    }
+    
+    public ErrorCode getErrorCode() {
+        return code;
+    }
+    
+    public String getErrorMessage() {
+        return new StringBuilder("Error Code=").append(code).append("; Error Message=").append(super.toString()).toString();
+    }
+    
+    @Override
+    public String toString() {
+        StringBuilder buff = new StringBuilder();
+        buff.append("Error Code=").append(code);
+        buff.append("; Error Message=").append(super.toString());
+        if (details.size() > 0) {
+            buff.append("; Error Details=").append(details.toString());
+        }
+        return buff.toString();
+    }
+}
diff --git a/api/src/com/cloud/exception/ErrorCode.java b/api/src/com/cloud/exception/ErrorCode.java
new file mode 100755
index 00000000000..046443c0bad
--- /dev/null
+++ b/api/src/com/cloud/exception/ErrorCode.java
@@ -0,0 +1,54 @@
+/**
+ * Copyright (C) 2011 Citrix Systems, Inc.  All rights reserved
+ * 
+ * This software is licensed under the GNU General Public License v3 or later.
+ * 
+ * It is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or any later version.
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ * 
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ * 
+ */
+package com.cloud.exception;
+
+import java.util.HashSet;
+
+/**
+ * ErrorCode is a standard error code given by the API to represent the error. 
+ */
+public class ErrorCode {
+    String code;
+    private static HashSet<ErrorCode> s_codes = new HashSet<ErrorCode>();
+    
+    public ErrorCode(String code) {
+        this.code = code;
+        assert !s_codes.contains(this) : "There is already an error code registered for this code: " + code;
+        s_codes.add(this);
+    }
+    
+    public String getCode() {
+        return code;
+    }
+    
+    @Override
+    public int hashCode() {
+        return code.hashCode();
+    }
+    
+    @Override
+    public boolean equals(Object that) {
+        if (!(that instanceof ErrorCode)) {
+            return false;
+        }
+        
+        return this.code.equals(((ErrorCode)that).code);
+    }
+    
+    public final static ErrorCode UnableToReachResource = new ErrorCode("resource.unavailable");
+}
diff --git a/api/src/com/cloud/network/guru/NetworkGuru.java b/api/src/com/cloud/network/guru/NetworkGuru.java
index 5ead472300e..b2d2842b82f 100644
--- a/api/src/com/cloud/network/guru/NetworkGuru.java
+++ b/api/src/com/cloud/network/guru/NetworkGuru.java
@@ -52,29 +52,37 @@ public interface NetworkGuru extends Adapter {
      * @return NetworkConfiguration
      */
     Network design(NetworkOffering offering, DeploymentPlan plan, Network userSpecified, Account owner);
-    
+
     /**
-     * allocate a nic in this network.  This method implementation cannot take a long time as 
-     * it is meant to allocate for the DB.
-     * @param network configuration to allocate the nic in.
-     * @param nic user specified 
-     * @param vm virtual machine the network configuraiton will be in.
+     * allocate a nic in this network. This method implementation cannot take a long time as it is meant to allocate for
+     * the DB.
+     * 
+     * @param network
+     *            configuration to allocate the nic in.
+     * @param nic
+     *            user specified
+     * @param vm
+     *            virtual machine the network configuration will be in.
      * @return NicProfile.
      * @throws InsufficientVirtualNetworkCapcityException
      * @throws InsufficientAddressCapacityException
      */
     NicProfile allocate(Network network, NicProfile nic, VirtualMachineProfile<? extends VirtualMachine> vm) throws InsufficientVirtualNetworkCapcityException, InsufficientAddressCapacityException, ConcurrentOperationException;
-    
+
     /**
      * Fully implement the network configuration as specified.
-     * @param network network configuration 
-     * @param offering offering that the network configuration was based on.
-     * @param destination where were deploying to.
+     * 
+     * @param network
+     *            network configuration
+     * @param offering
+     *            offering that the network configuration was based on.
+     * @param destination
+     *            where were deploying to.
      * @return a fully implemented NetworkConfiguration.
-     * @throws InsufficientVirtualNetworkCapcityException TODO
+     * @throws InsufficientVirtualNetworkCapcityException
      */
     Network implement(Network network, NetworkOffering offering, DeployDestination destination, ReservationContext context) throws InsufficientVirtualNetworkCapcityException;
-    
+
     /**
      * reserve a nic for this VM in this network.
      * @param nic
@@ -89,13 +97,20 @@ public interface NetworkGuru extends Adapter {
     void reserve(NicProfile nic, Network network, VirtualMachineProfile<? extends VirtualMachine> vm, DeployDestination dest, ReservationContext context) throws InsufficientVirtualNetworkCapcityException, InsufficientAddressCapacityException, ConcurrentOperationException;
 
     boolean release(NicProfile nic, VirtualMachineProfile<? extends VirtualMachine> vm, String reservationId);
-    
+
     void deallocate(Network network, NicProfile nic, VirtualMachineProfile<? extends VirtualMachine> vm);
-    
+
+    /**
+     * @deprecated This method should not be here in the first place. What does this really mean? Is it always persisted
+     *             in the nic? When is it persisted in the nic? When is it called? No Idea.
+     * @param profile
+     * @param network
+     */
+    @Deprecated
     void updateNicProfile(NicProfile profile, Network network);
-    
+
     void shutdown(NetworkProfile network, NetworkOffering offering);
-    
+
     /**
      * Throw away the design.
      * @param network
@@ -104,7 +119,7 @@ public interface NetworkGuru extends Adapter {
      * @return
      */
     boolean trash(Network network, NetworkOffering offering, Account owner);
-    
+
     void updateNetworkProfile(NetworkProfile networkProfile);
-    
+
 }
diff --git a/server/src/com/cloud/vm/VirtualMachineManagerImpl.java b/server/src/com/cloud/vm/VirtualMachineManagerImpl.java
index e3b9f47fdfb..63ec27da1d3 100755
--- a/server/src/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/server/src/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -687,7 +687,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
                 }
 
                 if (dest == null) {
-                        throw new InsufficientServerCapacityException("Unable to create a deployment for " + vmProfile, DataCenter.class, plan.getDataCenterId());
+                    throw new InsufficientServerCapacityException("Unable to create a deployment for " + vmProfile, DataCenter.class, plan.getDataCenterId());
                 }
 
                 long destHostId = dest.getHost().getId();
@@ -929,6 +929,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
         }
 
         VirtualMachineGuru<T> vmGuru = getVmGuru(vm);
+        VirtualMachineProfile<T> profile = new VirtualMachineProfileImpl<T>(vm);
 
         try {
             if (!stateTransitTo(vm, Event.StopRequested, vm.getHostId())) {
@@ -939,66 +940,55 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
                 throw new CloudRuntimeException("We cannot stop " + vm + " when it is in state " + vm.getState());
             }
             s_logger.debug("Unable to transition the state but we're moving on because it's forced stop");
-        }
-
-        VirtualMachineProfile<T> profile = new VirtualMachineProfileImpl<T>(vm);
-        if ((vm.getState() == State.Starting || vm.getState() == State.Stopping || vm.getState() == State.Migrating) && forced) {
-            ItWorkVO work = _workDao.findByOutstandingWork(vm.getId(), vm.getState());
-            if (work == null) {
-                if (cleanup(vmGuru, new VirtualMachineProfileImpl<T>(vm), work, Event.StopRequested, forced, user, account)) {
-                    try {
-                        return stateTransitTo(vm, Event.AgentReportStopped, null);
-                    } catch (NoTransitionException e) {
-                        s_logger.warn("Unable to cleanup " + vm);
-                        return false;
-                    }
-                }
-            } else {
-                try {
-                    return stateTransitTo(vm, Event.AgentReportStopped, null);
-                } catch (NoTransitionException e) {
-                    s_logger.warn("Unable to cleanup " + vm);
-                    return false;
-                }
-            }
-        }
-
-        if (vm.getHostId() != null) {
-            String routerPrivateIp = null;
-            if (vm.getType() == VirtualMachine.Type.DomainRouter) {
-                routerPrivateIp = vm.getPrivateIpAddress();
-            }
-            StopCommand stop = new StopCommand(vm, vm.getInstanceName(), null, routerPrivateIp);
-            boolean stopped = false;
-            StopAnswer answer = null;
-            try {
-                answer = (StopAnswer) _agentMgr.send(vm.getHostId(), stop);
-                stopped = answer.getResult();
-                if (!stopped) {
-                    throw new CloudRuntimeException("Unable to stop the virtual machine due to " + answer.getDetails());
-                }
-                vmGuru.finalizeStop(profile, answer);
-
-            } catch (AgentUnavailableException e) {
-            } catch (OperationTimedoutException e) {
-            } finally {
-                if (!stopped) {
-                    if (!forced) {
-                        s_logger.warn("Unable to stop vm " + vm);
+            if (state == State.Starting || state == State.Stopping || state == State.Migrating) {
+                ItWorkVO work = _workDao.findByOutstandingWork(vm.getId(), vm.getState());
+                if (work != null) {
+                    if (cleanup(vmGuru, new VirtualMachineProfileImpl<T>(vm), work, Event.StopRequested, forced, user, account)) {
                         try {
-                            stateTransitTo(vm, Event.OperationFailed, vm.getHostId());
+                            return stateTransitTo(vm, Event.AgentReportStopped, null);
                         } catch (NoTransitionException e) {
-                            s_logger.warn("Unable to transition the state " + vm);
+                            s_logger.warn("Unable to cleanup " + vm);
+                            return false;
                         }
-                        return false;
-                    } else {
-                        s_logger.warn("Unable to actually stop " + vm + " but continue with release because it's a force stop");
-                        vmGuru.finalizeStop(profile, answer);
                     }
                 }
             }
         }
 
+        String routerPrivateIp = null;
+        if (vm.getType() == VirtualMachine.Type.DomainRouter) {
+            routerPrivateIp = vm.getPrivateIpAddress();
+        }
+        StopCommand stop = new StopCommand(vm, vm.getInstanceName(), null, routerPrivateIp);
+        boolean stopped = false;
+        StopAnswer answer = null;
+        try {
+            answer = (StopAnswer) _agentMgr.send(vm.getHostId(), stop);
+            stopped = answer.getResult();
+            if (!stopped) {
+                throw new CloudRuntimeException("Unable to stop the virtual machine due to " + answer.getDetails());
+            }
+            vmGuru.finalizeStop(profile, answer);
+
+        } catch (AgentUnavailableException e) {
+        } catch (OperationTimedoutException e) {
+        } finally {
+            if (!stopped) {
+                if (!forced) {
+                    s_logger.warn("Unable to stop vm " + vm);
+                    try {
+                        stateTransitTo(vm, Event.OperationFailed, vm.getHostId());
+                    } catch (NoTransitionException e) {
+                        s_logger.warn("Unable to transition the state " + vm);
+                    }
+                    return false;
+                } else {
+                    s_logger.warn("Unable to actually stop " + vm + " but continue with release because it's a force stop");
+                    vmGuru.finalizeStop(profile, answer);
+                }
+            }
+        }
+
         if (s_logger.isDebugEnabled()) {
             s_logger.debug(vm + " is stopped on the host.  Proceeding to release resource held.");
         }
@@ -1467,7 +1457,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
         return commands;
     }
 
-    
+
     protected Map<Long, AgentVmInfo> convertDeltaToInfos(final Map<String, State> states) {
         final HashMap<Long, AgentVmInfo> map = new HashMap<Long, AgentVmInfo>();
 
@@ -1498,7 +1488,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
 
         return map;
     }
-    
+
     protected Map<Long, AgentVmInfo> convertToInfos(final Map<String, VmState> states) {
         final HashMap<Long, AgentVmInfo> map = new HashMap<Long, AgentVmInfo>();
 
@@ -1701,7 +1691,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
     }
 
     public Commands fullSync(final long hostId, StartupRoutingCommand startup) {
-        
+
         Commands commands = new Commands(OnError.Continue);
         Map<Long, AgentVmInfo> infos = convertToInfos(startup.getVmStates());
         if( startup.isPoolSync()) {
@@ -1728,7 +1718,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
                     hId = host.getId();
                 }
                 HypervisorGuru hvGuru = _hvGuruMgr.getGuru(castedVm.getHypervisorType());
-    
+
                 Command command = compareState(hId, castedVm, info, true, hvGuru.trackVmHostChange());
                 if (command != null) {
                     commands.addCommand(command);
@@ -1738,13 +1728,13 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
                 s_logger.warn("Stopping a VM that we have no record of: " + left.name);
                 commands.addCommand(cleanup(left.name));
             }
-            
+
         } else {           
             final List<? extends VMInstanceVO> vms = _vmDao.listByHostId(hostId);
             s_logger.debug("Found " + vms.size() + " VMs for host " + hostId);
             for (VMInstanceVO vm : vms) {
                 AgentVmInfo info = infos.remove(vm.getId());
-    
+
                 VMInstanceVO castedVm = null;
                 if (info == null) {
                     info = new AgentVmInfo(vm.getInstanceName(), getVmGuru(vm), vm, State.Stopped);
@@ -1752,15 +1742,15 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
                 } else {
                     castedVm = info.vm;
                 }
-                
+
                 HypervisorGuru hvGuru = _hvGuruMgr.getGuru(castedVm.getHypervisorType());
-    
+
                 Command command = compareState(hostId, castedVm, info, true, hvGuru.trackVmHostChange());
                 if (command != null) {
                     commands.addCommand(command);
                 }
             }
-    
+
             for (final AgentVmInfo left : infos.values()) {
                 boolean found = false;
                 for (VirtualMachineGuru<? extends VMInstanceVO> vmGuru : _vmGurus.values()) {
@@ -1769,10 +1759,10 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
                         found = true;
                         HypervisorGuru hvGuru = _hvGuruMgr.getGuru(vm.getHypervisorType());
                         if(hvGuru.trackVmHostChange()) {
-    	                    Command command = compareState(hostId, vm, left, true, true);
-    	                    if (command != null) {
-    	                        commands.addCommand(command);
-    	                    }
+                            Command command = compareState(hostId, vm, left, true, true);
+                            if (command != null) {
+                                commands.addCommand(command);
+                            }
                         } else {
                             s_logger.warn("Stopping a VM,  VM " + left.name + " migrate from Host " + vm.getHostId() + " to Host " + hostId );
                             commands.addCommand(cleanup(left.name));
@@ -1940,7 +1930,7 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
             this.guru = (VirtualMachineGuru<VMInstanceVO>) guru;
             this.host = host;
         }
-        
+
         public AgentVmInfo(String name, VirtualMachineGuru<? extends VMInstanceVO> guru, VMInstanceVO vm, State state) {
             this(name, guru, vm, state, null);
         }
diff --git a/utils/src/com/cloud/utils/SerialVersionUID.java b/utils/src/com/cloud/utils/SerialVersionUID.java
index 889640ac13f..72f8c5686d4 100755
--- a/utils/src/com/cloud/utils/SerialVersionUID.java
+++ b/utils/src/com/cloud/utils/SerialVersionUID.java
@@ -64,4 +64,5 @@ public interface SerialVersionUID {
     public static final long VirtualMachineMigrationException = Base | 0x24;
     public static final long DiscoveredWithErrorException = Base | 0x25;
     public static final long NoTransitionException = Base | 0x26;
+    public static final long CloudExecutionException = Base | 0x27;
 }

From 8b405e477cec7a072cb100485a197b868171d6df Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Thu, 11 Aug 2011 10:57:05 -0700
Subject: [PATCH 52/77] Fix sometime system VM is up but mgmt server can't
 reach it

---
 patches/systemvm/debian/config/etc/init.d/cloud-early-config | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/patches/systemvm/debian/config/etc/init.d/cloud-early-config b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
index 69c1daa8dc4..d3748093337 100755
--- a/patches/systemvm/debian/config/etc/init.d/cloud-early-config
+++ b/patches/systemvm/debian/config/etc/init.d/cloud-early-config
@@ -250,6 +250,10 @@ setup_common() {
  
   # a hacking way to activate vSwitch under VMware
   ping -n -c 3 -w 5 $GW
+  if [ -n "$MGMTNET"  -a -n "$LOCAL_GW" ]
+  then
+      ping -n -c 3 -w 5 $LOCAL_GW
+  fi
 }
 
 setup_dnsmasq() {

From 05048324256a1f15506483ad559ff57477d21e2d Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 11:01:24 -0700
Subject: [PATCH 53/77] bug 11070: cloudStack - delete account - fix a bug that
 an API error showed after account was deleted ("listAccounts&id=N")

---
 ui/scripts/cloud.core.account.js | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/ui/scripts/cloud.core.account.js b/ui/scripts/cloud.core.account.js
index a0046fc72ef..e0f1a55d41d 100644
--- a/ui/scripts/cloud.core.account.js
+++ b/ui/scripts/cloud.core.account.js
@@ -384,7 +384,7 @@ function accountJsonToDetailsTab() {
         accountClearDetailsTab();
         return;
     }
-   
+
     $.ajax({
         data: createURL("command=listAccounts&id="+jsonObj.id),
         dataType: "json",
@@ -614,14 +614,12 @@ var accountActionMap = {
         asyncJobResponse: "deleteaccountresponse",
         dialogBeforeActionFn : doDeleteAccount,
         inProcessText: "label.action.delete.account.processing",
-        afterActionSeccessFn: function(json, $midmenuItem1, id) {    
-            $midmenuItem1.slideUp("slow", function() {                
-                $(this).remove();  
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    accountClearRightPanel();
-                }                
-            });
+        afterActionSeccessFn: function(json, $midmenuItem1, id) {  
+    	    $midmenuItem1.remove();
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                accountClearRightPanel();
+            }   
         }
     }          
 }; 

From 477e5d6389caa4848b3889da8efa710389010a88 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Thu, 11 Aug 2011 11:18:38 -0700
Subject: [PATCH 54/77] bug 10561: reapply static nat on the backend as a part
 of domR restart and network restart

---
 .../src/com/cloud/network/NetworkManager.java |  2 +
 .../com/cloud/network/NetworkManagerImpl.java | 13 +++++
 .../VirtualNetworkApplianceManagerImpl.java   | 15 ++++++
 .../com/cloud/network/rules/RulesManager.java |  7 +--
 .../cloud/network/rules/RulesManagerImpl.java | 51 ++++++++++++++-----
 5 files changed, 73 insertions(+), 15 deletions(-)

diff --git a/server/src/com/cloud/network/NetworkManager.java b/server/src/com/cloud/network/NetworkManager.java
index 163c428cc10..09fa13e6c56 100644
--- a/server/src/com/cloud/network/NetworkManager.java
+++ b/server/src/com/cloud/network/NetworkManager.java
@@ -213,4 +213,6 @@ public interface NetworkManager extends NetworkService {
     String getStartIpAddress(long networkId);
     
     boolean applyStaticNats(List<? extends StaticNat> staticNats, boolean continueOnError) throws ResourceUnavailableException;
+    
+    String getIpInNetwork(long vmId, long networkId);
 }
diff --git a/server/src/com/cloud/network/NetworkManagerImpl.java b/server/src/com/cloud/network/NetworkManagerImpl.java
index 3cb30dea9af..f4a50f22cb2 100755
--- a/server/src/com/cloud/network/NetworkManagerImpl.java
+++ b/server/src/com/cloud/network/NetworkManagerImpl.java
@@ -2432,6 +2432,12 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
             success = false;
         }
         
+        // apply static nat
+        if (!_rulesMgr.applyStaticNatsForNetwork(networkId, false, caller)) {
+            s_logger.warn("Failed to apply static nats a part of network id" + networkId + " restart");
+            success = false;
+        }
+        
         // apply firewall rules
         List<FirewallRuleVO> firewallRulesToApply = _firewallDao.listByNetworkAndPurpose(networkId, Purpose.Firewall);
         if (!_firewallMgr.applyFirewallRules(firewallRulesToApply, false, caller)) {
@@ -2631,6 +2637,13 @@ public class NetworkManagerImpl implements NetworkManager, NetworkService, Manag
     public Nic getNicInNetwork(long vmId, long networkId) {
         return _nicDao.findByInstanceIdAndNetworkId(networkId, vmId);
     }
+    
+    @Override
+    public String getIpInNetwork(long vmId, long networkId) {
+        Nic guestNic = getNicInNetwork(vmId, networkId);
+        assert (guestNic != null && guestNic.getIp4Address() != null) : "Vm doesn't belong to network associated with ipAddress or ip4 address is null...how is it possible?";
+        return guestNic.getIp4Address();
+    }
 
     @Override
     public Nic getNicInNetworkIncludingRemoved(long vmId, long networkId) {
diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 90a40472733..2c47ce5f017 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -136,6 +136,7 @@ import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.network.rules.PortForwardingRule;
 import com.cloud.network.rules.RulesManager;
 import com.cloud.network.rules.StaticNat;
+import com.cloud.network.rules.StaticNatImpl;
 import com.cloud.network.rules.StaticNatRule;
 import com.cloud.network.rules.dao.PortForwardingRulesDao;
 import com.cloud.offering.NetworkOffering;
@@ -1392,7 +1393,9 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                 List<RemoteAccessVpn> vpns = new ArrayList<RemoteAccessVpn>();
                 List<PortForwardingRule> pfRules = new ArrayList<PortForwardingRule>();
                 List<FirewallRule> staticNatFirewallRules = new ArrayList<FirewallRule>();
+                List<StaticNat> staticNats = new ArrayList<StaticNat>();
 
+                //Get information about all the rules (StaticNats and StaticNatRules; PFVPN to reapply on domR start)
                 for (PublicIpAddress ip : publicIps) {
                     pfRules.addAll(_pfRulesDao.listForApplication(ip.getId()));
                     staticNatFirewallRules.addAll(_rulesDao.listByIpAndPurpose(ip.getId(), Purpose.StaticNat));
@@ -1401,6 +1404,18 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                     if (vpn != null) {
                         vpns.add(vpn);
                     }
+                    
+                    if (ip.isOneToOneNat()) {
+                        String dstIp = _networkMgr.getIpInNetwork(ip.getAssociatedWithVmId(), networkId);
+                        StaticNatImpl staticNat = new StaticNatImpl(ip.getAccountId(), ip.getDomainId(), networkId, ip.getId(), dstIp, false);
+                        staticNats.add(staticNat);
+                    }
+                }
+                
+                //Re-apply static nats
+                s_logger.debug("Found " + staticNats.size() + " static nat(s) to apply as a part of domR " + router + " start.");
+                if (!staticNats.isEmpty()) {
+                    createApplyStaticNatCommands(staticNats, router, cmds);
                 }
 
                 // Re-apply port forwarding rules
diff --git a/server/src/com/cloud/network/rules/RulesManager.java b/server/src/com/cloud/network/rules/RulesManager.java
index 1f83b1ca320..04ea5829a75 100644
--- a/server/src/com/cloud/network/rules/RulesManager.java
+++ b/server/src/com/cloud/network/rules/RulesManager.java
@@ -67,7 +67,8 @@ public interface RulesManager extends RulesService {
 	
 	List<PortForwardingRuleVO> listByNetworkId(long networkId);
 
-    boolean applyStaticNat(long sourceIpId, boolean continueOnError, Account caller, boolean forRevoke);
-	
-	
+    boolean applyStaticNatForIp(long sourceIpId, boolean continueOnError, Account caller, boolean forRevoke);
+    
+    boolean applyStaticNatsForNetwork(long networkId, boolean continueOnError, Account caller);
+
 }
diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java
index d1130dad42b..767ae557200 100755
--- a/server/src/com/cloud/network/rules/RulesManagerImpl.java
+++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java
@@ -251,10 +251,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         Long accountId = ipAddress.getAccountId();
         Long domainId = ipAddress.getDomainId();
 
-        // Get nic IP4 address
-        Nic guestNic = _networkMgr.getNicInNetwork(ipAddress.getAssociatedWithVmId(), networkId);
-        assert (guestNic != null && guestNic.getIp4Address() != null) : "Vm doesn't belong to network associated with ipAddress or ip4 address is null...how is it possible?";
-        String dstIp = guestNic.getIp4Address();
+        String dstIp = _networkMgr.getIpInNetwork(ipAddress.getAssociatedWithVmId(), networkId);
 
         Transaction txn = Transaction.currentTxn();
         txn.start();
@@ -354,7 +351,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         if (_ipAddressDao.update(ipAddress.getId(), ipAddress)) {
             //enable static nat on the backend
             s_logger.trace("Enabling static nat for ip address " + ipAddress + " and vm id=" + vmId + " on the backend");
-            if (applyStaticNat(ipId, false, caller, false)) {
+            if (applyStaticNatForIp(ipId, false, caller, false)) {
                 return true;
             } else {
                 ipAddress.setOneToOneNat(false);
@@ -706,6 +703,38 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
 
         return true;
     }
+    
+    @Override
+    public boolean applyStaticNatsForNetwork(long networkId, boolean continueOnError, Account caller) {
+        List<IPAddressVO> ips = _ipAddressDao.listStaticNatPublicIps(networkId);
+        if (ips.isEmpty()) {
+            s_logger.debug("There are no static nat to apply for network id=" + networkId);
+            return true;
+        }
+        
+        if (caller != null) {
+            _accountMgr.checkAccess(caller, ips.toArray(new IPAddressVO[ips.size()]));
+        }
+        
+        List<StaticNat> staticNats = new ArrayList<StaticNat>();
+        for (IPAddressVO ip : ips) {
+            // Get nic IP4 address
+            String dstIp = _networkMgr.getIpInNetwork(ip.getAssociatedWithVmId(), networkId);
+            StaticNatImpl staticNat = new StaticNatImpl(ip.getAccountId(), ip.getDomainId(), networkId, ip.getId(), dstIp, false);
+            staticNats.add(staticNat);
+        }
+        
+        try {
+            if (!_networkMgr.applyStaticNats(staticNats, continueOnError)) {
+                return false;
+            }
+        } catch (ResourceUnavailableException ex) {
+            s_logger.warn("Failed to create static nat rule due to ", ex);
+            return false;
+        }
+
+        return true;
+    }
 
     @Override
     public List<? extends FirewallRule> searchStaticNatRules(Long ipId, Long id, Long vmId, Long start, Long size, String accountName, Long domainId) {
@@ -819,7 +848,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         }
         
         //revoke static nat for the ip address
-        boolean staticNatRevoked = applyStaticNat(ipId, false, caller, true);
+        boolean staticNatRevoked = applyStaticNatForIp(ipId, false, caller, true);
 
         // revoke all port forwarding rules
         applyPortForwardingRules(ipId, true, caller);
@@ -1021,13 +1050,13 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
             throw new InvalidParameterValueException("Source ip address of the rule id=" + rule.getId() + " is not static nat enabled");
         }
 
-        Nic guestNic = _networkMgr.getNicInNetwork(ip.getAssociatedWithVmId(), rule.getNetworkId());
+        String dstIp = _networkMgr.getIpInNetwork(ip.getAssociatedWithVmId(), rule.getNetworkId());
 
-        return new StaticNatRuleImpl(ruleVO, guestNic.getIp4Address());
+        return new StaticNatRuleImpl(ruleVO, dstIp);
     }
     
     @Override
-    public boolean applyStaticNat(long sourceIpId, boolean continueOnError, Account caller, boolean forRevoke) {
+    public boolean applyStaticNatForIp(long sourceIpId, boolean continueOnError, Account caller, boolean forRevoke) {
         
         List<StaticNat> staticNats = new ArrayList<StaticNat>();
         IpAddress sourceIp = _ipAddressDao.findById(sourceIpId);
@@ -1054,9 +1083,7 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
 
         //create new static nat rule
         // Get nic IP4 address
-        Nic guestNic = _networkMgr.getNicInNetwork(sourceIp.getAssociatedWithVmId(), networkId);
-        assert (guestNic != null && guestNic.getIp4Address() != null) : "Vm doesn't belong to network associated with ipAddress or ip4 address is null...how is it possible?";
-        String dstIp = guestNic.getIp4Address();
+        String dstIp = _networkMgr.getIpInNetwork(sourceIp.getAssociatedWithVmId(), networkId);
         StaticNatImpl staticNat = new StaticNatImpl(sourceIp.getAccountId(), sourceIp.getDomainId(), networkId, sourceIpId, dstIp, forRevoke);
         staticNats.add(staticNat);
         

From d54c3dab577d270033650081df526b1da5dfc1db Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Thu, 11 Aug 2011 11:25:10 -0700
Subject: [PATCH 55/77] fix firewall script. FIXME: make this 2 different
 scripts

---
 scripts/network/domr/call_firewall.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/network/domr/call_firewall.sh b/scripts/network/domr/call_firewall.sh
index 922b69a80ae..1e4dc939eaf 100755
--- a/scripts/network/domr/call_firewall.sh
+++ b/scripts/network/domr/call_firewall.sh
@@ -29,11 +29,10 @@ usage() {
   printf "Usage for other purposes : %s: <domR eth1 ip> (-A|-D) -i <domR eth1 ip>  -r <target-instance-ip> -P protocol (-p port_range | -t icmp_type_code)  -l <public ip address> -d <target port> [-f <firewall ip> -u <firewall user> -y <firewall password> -z <firewall enable password> ] \n" $(basename $0) >&2
 }
 
-# set -x
+#set -x
 
 # check if gateway domain is up and running
 check_gw() {
-# return 0;
   ping -c 1 -n -q $1 > /dev/null
   if [ $? -gt 0 ]
   then
@@ -54,11 +53,12 @@ then
   exit 1
 fi
 fflag=
-while getopts 'F:' OPTION
+while getopts ':F' OPTION
 do
   case $OPTION in 
   F)    fflag=1
                 ;;
+  \?)  ;;
   esac
 done
 

From d1ec7e759b2b1f53a992da88323fdb85d8aab1b4 Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Thu, 11 Aug 2011 11:26:39 -0700
Subject: [PATCH 56/77] remove cruft

---
 patches/systemvm/debian/config/root/firewall_rule.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index c38befbebaf..63b4656c111 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -19,7 +19,7 @@
 #
 #
 # @VERSION@
-echo $* >> /tmp/jana.log 
+
 usage() {
   printf "Usage: %s:  -a <public ip address:protocol:startport:endport:sourcecidrs>  \n" $(basename $0) >&2
   printf "sourcecidrs format:  cidr1-cidr2-cidr3-...\n"

From d47eb46faffafdda46cf256ef8deb5142df32fe0 Mon Sep 17 00:00:00 2001
From: keshav <keshav@cloud.com>
Date: Thu, 11 Aug 2011 11:40:46 -0700
Subject: [PATCH 57/77] Added parameter to enable the firewall rule UI to the
 list capabilities API.

---
 .../com/cloud/api/commands/ListCapabilitiesCmd.java   |  1 +
 .../com/cloud/api/response/CapabilitiesResponse.java  | 11 +++++++++++
 server/src/com/cloud/server/ManagementServerImpl.java |  4 +++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/api/src/com/cloud/api/commands/ListCapabilitiesCmd.java b/api/src/com/cloud/api/commands/ListCapabilitiesCmd.java
index 8fcc16d353b..87e9f37d54a 100644
--- a/api/src/com/cloud/api/commands/ListCapabilitiesCmd.java
+++ b/api/src/com/cloud/api/commands/ListCapabilitiesCmd.java
@@ -50,6 +50,7 @@ public class ListCapabilitiesCmd extends BaseCmd {
         response.setCloudStackVersion((String)capabilities.get("cloudStackVersion"));
         response.setUserPublicTemplateEnabled((Boolean)capabilities.get("userPublicTemplateEnabled"));
         response.setSupportELB((String)capabilities.get("supportELB"));
+        response.setFirewallRuleUiEnabled((Boolean) capabilities.get("firewallRuleUiEnabled"));
         response.setObjectName("capability");
         response.setResponseName(getCommandName());
         this.setResponseObject(response);
diff --git a/api/src/com/cloud/api/response/CapabilitiesResponse.java b/api/src/com/cloud/api/response/CapabilitiesResponse.java
index 7202ce70c39..07ed8d9120a 100644
--- a/api/src/com/cloud/api/response/CapabilitiesResponse.java
+++ b/api/src/com/cloud/api/response/CapabilitiesResponse.java
@@ -34,6 +34,9 @@ public class CapabilitiesResponse extends BaseResponse {
     
     @SerializedName("supportELB") @Param(description="true if region supports elastic load balancer on basic zones")
     private String supportELB;
+    
+    @SerializedName("firewallRuleUiEnabled") @Param(description="true if the firewall rule UI is enabled")
+    private boolean firewallRuleUiEnabled;
 
     public boolean getSecurityGroupsEnabled() {
         return securityGroupsEnabled;
@@ -66,4 +69,12 @@ public class CapabilitiesResponse extends BaseResponse {
     public String getSupportELB() {
         return supportELB;
     }
+    
+    public void setFirewallRuleUiEnabled(boolean firewallRuleUiEnabled) {
+    	this.firewallRuleUiEnabled = firewallRuleUiEnabled;
+    }
+    
+    public boolean getFirewallRuleUiEnabled() {
+    	return firewallRuleUiEnabled;
+    }
 }
diff --git a/server/src/com/cloud/server/ManagementServerImpl.java b/server/src/com/cloud/server/ManagementServerImpl.java
index 52c86402ae2..41dc259f5e0 100755
--- a/server/src/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/com/cloud/server/ManagementServerImpl.java
@@ -4219,13 +4219,15 @@ public class ManagementServerImpl implements ManagementServer {
                     supportELB = networkType;
             }
         }
-
+        
+        String firewallRuleUiEnabled = _configs.get(Config.FirewallRuleUiEnabled.key());
         String userPublicTemplateEnabled = _configs.get(Config.AllowPublicUserTemplates.key());
 
         capabilities.put("securityGroupsEnabled", securityGroupsEnabled);
         capabilities.put("userPublicTemplateEnabled", (userPublicTemplateEnabled == null || userPublicTemplateEnabled.equals("false") ? false : true));
         capabilities.put("cloudStackVersion", getVersion());
         capabilities.put("supportELB", supportELB);
+        capabilities.put("firewallRuleUiEnabled", (firewallRuleUiEnabled != null && firewallRuleUiEnabled.equals("true")) ? true : false);
         return capabilities;
     }
 

From aa1e09224dd76aadebe7735c87638fca31b2d2d3 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 11:57:28 -0700
Subject: [PATCH 58/77] cloudStack - IP Address page - for elasticLB-basicZone,
 do not open firewall when creating load balancer rule and IP.

---
 ui/scripts/cloud.core.ipaddress.js | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index c8a1915565d..3b2f959c5d6 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -65,7 +65,7 @@ function ipGetSearchParams() {
 	return moreCriteria.join("");          
 }
 
-var firewallTabIsShown = true;
+var firewallTabIsShownInAdvancedZone = true;
 function afterLoadIpJSP() {
     //***** switch between different tabs (begin) ********************************************************************
     var tabArray = [$("#tab_details"), $("#tab_firewall"), $("#tab_port_range"), $("#tab_port_forwarding"), $("#tab_load_balancer"), $("#tab_vpn")];
@@ -129,8 +129,7 @@ function afterLoadIpJSP() {
 			        var algorithm = $thisDialog.find("#algorithm_select").val();  
 			        array1.push("&algorithm="+algorithm);
 			       
-			        if(firewallTabIsShown == true)
-			        	array1.push("&openfirewall=false");
+			        array1.push("&openfirewall=false"); //elasticLB(basicZone) has nothing to do with firewall, so do not open firewall  when creating LB rule in elasticLB(basicZone).
 			        
 			        var $midmenuItem1 = beforeAddingMidMenuItem() ;	
 			        $.ajax({
@@ -213,7 +212,7 @@ function afterLoadIpJSP() {
     else { 
     	$("#tab_details,#tab_content_details").show();
     	
-    	if(firewallTabIsShown == true)
+    	if(firewallTabIsShownInAdvancedZone == true)
     	    $("#tab_firewall").show();
     	else
     		$("#tab_firewall").hide();
@@ -467,7 +466,7 @@ function afterLoadIpJSP() {
 	        array1.push("&endPort="+endPort);
 	        array1.push("&protocol="+protocol);
 	           
-	        if(firewallTabIsShown == true)
+	        if(firewallTabIsShownInAdvancedZone == true)
 	        	array1.push("&openfirewall=false");
 	        
 	        $.ajax({
@@ -608,7 +607,7 @@ function afterLoadIpJSP() {
 		    var virtualMachineId = $createPortForwardingRow.find("#vm").val();	
 	        array1.push("&virtualmachineid=" + virtualMachineId);
 	        
-	        if(firewallTabIsShown == true)
+	        if(firewallTabIsShownInAdvancedZone == true)
 	        	array1.push("&openfirewall=false");
 	        
 	        $.ajax({
@@ -714,7 +713,7 @@ function afterLoadIpJSP() {
         var algorithm = createLoadBalancerRow.find("#algorithm_select").val();  
         array1.push("&algorithm="+algorithm);
         
-        if(firewallTabIsShown == true)
+        if(firewallTabIsShownInAdvancedZone == true)
         	array1.push("&openfirewall=false");
         
         $.ajax({
@@ -842,7 +841,12 @@ function ipToRightPanel($midmenuItem1) {
         $("#tab_details").click();        
    
     if(ipObj.isstaticnat == true) {
-        $("#tab_port_range").show();	
+    	if(firewallTabIsShownInAdvancedZone == true) {
+            $("#tab_port_range").hide();	
+    	} 
+    	else {
+    		$("#tab_port_range").show();
+    	}
         $("#tab_port_forwarding, #tab_load_balancer, #tab_vpn").hide();	
     }
     else { //ipObj.isstaticnat == false  
@@ -1162,7 +1166,7 @@ function showEnableVPNDialog($thisTab) {
 			array1.push("&account="+ipObj.account);
 			array1.push("&domainid="+ipObj.domainid);
 			array1.push("&zoneid="+ipObj.zoneid);	
-			if(firewallTabIsShown == true)
+			if(firewallTabIsShownInAdvancedZone == true)
 		        array1.push("&openfirewall=false");
 			
 			$.ajax({

From 88a1c69413f89c81ebb3a287b17aa87572c490ec Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Thu, 11 Aug 2011 12:41:10 -0700
Subject: [PATCH 59/77] bug 10561: get static nat working

---
 .../systemvm/debian/config/root/firewall.sh   | 57 ++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/patches/systemvm/debian/config/root/firewall.sh b/patches/systemvm/debian/config/root/firewall.sh
index 84cbab75d5f..a4b60b55378 100755
--- a/patches/systemvm/debian/config/root/firewall.sh
+++ b/patches/systemvm/debian/config/root/firewall.sh
@@ -138,6 +138,56 @@ one_to_one_fw_entry() {
   return $result
 }
 
+fw_chain_for_ip() {
+  local pubIp=$1
+  if  iptables -t mangle -N FIREWALL_$pubIp &> /dev/null
+  then
+    logger -t cloud "created a fw chain for $pubIp to DROP by default"
+    (sudo iptables -t mangle -A FIREWALL_$pubIp -j DROP) &&
+    (sudo iptables -t mangle -I FIREWALL_$pubIp -m state --state RELATED,ESTABLISHED -j ACCEPT ) &&
+    (sudo iptables -t mangle -I PREROUTING -d $pubIp -j FIREWALL_$pubIp)
+    return $?
+  fi
+  logger -t cloud "fw chain for $pubIp already exists"
+  return 0
+}
+
+static_nat() {
+  local publicIp=$1
+  local instIp=$2  
+  local op=$3
+  local op2="-D"
+  local rulenum=
+  logger -t cloud "$(basename $0): static nat: public ip=$publicIp \
+  instance ip=$instIp  op=$op"
+  
+  #TODO check error below
+  fw_chain_for_ip $publicIp
+
+  #if adding, this might be a duplicate, so delete the old one first
+  [ "$op" == "-A" ] && static_nat $publicIp $instIp  "-D" 
+  # the delete operation may have errored out but the only possible reason is 
+  # that the rules didn't exist in the first place
+  [ "$op" == "-A" ] && rulenum=1
+  [ "$op" == "-A" ] && op2="-I"
+
+  local dev=$(ip_to_dev $publicIp)
+  [ $? -ne 0 ] && echo "Could not find device associated with $publicIp" && return 1
+
+  # shortcircuit the process if error and it is an append operation
+  # continue if it is delete
+  (sudo iptables -t nat $op  PREROUTING -i $dev -d $publicIp -j DNAT \
+           --to-destination $instIp &>>  $OUTFILE || [ "$op" == "-D" ]) &&
+  (sudo iptables $op FORWARD -i $dev -o eth0 -d $instIp  -m state \
+           --state NEW -j ACCEPT &>>  $OUTFILE || [ "$op" == "-D" ]) &&
+  (sudo iptables -t nat $op2 POSTROUTING $rulenum -s $instIp -j SNAT \
+           --to-source $publicIp &>> $OUTFILE || [ "$op" == "-D" ])
+
+  result=$?
+  logger -t cloud "$(basename $0): done static nat entry public ip=$publicIp op=$op result=$result"
+  return $result
+}
+
 
 
 rflag=
@@ -192,7 +242,12 @@ OUTFILE=$(mktemp)
 #Firewall ports for one-to-one/static NAT
 if [ "$Gflag" == "1" ]
 then
-  one_to_one_fw_entry $publicIp $instanceIp  $protocol $dport $op
+  if [ "$protocol" == "" ] 
+  then
+    static_nat $publicIp $instanceIp  $op
+  else
+    one_to_one_fw_entry $publicIp $instanceIp  $protocol $dport $op
+  fi
   result=$?
   [ "$result" -ne 0 ] && cat $OUTFILE >&2
   rm -f $OUTFILE

From f28291cedb02de9a71e5f08a10b5186edd728bfa Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Thu, 11 Aug 2011 12:41:17 -0700
Subject: [PATCH 60/77] Fix redundant router switch back to single router

The existed redundant router network didn't change.
---
 .../network/router/VirtualNetworkApplianceManagerImpl.java     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 2c47ce5f017..d8005a4cf3a 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -876,7 +876,8 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                 }
             }
 
-            if (routers.size() == routerCount) {
+            /* If old network is redundant but new is single router, then routers.size() = 2 but routerCount = 1 */
+            if (routers.size() >= routerCount) {
                 return routers;
             }
 

From aea70fab01e473c1111d99b79e1b5df84da6ce34 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 13:10:51 -0700
Subject: [PATCH 61/77] cloudStack - IP Address page - hide network tab for
 system-owned IP.

---
 ui/scripts/cloud.core.ipaddress.js | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 3b2f959c5d6..6013051f7bf 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -211,12 +211,7 @@ function afterLoadIpJSP() {
 	}
     else { 
     	$("#tab_details,#tab_content_details").show();
-    	
-    	if(firewallTabIsShownInAdvancedZone == true)
-    	    $("#tab_firewall").show();
-    	else
-    		$("#tab_firewall").hide();
-    	
+    	    	
 	    //dialogs
 	    initDialog("dialog_acquire_public_ip", 325);
 		initDialog("dialog_enable_vpn");
@@ -304,7 +299,9 @@ function afterLoadIpJSP() {
 	    //*** Firewall tab (begin) ***
 	    var $createFirewallRow = $("#tab_content_firewall").find("#create_firewall_row");     
 	  
-	    $createFirewallRow.find("#protocol").bind("click", function(event) {	    	
+	    $createFirewallRow.find("#protocol").bind("click", function(event) {	
+	    	if($(this).val() == null)
+	    		return true;
 	    	var protocol = $(this).val().toLowerCase();	    
 	    	if(protocol == "tcp" || protocol == "udp") {
 	    		$createFirewallRow.find("#start_port,#end_port").removeAttr("disabled");
@@ -852,7 +849,11 @@ function ipToRightPanel($midmenuItem1) {
     else { //ipObj.isstaticnat == false  
         $("#tab_port_range").hide();
         if(ipObj.forvirtualnetwork == true) { //(public network)            
-            if(isIpManageable(ipObj.domainid, ipObj.account) == true) {           
+            if(isIpManageable(ipObj.domainid, ipObj.account) == true) {      
+            	if(firewallTabIsShownInAdvancedZone == true)
+            	    $("#tab_firewall").show();
+            	else
+            		$("#tab_firewall").hide();
 	            //Port Forwarding tab
 	            if(networkObj != null) {
 	                var firewallServiceObj = ipFindNetworkServiceByName("Firewall", networkObj);
@@ -915,12 +916,12 @@ function ipToRightPanel($midmenuItem1) {
 		            $("#tab_vpn").hide();
 		        }          
             } 
-            else { 
-	            $("#tab_port_forwarding, #tab_load_balancer, #tab_vpn").hide();	    
+            else {             	
+	            $("#tab_firewall, #tab_port_forwarding, #tab_load_balancer, #tab_vpn").hide();	    
             }
         }
         else { //ipObj.forvirtualnetwork == false (direct network)
-            $("#tab_port_forwarding, #tab_load_balancer, #tab_vpn").hide();	    
+            $("#tab_firewall, #tab_port_forwarding, #tab_load_balancer, #tab_vpn").hide();	    
         }            
     }        
 }

From 9083bbcb475829c55792d1448541981ee4e009eb Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Thu, 11 Aug 2011 13:30:07 -0700
Subject: [PATCH 62/77] bug 11084: enable firewall ports for vpn by default

---
 ui/scripts/cloud.core.ipaddress.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 6013051f7bf..2bc0354d353 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -1168,7 +1168,7 @@ function showEnableVPNDialog($thisTab) {
 			array1.push("&domainid="+ipObj.domainid);
 			array1.push("&zoneid="+ipObj.zoneid);	
 			if(firewallTabIsShownInAdvancedZone == true)
-		        array1.push("&openfirewall=false");
+		        array1.push("&openfirewall=true");
 			
 			$.ajax({
 				data: createURL("command=createRemoteAccessVpn"+array1.join("")),

From a73c6edcb972b9323a09d0f73a4a65a4b323ee49 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 13:42:05 -0700
Subject: [PATCH 63/77] cloudStack - IP Address page - take
 "firewallRuleUiEnabled" from listcapabilitiesresponse to determine to
 show/hide network tab.

---
 ui/scripts/cloud.core.init.js      | 10 +++++++++-
 ui/scripts/cloud.core.ipaddress.js | 13 ++++++-------
 ui/scripts/cloud.core.js           |  3 +--
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/ui/scripts/cloud.core.init.js b/ui/scripts/cloud.core.init.js
index 6440be35ac3..5ad24fb57cf 100644
--- a/ui/scripts/cloud.core.init.js
+++ b/ui/scripts/cloud.core.init.js
@@ -596,6 +596,7 @@ $(document).ready(function() {
 		g_timezoneoffset = null;
 		g_timezone = null;
 		g_supportELB = null;
+		g_firewallRuleUiEnabled = null;
 		
 		$.cookie('JSESSIONID', null);
 		$.cookie('sessionKey', null);
@@ -607,6 +608,7 @@ $(document).ready(function() {
 		$.cookie('timezoneoffset', null);
 		$.cookie('timezone', null);
 		$.cookie('supportELB', null);
+		$.cookie('firewallRuleUiEnabled', null);
 		
 		$("body").stopTime();
 		
@@ -706,7 +708,10 @@ $(document).ready(function() {
 					     */
 					    g_supportELB = json.listcapabilitiesresponse.capability.supportELB;					    
 					    $.cookie('supportELB', g_supportELB, { expires: 1}); 
-					    
+					    					    
+					    g_firewallRuleUiEnabled = json.listcapabilitiesresponse.capability.firewallRuleUiEnabled;					    
+					    $.cookie('firewallRuleUiEnabled', g_firewallRuleUiEnabled, { expires: 1}); 
+					    			    
 						if (json.listcapabilitiesresponse.capability.userpublictemplateenabled != null) {
 							g_userPublicTemplateEnabled = ""+json.listcapabilitiesresponse.capability.userpublictemplateenabled;
 							$.cookie('userpublictemplateenabled', g_userPublicTemplateEnabled, { expires: 1});
@@ -803,6 +808,9 @@ $(document).ready(function() {
 	
 	if(g_supportELB == null)
 		g_supportELB = $.cookie("supportELB");
+		
+	if(g_firewallRuleUiEnabled == null)
+		g_firewallRuleUiEnabled = $.cookie("firewallRuleUiEnabled");
 	
 	$.ajax({
 	    data: createURL("command=listCapabilities"),
diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 2bc0354d353..6925292c896 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -65,7 +65,6 @@ function ipGetSearchParams() {
 	return moreCriteria.join("");          
 }
 
-var firewallTabIsShownInAdvancedZone = true;
 function afterLoadIpJSP() {
     //***** switch between different tabs (begin) ********************************************************************
     var tabArray = [$("#tab_details"), $("#tab_firewall"), $("#tab_port_range"), $("#tab_port_forwarding"), $("#tab_load_balancer"), $("#tab_vpn")];
@@ -463,7 +462,7 @@ function afterLoadIpJSP() {
 	        array1.push("&endPort="+endPort);
 	        array1.push("&protocol="+protocol);
 	           
-	        if(firewallTabIsShownInAdvancedZone == true)
+	        if(g_firewallRuleUiEnabled == true)
 	        	array1.push("&openfirewall=false");
 	        
 	        $.ajax({
@@ -604,7 +603,7 @@ function afterLoadIpJSP() {
 		    var virtualMachineId = $createPortForwardingRow.find("#vm").val();	
 	        array1.push("&virtualmachineid=" + virtualMachineId);
 	        
-	        if(firewallTabIsShownInAdvancedZone == true)
+	        if(g_firewallRuleUiEnabled == true)
 	        	array1.push("&openfirewall=false");
 	        
 	        $.ajax({
@@ -710,7 +709,7 @@ function afterLoadIpJSP() {
         var algorithm = createLoadBalancerRow.find("#algorithm_select").val();  
         array1.push("&algorithm="+algorithm);
         
-        if(firewallTabIsShownInAdvancedZone == true)
+        if(g_firewallRuleUiEnabled == true)
         	array1.push("&openfirewall=false");
         
         $.ajax({
@@ -838,7 +837,7 @@ function ipToRightPanel($midmenuItem1) {
         $("#tab_details").click();        
    
     if(ipObj.isstaticnat == true) {
-    	if(firewallTabIsShownInAdvancedZone == true) {
+    	if(g_firewallRuleUiEnabled == true) {
             $("#tab_port_range").hide();	
     	} 
     	else {
@@ -850,7 +849,7 @@ function ipToRightPanel($midmenuItem1) {
         $("#tab_port_range").hide();
         if(ipObj.forvirtualnetwork == true) { //(public network)            
             if(isIpManageable(ipObj.domainid, ipObj.account) == true) {      
-            	if(firewallTabIsShownInAdvancedZone == true)
+            	if(g_firewallRuleUiEnabled == true)
             	    $("#tab_firewall").show();
             	else
             		$("#tab_firewall").hide();
@@ -1167,7 +1166,7 @@ function showEnableVPNDialog($thisTab) {
 			array1.push("&account="+ipObj.account);
 			array1.push("&domainid="+ipObj.domainid);
 			array1.push("&zoneid="+ipObj.zoneid);	
-			if(firewallTabIsShownInAdvancedZone == true)
+			if(g_firewallRuleUiEnabled == true)
 		        array1.push("&openfirewall=true");
 			
 			$.ajax({
diff --git a/ui/scripts/cloud.core.js b/ui/scripts/cloud.core.js
index 06dd351862e..2003ad404ae 100644
--- a/ui/scripts/cloud.core.js
+++ b/ui/scripts/cloud.core.js
@@ -1527,6 +1527,7 @@ var g_enableLogging = false;
 var g_timezoneoffset = null;
 var g_timezone = null;
 var g_supportELB = null;
+var g_firewallRuleUiEnabled = null; //true or false
 
 // capabilities
 var g_directAttachSecurityGroupsEnabled = "false";
@@ -1535,8 +1536,6 @@ function getDirectAttachSecurityGroupsEnabled() { return g_directAttachSecurityG
 var g_userPublicTemplateEnabled = "true";
 function getUserPublicTemplateEnabled() { return g_userPublicTemplateEnabled; }
 
-var g_supportELB = null;
-
 //keyboard keycode
 var keycode_Enter = 13;
 

From 10034bc1964a1580a9f8bf9e5962826479608c6c Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Thu, 11 Aug 2011 14:03:32 -0700
Subject: [PATCH 64/77] Fixed rule validation for static nat rules

---
 .../network/firewall/FirewallManagerImpl.java   | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
index d6105b65d79..d55e8d5b6aa 100644
--- a/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -231,17 +231,20 @@ public class FirewallManagerImpl implements FirewallService, FirewallManager, Ma
                 continue; // Skips my own rule.
             }
 
-            if (rule.getPurpose() == Purpose.StaticNat && newRule.getPurpose() != Purpose.StaticNat) {
-                throw new NetworkRuleConflictException("There is 1 to 1 Nat rule specified for the ip address id=" + newRule.getSourceIpAddressId());
-            } else if (rule.getPurpose() != Purpose.StaticNat && newRule.getPurpose() == Purpose.StaticNat) {
-                throw new NetworkRuleConflictException("There is already firewall rule specified for the ip address id=" + newRule.getSourceIpAddressId());
+            
+            boolean allowFirewall = ((rule.getPurpose() == Purpose.Firewall || newRule.getPurpose() == Purpose.Firewall) && newRule.getPurpose() != rule.getPurpose());
+            
+            if (!allowFirewall) {
+                if (rule.getPurpose() == Purpose.StaticNat && newRule.getPurpose() != Purpose.StaticNat) {
+                    throw new NetworkRuleConflictException("There is 1 to 1 Nat rule specified for the ip address id=" + newRule.getSourceIpAddressId());
+                } else if (rule.getPurpose() != Purpose.StaticNat && newRule.getPurpose() == Purpose.StaticNat) {
+                    throw new NetworkRuleConflictException("There is already firewall rule specified for the ip address id=" + newRule.getSourceIpAddressId());
+                }
             }
 
             if (rule.getNetworkId() != newRule.getNetworkId() && rule.getState() != State.Revoke) {
                 throw new NetworkRuleConflictException("New rule is for a different network than what's specified in rule " + rule.getXid());
-            }
-            
-            boolean allowFirewall = ((rule.getPurpose() == Purpose.Firewall || newRule.getPurpose() == Purpose.Firewall) && newRule.getPurpose() != rule.getPurpose());
+            }  
 
             boolean notNullPorts = (newRule.getSourcePortStart() != null && newRule.getSourcePortEnd() != null && rule.getSourcePortStart() != null && rule.getSourcePortEnd() != null);
             if (!allowFirewall && notNullPorts && ((rule.getSourcePortStart() <= newRule.getSourcePortStart() && rule.getSourcePortEnd() >= newRule.getSourcePortStart())

From ac62f290d3eaab888a97135406fb4e888b9ec343 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 14:23:49 -0700
Subject: [PATCH 65/77] bug 11070: cloudStack - delete
 domain/IPAddress/SecurityGroup/snapshot/volume - fix a bug that an API error
 showed after account was deleted ("listxxxxxxx&id=N")

---
 ui/scripts/cloud.core.domain.js        | 12 +++++-------
 ui/scripts/cloud.core.ipaddress.js     | 13 +++++--------
 ui/scripts/cloud.core.securitygroup.js | 12 +++++-------
 ui/scripts/cloud.core.snapshot.js      | 15 +++++++--------
 ui/scripts/cloud.core.volume.js        | 12 +++++-------
 5 files changed, 27 insertions(+), 37 deletions(-)

diff --git a/ui/scripts/cloud.core.domain.js b/ui/scripts/cloud.core.domain.js
index c2518cddd71..4478ec1bf41 100644
--- a/ui/scripts/cloud.core.domain.js
+++ b/ui/scripts/cloud.core.domain.js
@@ -717,13 +717,11 @@ var domainActionMap = {
         asyncJobResponse: "deletedomainresponse",          
         inProcessText: "label.action.delete.domain.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {        
-            $midmenuItem1.slideUp(function() {                
-                $(this).remove();   
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    domainJsonClearRightPanel();
-                }                
-            });                
+    		$midmenuItem1.remove();   	
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                domainJsonClearRightPanel();
+            }            
         }
     }    
 } 
\ No newline at end of file
diff --git a/ui/scripts/cloud.core.ipaddress.js b/ui/scripts/cloud.core.ipaddress.js
index 6925292c896..a453abff675 100644
--- a/ui/scripts/cloud.core.ipaddress.js
+++ b/ui/scripts/cloud.core.ipaddress.js
@@ -1718,14 +1718,11 @@ var ipActionMap = {
         dialogBeforeActionFn : doReleaseIp,
         inProcessText: "label.action.release.ip.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {   
-            $midmenuItem1.slideUp("slow", function(){
-                $(this).remove();                    
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    ipClearRightPanel();
-                }
-            });  
-            
+			$midmenuItem1.remove();   
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                ipClearRightPanel();
+            }
         }
     },
     "label.action.enable.static.NAT": {                      
diff --git a/ui/scripts/cloud.core.securitygroup.js b/ui/scripts/cloud.core.securitygroup.js
index 0799f936525..b24b1f172a4 100644
--- a/ui/scripts/cloud.core.securitygroup.js
+++ b/ui/scripts/cloud.core.securitygroup.js
@@ -588,13 +588,11 @@ var securityGroupActionMap = {
         dialogBeforeActionFn : doDeleteSecurityGroup,               
         inProcessText: "Deleting Security Group....",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {  
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    securityGroupClearRightPanel();
-                }
-            });                
+			$midmenuItem1.remove(); 
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                securityGroupClearRightPanel();
+            }                           
         }
     }    
 }  
\ No newline at end of file
diff --git a/ui/scripts/cloud.core.snapshot.js b/ui/scripts/cloud.core.snapshot.js
index e63f6a67993..fdfb33b7e76 100644
--- a/ui/scripts/cloud.core.snapshot.js
+++ b/ui/scripts/cloud.core.snapshot.js
@@ -198,7 +198,8 @@ function snapshotClearDetailsTab() {
     var $thisTab = $("#right_panel_content #tab_content_details");   
     $thisTab.find("#id").text("");
     $thisTab.find("#name").text("");
-    $thisTab.find("#volume_name").text("");
+    $thisTab.find("#volume_name").text("");    
+    $thisTab.find("#state").text("");
     $thisTab.find("#interval_type").text("");
     $thisTab.find("#account").text("");
     $thisTab.find("#domain").text("");      
@@ -220,13 +221,11 @@ var snapshotActionMap = {
 		dialogBeforeActionFn : doSnapshotDelete,
         inProcessText: "label.action.delete.snapshot.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id){   
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    snapshotClearRightPanel();
-                }
-            });            
+    		$midmenuItem1.remove();                                   
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                snapshotClearRightPanel();
+            }                      
         }
     } 
     ,
diff --git a/ui/scripts/cloud.core.volume.js b/ui/scripts/cloud.core.volume.js
index ab1f7dcdb7d..23c1d2f0b24 100644
--- a/ui/scripts/cloud.core.volume.js
+++ b/ui/scripts/cloud.core.volume.js
@@ -601,13 +601,11 @@ var volumeActionMap = {
         dialogBeforeActionFn : doDeleteVolume,      
         inProcessText: "label.action.delete.volume.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {  
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    volumeClearRightPanel();
-                }
-            });          
+    	    $midmenuItem1.remove();
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                volumeClearRightPanel();
+            }                      
         }
     },
     "label.action.take.snapshot": {

From 9e1ee30ea3c4df034050b8656ff75fc0b283a516 Mon Sep 17 00:00:00 2001
From: Kelven Yang <kelven@cloud.com>
Date: Thu, 11 Aug 2011 14:28:32 -0700
Subject: [PATCH 66/77] bug 11019: Let VM sync to coordinate with possible
 VM-relocation under VMware when VM is in starting time

---
 server/src/com/cloud/vm/VirtualMachineManagerImpl.java | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server/src/com/cloud/vm/VirtualMachineManagerImpl.java b/server/src/com/cloud/vm/VirtualMachineManagerImpl.java
index 63ec27da1d3..11c02b2cc44 100755
--- a/server/src/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/server/src/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -1557,6 +1557,13 @@ public class VirtualMachineManagerImpl implements VirtualMachineManager, Listene
         }
 
         if(trackExternalChange) {
+        	if(serverState == State.Starting) {
+        		if(vm.getHostId() != null && vm.getHostId() != hostId) {
+        			s_logger.info("CloudStack is starting VM on host " + vm.getHostId() + ", but status report comes from a different host " + hostId + ", skip status sync for vm: " + vm.getInstanceName());
+        			return null;
+        		}
+        	}
+        	
             if(vm.getHostId() == null || hostId != vm.getHostId()) {
                 try {
                     stateTransitTo(vm, VirtualMachine.Event.AgentReportMigrated, hostId);

From 0fcd36441236769c5563c2635276f564ee1df985 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 14:29:03 -0700
Subject: [PATCH 67/77] bug 11070: cloudStack - delete
 diskOffering/serviceOffering - fix a bug that an API error showed after
 account was deleted ("listxxxxxxx&id=N")

---
 ui/scripts/cloud.core.diskoffering.js          | 12 +++++-------
 ui/scripts/cloud.core.serviceoffering.js       | 12 +++++-------
 ui/scripts/cloud.core.systemserviceoffering.js | 12 +++++-------
 3 files changed, 15 insertions(+), 21 deletions(-)

diff --git a/ui/scripts/cloud.core.diskoffering.js b/ui/scripts/cloud.core.diskoffering.js
index 73d1ff1eb16..b00b00e09de 100644
--- a/ui/scripts/cloud.core.diskoffering.js
+++ b/ui/scripts/cloud.core.diskoffering.js
@@ -376,13 +376,11 @@ var diskOfferingActionMap = {
         dialogBeforeActionFn : doDeleteDiskOffering,              
         inProcessText: "label.action.delete.disk.offering.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {   
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();   
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    diskOfferingClearRightPanel();
-                }                
-            });         
+    		$midmenuItem1.remove();   
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                diskOfferingClearRightPanel();
+            }      
         }
     }    
 }  
\ No newline at end of file
diff --git a/ui/scripts/cloud.core.serviceoffering.js b/ui/scripts/cloud.core.serviceoffering.js
index e843986c708..52767a68611 100644
--- a/ui/scripts/cloud.core.serviceoffering.js
+++ b/ui/scripts/cloud.core.serviceoffering.js
@@ -391,13 +391,11 @@ var serviceOfferingActionMap = {
         dialogBeforeActionFn : doDeleteServiceOffering,               
         inProcessText: "label.action.delete.service.offering.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    serviceOfferingClearRightPanel();
-                }                
-            });    
+    		$midmenuItem1.remove();    
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                serviceOfferingClearRightPanel();
+            }                  
         }
     }    
 }  
\ No newline at end of file
diff --git a/ui/scripts/cloud.core.systemserviceoffering.js b/ui/scripts/cloud.core.systemserviceoffering.js
index 2a7841f361a..c677971b72b 100644
--- a/ui/scripts/cloud.core.systemserviceoffering.js
+++ b/ui/scripts/cloud.core.systemserviceoffering.js
@@ -401,13 +401,11 @@ var systemServiceOfferingActionMap = {
         dialogBeforeActionFn : doDeleteSystemServiceOffering,               
         inProcessText: "label.action.delete.service.offering.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    systemServiceOfferingClearRightPanel();
-                }                
-            });    
+    	    $midmenuItem1.remove();                          
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                systemServiceOfferingClearRightPanel();
+            }         
         }
     }    
 }  
\ No newline at end of file

From b63b3fcf05df374ff7642e24b10a3f4ebaab374a Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Thu, 11 Aug 2011 13:21:52 -0700
Subject: [PATCH 68/77] Skip the null Host for CheckRouterTask

---
 .../network/router/VirtualNetworkApplianceManagerImpl.java      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index d8005a4cf3a..5671d64f326 100755
--- a/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -766,7 +766,7 @@ public class VirtualNetworkApplianceManagerImpl implements VirtualNetworkApplian
                     String privateIP = router.getPrivateIpAddress();
                     HostVO host = _hostDao.findById(router.getHostId());
                     /* Only cover hosts managed by this management server */
-                    if (host.getManagementServerId() != ManagementServerNode.getManagementServerId()) {
+                    if (host == null || host.getManagementServerId() != ManagementServerNode.getManagementServerId()) {
                         continue;
                     }
                     if (privateIP != null) {

From 95cc2d638162c6ecf13f4dc32a77fc0feff18597 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Thu, 11 Aug 2011 14:28:42 -0700
Subject: [PATCH 69/77] Use ifup/ifdown for redundant router

---
 .../debian/config/root/redundant_router/disable_pubip.sh    | 2 +-
 .../config/root/redundant_router/enable_pubip.sh.templ      | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh b/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh
index 9a9a2c6f72f..f59eea9ef23 100644
--- a/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh
+++ b/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 
-ifconfig eth2 down
+ifdown eth2
 service dnsmasq stop
diff --git a/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ b/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
index 93539422753..5d96b018327 100644
--- a/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
+++ b/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-ifconfig eth2 down && \
+ifdown eth2 && \
 ifconfig eth2 hw ether [ETH2MAC] && \
-ifconfig eth2 up && \
-ip route add 0/0 via [GATEWAY] && \
+ifup eth2 && \
+ip route add default via [GATEWAY] dev eth2 && \
 service dnsmasq restart

From f91d1735115eda7769a0165ee0d91a753540d2eb Mon Sep 17 00:00:00 2001
From: Chiradeep Vittal <chiradeep@cloud.com>
Date: Thu, 11 Aug 2011 14:36:34 -0700
Subject: [PATCH 70/77] bug 10561: handle icmp (finally\!)

---
 .../debian/config/root/firewall_rule.sh       | 36 ++++++++-----------
 1 file changed, 15 insertions(+), 21 deletions(-)

diff --git a/patches/systemvm/debian/config/root/firewall_rule.sh b/patches/systemvm/debian/config/root/firewall_rule.sh
index 63b4656c111..f0f8c0c1e2d 100755
--- a/patches/systemvm/debian/config/root/firewall_rule.sh
+++ b/patches/systemvm/debian/config/root/firewall_rule.sh
@@ -64,33 +64,27 @@ fw_entry_for_public_ip() {
   logger -t cloud "$(basename $0): enter apply firewall rules for public ip $pubIp:$prot:$sport:$eport:$scidrs"  
 
 
-  # note that rules are inserted after the RELATED,ESTABLISHED rule but before the DROP rule
+  # note that rules are inserted after the RELATED,ESTABLISHED rule 
+  # but before the DROP rule
   for src in $scidrs
   do
-    if [ "$prot" == "reverted" ]
-    then
-      continue;
-    fi
+    [ "$prot" == "reverted" ] && continue;
     if [ "$prot" == "icmp" ]
     then
-    # TODO  icmp code need to be implemented
-    # sport is icmpType , dport is icmpcode 
-      if [ "$sport" == "-1" ]
-      then
-           sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot  -j RETURN
-       else
-           if ["$eport" == "-1"]
-           then
-               sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport  -j RETURN
-           else
-               sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --icmp-type $sport/$eport  -j RETURN
-           fi
-       fi
+      typecode="$sport/$eport"
+      [ "$eport" == "-1" ] && typecode="$sport"
+      [ "$sport" == "-1" ] && typecode="any"
+      sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot \
+                    --icmp-type $typecode  -j RETURN
     else
-       sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot --dport $sport:$eport -j RETURN
-  fi
+       sudo iptables -t mangle -I FIREWALL_$pubIp 2 -s $src -p $prot \
+                    --dport $sport:$eport -j RETURN
+    fi
+    result=$?
+    [ $result -gt 0 ] && 
+       logger -t cloud "Error adding iptables entry for $pubIp:$prot:$sport:$eport:$src" &&
+       break
   done
-  result=$?
       
   logger -t cloud "$(basename $0): exit apply firewall rules for public ip $pubIp"  
   return $result

From 45a927b3d53bc6490089606a67a5c0fd8b7efecf Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 14:51:43 -0700
Subject: [PATCH 71/77] bug 11070: cloudStack - delete
 cluster/host/network/pod/primaryStorage/secondaryStorage/zone - fix a bug
 that an API error showed after account was deleted ("listxxxxxxx&id=N")

---
 ui/scripts/cloud.core.cluster.js          | 12 +++++-------
 ui/scripts/cloud.core.host.js             | 12 +++++-------
 ui/scripts/cloud.core.network.js          | 12 +++++-------
 ui/scripts/cloud.core.pod.js              | 14 +++++++-------
 ui/scripts/cloud.core.primarystorage.js   | 12 +++++-------
 ui/scripts/cloud.core.secondarystorage.js | 12 +++++-------
 ui/scripts/cloud.core.zone.js             | 12 +++++-------
 7 files changed, 37 insertions(+), 49 deletions(-)

diff --git a/ui/scripts/cloud.core.cluster.js b/ui/scripts/cloud.core.cluster.js
index de832fdf357..a11f36617f9 100644
--- a/ui/scripts/cloud.core.cluster.js
+++ b/ui/scripts/cloud.core.cluster.js
@@ -173,13 +173,11 @@ var clusterActionMap = {
         dialogBeforeActionFn : doDeleteCluster,   
         inProcessText: "label.action.delete.cluster.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {     
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    clusterClearRightPanel();
-                }                
-            });            
+            $midmenuItem1.remove();
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                clusterClearRightPanel();
+            }     
         }
     }
 }
diff --git a/ui/scripts/cloud.core.host.js b/ui/scripts/cloud.core.host.js
index 25ac7f9c8c3..14aa8ecc215 100644
--- a/ui/scripts/cloud.core.host.js
+++ b/ui/scripts/cloud.core.host.js
@@ -586,13 +586,11 @@ var hostActionMap = {
         dialogBeforeActionFn: doRemoveHost,
         inProcessText: "label.action.remove.host.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {    
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    hostClearRightPanel();
-                }               
-            });         
+            $midmenuItem1.remove();               
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                hostClearRightPanel();
+            }                         
         }
     },    
     "label.action.update.OS.preference": {              
diff --git a/ui/scripts/cloud.core.network.js b/ui/scripts/cloud.core.network.js
index cb607b2d41a..5ff507ba9fa 100644
--- a/ui/scripts/cloud.core.network.js
+++ b/ui/scripts/cloud.core.network.js
@@ -1519,13 +1519,11 @@ var directNetworkActionMap = {
         dialogBeforeActionFn : doDeleteDirectNetwork,        
         inProcessText: "label.action.delete.network.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {   
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#direct_network_page").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    directNetworkClearRightPanel();
-                }                
-            });              
+            $midmenuItem1.remove();                             
+            if(id.toString() == $("#right_panel_content").find("#direct_network_page").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                directNetworkClearRightPanel();
+            }           
         }
     }    
 }  
diff --git a/ui/scripts/cloud.core.pod.js b/ui/scripts/cloud.core.pod.js
index c5f977773b0..a24722bf075 100644
--- a/ui/scripts/cloud.core.pod.js
+++ b/ui/scripts/cloud.core.pod.js
@@ -350,6 +350,8 @@ function podClearDetailsTab() {
     
     $thisTab.find("#gateway").text(""); 
     $thisTab.find("#gateway_edit").val(""); 
+    
+    $thisTab.find("#allocationstate").text(""); 
 }
 	
 function getIpRange(startip, endip) {
@@ -1132,13 +1134,11 @@ var podActionMap = {
         dialogBeforeActionFn : doDeletePod,        
         inProcessText: "label.action.delete.pod.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {       
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    podClearRightPanel();
-                }                
-            });           
+            $midmenuItem1.remove();                             
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                podClearRightPanel();
+            }       
         }
     }
 }
diff --git a/ui/scripts/cloud.core.primarystorage.js b/ui/scripts/cloud.core.primarystorage.js
index df91c424f57..84523293ab1 100644
--- a/ui/scripts/cloud.core.primarystorage.js
+++ b/ui/scripts/cloud.core.primarystorage.js
@@ -278,13 +278,11 @@ var primarystorageActionMap = {
         dialogBeforeActionFn: doDeletePrimaryStorage,
         inProcessText: "label.action.delete.primary.storage.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {   
-            $midmenuItem1.slideUp("slow", function() {
-                $(this).remove();                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    primarystorageClearRightPanel();
-                }
-            });        
+            $midmenuItem1.remove();                             
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                primarystorageClearRightPanel();
+            }
         }
     }
 }
diff --git a/ui/scripts/cloud.core.secondarystorage.js b/ui/scripts/cloud.core.secondarystorage.js
index 117dc9a3b8c..29c9fdae366 100644
--- a/ui/scripts/cloud.core.secondarystorage.js
+++ b/ui/scripts/cloud.core.secondarystorage.js
@@ -168,13 +168,11 @@ var secondaryStorageActionMap = {
         dialogBeforeActionFn: doDeleteSecondaryStorage,       
         inProcessText: "label.action.delete.secondary.storage.processing",
         afterActionSeccessFn: function(json, $midmenuItem1, id) {  
-			$midmenuItem1.slideUp("slow", function() {
-		        $(this).remove();                
-		        if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-		            clearRightPanel();
-		            secondaryStorageClearRightPanel();
-		        }
-		    });   
+			$midmenuItem1.remove();		                   
+	        if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+	            clearRightPanel();
+	            secondaryStorageClearRightPanel();
+	        }		    
         }
     } 
 }
diff --git a/ui/scripts/cloud.core.zone.js b/ui/scripts/cloud.core.zone.js
index 97c517a08e9..9cc5a7c17cf 100644
--- a/ui/scripts/cloud.core.zone.js
+++ b/ui/scripts/cloud.core.zone.js
@@ -396,13 +396,11 @@ var zoneActionMap = {
         dialogBeforeActionFn : doDeleteZone,  
         inProcessText: "label.action.delete.zone.processing",
         afterActionSeccessFn: function(json, $leftmenuItem1, id) {   
-            $leftmenuItem1.slideUp(function() {
-                $(this).remove();                                
-                if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
-                    clearRightPanel();
-                    zoneJsonClearRightPanel();
-                }                
-            });            
+            $leftmenuItem1.remove();                                         
+            if(id.toString() == $("#right_panel_content").find("#tab_content_details").find("#id").text()) {
+                clearRightPanel();
+                zoneJsonClearRightPanel();
+            }          
         }
     }
 }

From a935e52b62c2d2a876e21f3c8e12a5e620bc9364 Mon Sep 17 00:00:00 2001
From: Sheng Yang <sheng.yang@cloud.com>
Date: Thu, 11 Aug 2011 14:59:51 -0700
Subject: [PATCH 72/77] Ifdown may not bring interface down if ifup not run

Use ifconfig to bring it down
---
 .../debian/config/root/redundant_router/disable_pubip.sh         | 1 +
 .../debian/config/root/redundant_router/enable_pubip.sh.templ    | 1 +
 2 files changed, 2 insertions(+)

diff --git a/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh b/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh
index f59eea9ef23..349ddef14ea 100644
--- a/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh
+++ b/patches/systemvm/debian/config/root/redundant_router/disable_pubip.sh
@@ -1,4 +1,5 @@
 #!/bin/bash
 
 ifdown eth2
+ifconfig eth2 down
 service dnsmasq stop
diff --git a/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ b/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
index 5d96b018327..ac8b0e0ea85 100644
--- a/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
+++ b/patches/systemvm/debian/config/root/redundant_router/enable_pubip.sh.templ
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 ifdown eth2 && \
+ifconfig eth2 down && \
 ifconfig eth2 hw ether [ETH2MAC] && \
 ifup eth2 && \
 ip route add default via [GATEWAY] dev eth2 && \

From edcc962a3b8c15e1a653dfde39cece97cd6fb663 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 15:23:24 -0700
Subject: [PATCH 73/77] bug 8053: cloudStack - volume page - hide Download
 Volume action for volume whose state is Allocated (newly created volume).

---
 ui/scripts/cloud.core.volume.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/scripts/cloud.core.volume.js b/ui/scripts/cloud.core.volume.js
index 23c1d2f0b24..7be56e135c5 100644
--- a/ui/scripts/cloud.core.volume.js
+++ b/ui/scripts/cloud.core.volume.js
@@ -449,7 +449,9 @@ function volumeJsonToDetailsTab(){
         
     buildActionLinkForTab("label.action.take.snapshot", volumeActionMap, $actionMenu, $midmenuItem1, $thisTab);	//show take snapshot
     buildActionLinkForTab("label.action.recurring.snapshot", volumeActionMap, $actionMenu, $midmenuItem1, $thisTab);	//show Recurring Snapshot
-    buildActionLinkForTab("label.action.download.volume", volumeActionMap, $actionMenu, $midmenuItem1, $thisTab);
+    
+    if(jsonObj.state != "Allocated")
+        buildActionLinkForTab("label.action.download.volume", volumeActionMap, $actionMenu, $midmenuItem1, $thisTab);
     
     if(jsonObj.state != "Creating" && jsonObj.state != "Corrupted" && jsonObj.name != "attaching") {
         if(jsonObj.type=="ROOT") {

From 4d86929eb531ba7a812a0b776e6a11f3f66402c1 Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 15:42:38 -0700
Subject: [PATCH 74/77] bug 10843: cloudStack - Instance page - statistics tab
 - show "N/A" when NetworkRead/NetworkWrite is equal to zero.

---
 ui/scripts/cloud.core.instance.js | 28 +++++++++-------------------
 1 file changed, 9 insertions(+), 19 deletions(-)

diff --git a/ui/scripts/cloud.core.instance.js b/ui/scripts/cloud.core.instance.js
index 367d8824219..2682924b604 100755
--- a/ui/scripts/cloud.core.instance.js
+++ b/ui/scripts/cloud.core.instance.js
@@ -2202,33 +2202,23 @@ function vmJsonToStatisticsTab() {
 	}
 
     var $thisTab = $("#right_panel_content #tab_content_statistics");  	
-	
-	
-	/*
-	var $barChartContainer = $thisTab.find("#cpu_barchart");
-		 
-	var cpuNumber = ((jsonObj.cpunumber==null)? "":jsonObj.cpunumber.toString());
-	$barChartContainer.find("#cpunumber").text(cpuNumber);
-	
-	var cpuSpeed = ((jsonObj.cpuspeed==null)? "":convertHz(jsonObj.cpuspeed)) ;
-	$barChartContainer.find("#cpuspeed").text(cpuSpeed);
-	
-	$barChartContainer.find("#bar_chart").removeClass().addClass("db_barbox").css("width", "0%");    
-	$barChartContainer.find("#percentused").text("");   
-	if(jsonObj.cpuused!=null)
-		drawBarChart($barChartContainer, jsonObj.cpuused);		
-	*/
-    
+	    
     $thisTab.find("#cpunumber").text(fromdb(jsonObj.cpunumber));
     $thisTab.find("#cpuspeed").text(convertHz(jsonObj.cpuspeed));
     
     $thisTab.find("#percentused").text(jsonObj.cpuused); 
     
 	var networkKbsRead = ((jsonObj.networkkbsread==null)? "":convertBytes(jsonObj.networkkbsread * 1024));
-	$thisTab.find("#networkkbsread").text(networkKbsRead);
+	if(networkKbsRead == 0)
+		$thisTab.find("#networkkbsread").text("N/A");
+	else
+	    $thisTab.find("#networkkbsread").text(networkKbsRead);
 	
 	var networkKbsWrite = ((jsonObj.networkkbswrite==null)? "":convertBytes(jsonObj.networkkbswrite * 1024));
-	$thisTab.find("#networkkbswrite").text(networkKbsWrite);	
+	if(networkKbsWrite == 0)
+		$thisTab.find("#networkkbswrite").text("N/A");
+	else	
+	    $thisTab.find("#networkkbswrite").text(networkKbsWrite);	
 }
 
 function vmJsonClearStatisticsTab() {       

From 5080e8ba33e3d48d9b8b285e49f3c913f82646c3 Mon Sep 17 00:00:00 2001
From: alena <alena@cloud.com>
Date: Thu, 11 Aug 2011 15:59:39 -0700
Subject: [PATCH 75/77] No need to apply static nat for ip which is not static
 nat enabled

---
 .../src/com/cloud/network/rules/RulesManagerImpl.java  | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/server/src/com/cloud/network/rules/RulesManagerImpl.java b/server/src/com/cloud/network/rules/RulesManagerImpl.java
index 767ae557200..f8ec8f32cf2 100755
--- a/server/src/com/cloud/network/rules/RulesManagerImpl.java
+++ b/server/src/com/cloud/network/rules/RulesManagerImpl.java
@@ -1061,6 +1061,11 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         List<StaticNat> staticNats = new ArrayList<StaticNat>();
         IpAddress sourceIp = _ipAddressDao.findById(sourceIpId);
         
+        if (!sourceIp.isOneToOneNat()) {
+            s_logger.debug("Source ip id=" + sourceIpId + " is not one to one nat");
+            return true;
+        }
+        
         Long networkId = sourceIp.getAssociatedWithNetworkId();
         if (networkId == null) {
             throw new CloudRuntimeException("Ip address is not associated with any network");
@@ -1071,11 +1076,6 @@ public class RulesManagerImpl implements RulesManager, RulesService, Manager {
         if (network == null) {
             throw new CloudRuntimeException("Unable to find ip address to map to in vm id=" + vm.getId());
         }
-
-        if (!sourceIp.isOneToOneNat()) {
-            s_logger.debug("Source ip id=" + sourceIpId + " is not one to one nat");
-            return true;
-        }
         
         if (caller != null) {
             _accountMgr.checkAccess(caller, sourceIp);

From 1205206ed284beb4b1f3d5bd06b8cb8c4cb66e0a Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 16:11:40 -0700
Subject: [PATCH 76/77] bug 10843: cloudStack - Instance page - statistics tab
 - show "N/A" when NetworkRead/NetworkWrite is equal to zero. (2)

---
 ui/scripts/cloud.core.instance.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/scripts/cloud.core.instance.js b/ui/scripts/cloud.core.instance.js
index 2682924b604..f65b24c9c6b 100755
--- a/ui/scripts/cloud.core.instance.js
+++ b/ui/scripts/cloud.core.instance.js
@@ -2209,13 +2209,13 @@ function vmJsonToStatisticsTab() {
     $thisTab.find("#percentused").text(jsonObj.cpuused); 
     
 	var networkKbsRead = ((jsonObj.networkkbsread==null)? "":convertBytes(jsonObj.networkkbsread * 1024));
-	if(networkKbsRead == 0)
+	if(jsonObj.networkkbsread == 0)
 		$thisTab.find("#networkkbsread").text("N/A");
 	else
 	    $thisTab.find("#networkkbsread").text(networkKbsRead);
 	
 	var networkKbsWrite = ((jsonObj.networkkbswrite==null)? "":convertBytes(jsonObj.networkkbswrite * 1024));
-	if(networkKbsWrite == 0)
+	if(jsonObj.networkkbswrite == 0)
 		$thisTab.find("#networkkbswrite").text("N/A");
 	else	
 	    $thisTab.find("#networkkbswrite").text(networkKbsWrite);	

From e3b35e8d95ef58e077f3ea3185fa74cd3dffdb9d Mon Sep 17 00:00:00 2001
From: Jessica Wang <jessica@cloud.com>
Date: Thu, 11 Aug 2011 16:26:47 -0700
Subject: [PATCH 77/77] bug 10843: cloudStack - Instance page - statistics tab
 - show "N/A" when NetworkRead/NetworkWrite is null or equal to zero.

---
 ui/scripts/cloud.core.instance.js | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/ui/scripts/cloud.core.instance.js b/ui/scripts/cloud.core.instance.js
index f65b24c9c6b..21f15552681 100755
--- a/ui/scripts/cloud.core.instance.js
+++ b/ui/scripts/cloud.core.instance.js
@@ -2207,18 +2207,16 @@ function vmJsonToStatisticsTab() {
     $thisTab.find("#cpuspeed").text(convertHz(jsonObj.cpuspeed));
     
     $thisTab.find("#percentused").text(jsonObj.cpuused); 
-    
-	var networkKbsRead = ((jsonObj.networkkbsread==null)? "":convertBytes(jsonObj.networkkbsread * 1024));
-	if(jsonObj.networkkbsread == 0)
+    	
+	if(jsonObj.networkkbsread == null || jsonObj.networkkbsread == 0)
 		$thisTab.find("#networkkbsread").text("N/A");
 	else
-	    $thisTab.find("#networkkbsread").text(networkKbsRead);
-	
-	var networkKbsWrite = ((jsonObj.networkkbswrite==null)? "":convertBytes(jsonObj.networkkbswrite * 1024));
-	if(jsonObj.networkkbswrite == 0)
+	    $thisTab.find("#networkkbsread").text(convertBytes(jsonObj.networkkbsread * 1024));
+		
+	if(jsonObj.networkkbswrite == null || jsonObj.networkkbswrite == 0)
 		$thisTab.find("#networkkbswrite").text("N/A");
 	else	
-	    $thisTab.find("#networkkbswrite").text(networkKbsWrite);	
+	    $thisTab.find("#networkkbswrite").text(convertBytes(jsonObj.networkkbswrite * 1024));	
 }
 
 function vmJsonClearStatisticsTab() {