From df53a6f5641cb34ad3bce660a6fb08c58b0547ff Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 19 Jul 2013 10:23:59 -0700
Subject: [PATCH] Use cached nwinfo for secgroup rules

This stops a potential DOS with source security groups by using the
db cached version of the network info instead of calling out to
the network api multiple times.

Fixes bug 1184041

Change-Id: Id5f24ecf0e8cce60c27a9aecbc6e606c4c44d6b6
---
 nova/db/sqlalchemy/api.py |    2 ++
 nova/virt/firewall.py     |   16 +++-------------
 2 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index b48bbaf..ca3743a0 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -3501,6 +3501,8 @@ def security_group_rule_get_by_security_group(context, security_group_id):
             filter_by(parent_group_id=security_group_id).
             options(joinedload_all('grantee_group.instances.'
                                    'system_metadata')).
+            options(joinedload('grantee_group.instances.'
+                               'info_cache')).
             all())
 
 
diff --git a/nova/virt/firewall.py b/nova/virt/firewall.py
index bd2ec4a..7cd70dc 100644
--- a/nova/virt/firewall.py
+++ b/nova/virt/firewall.py
@@ -19,9 +19,8 @@
 
 from oslo.config import cfg
 
-from nova import conductor
+from nova.compute import utils as compute_utils
 from nova import context
-from nova import network
 from nova.network import linux_net
 from nova.openstack.common import importutils
 from nova.openstack.common import log as logging
@@ -415,18 +414,9 @@ class IptablesFirewallDriver(FirewallDriver):
                     fw_rules += [' '.join(args)]
                 else:
                     if rule['grantee_group']:
-                        # FIXME(jkoelker) This needs to be ported up into
-                        #                 the compute manager which already
-                        #                 has access to a nw_api handle,
-                        #                 and should be the only one making
-                        #                 making rpc calls.
-                        nw_api = network.API()
-                        capi = conductor.API()
                         for instance in rule['grantee_group']['instances']:
-                            nw_info = nw_api.get_instance_nw_info(
-                                ctxt,
-                                instance,
-                                conductor_api=capi)
+                            nw_info = compute_utils.get_nw_info_for_instance(
+                                    instance)
 
                             ips = [ip['address']
                                 for ip in nw_info.fixed_ips()
-- 
1.7.9.5