Basic support for openvswitch

Actually steal code from kvm-ifup script shipped
with official Ganeti.

Please note that nfdhcpd will not be functional because
get_physindev() will not return the proper value
(instead of the ifindex of the tap device, it will return the
one of the ovs bridge).

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add helper bridge in case of openvswitch

Since ebtables/iptables do not work on openvswitch bridges
we add a helper bridge between tap interface and ovs bridge
and connect them both with and two veth peers.

This will make MAC filtering used for private networks work
as long as nfdhcpd will be able to parse the packet mangled
and coming from the linux bridge correctly.

Lets assume the tap interface is tap1 and the ovs bridge is ovs-br.
With this patch we end up with:

tap1 -> tap1-br -> tap1-to-ovs-br -> ovs-br-to-tap3 -> ovs-br
           |                  \        /                  |
     (linux bridge)          (veth peers)           (openvswitch)

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add kerberos authentication support for nsupdate

Up until now snf-network used nsupdate with a keyfile to
dynamically update DNS entries on an external nameserver
(bind9). This patch adds support for authenticating against an
AD controller using Kerberos.

Specifically we use "k5start -H" to ensure there is a happy ticket,
otherwise use a keytab containing the password to obtain a ticket
automatically. Finally, we use nsupdate in GSS-TSIG mode (-g option) to
update AD-integrated DNS server.

The keytab file can be added with:

 # ktutil -v add -V 1 -e aes256-cts -p PRINCIPAL

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
Add doc section wrt kerberos authentication

..that explains how to configure snf-network in order to use
it for dynamic DNS update against an AD controller.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>