Add support for router scheduling in Cisco N1kv Plugin

Added functionality for router and network scheduling
in Cisco N1kv Plugin.

Change-Id: I1a8d27670d10ca26fb62a8d02230a1aaf3e7bbca
Closes-Bug: #1286412
Correctly inherit __table_args__ from parent class

Where unique constraints are added to certain tables by populating
__table_args__, we need to ensure we inherit the top level
__table_args__ that define the default storage engine to use when
creating tables.

Change-Id: Ib886b84922830b60282b4f882591e43f5041e713
Fixes: bug 1288358
Fix _validate_mac_address method

The method _validate_mac_address previously used: netaddr.EUI(data)
which would convert data passed in to the correct mac_address representation.
For example if data=123 it would return: EUI('00-00-00-00-00-7B'). To fix
this issue I used netaddr.valid_mac() instead which returns a bool if a mac is
valid or not and does not raise. Note this file needs some improvements to
improve how exception handling is done that will come later.

Change-Id: I4fb868e40abbad9e743028cc768f47ca9b3e0e70
Closes-bug: 1291163
Advanced Services documentation

Adds the beginnings of documentation for the Firewall as a Service,
Loadbalancer as a Service, and VPN as a Service.

Part of blueprint developer-documentation

Change-Id: I5e46df2dc4f87f961490ee75791a7e825ea94e1e
De-duplicate unit tests for ports in Big Switch

This eliminates the separate classes that existed
for the VIF type testing. Each class was going
through all of the port tests when none of the
logic those tests were exercising was affected by
the VIF types.

This cut the number of tests run in test_restproxy_plugin
by close to 44% without a reduction in code coverage.

Closes-Bug: #1295448
Change-Id: I8c84e1599568fad36b6dd3d51e4ba8a3c012c6c5
Cisco VPN driver correct reporting for admin state chg

Depends on reference implementation change (81124 review) that will pass VPN
service admin up/down changes to the service driver (for subsequent passing
to the device driver).

This change will save the runtime state of the IPSec connections that have
been removed due to a VPN service down change, so that this can be reported
to the plugin properly. Otherwise, without the change, there is no info
on the downed connection and no change report so the plugin thinks the
connection is still active.

In addition, the status for the VPN service will reflect whether there are
any IPSec connections ACTIVE. If one or more are acive, the service will
be active, otherwise it will be DOWN.

Updated UT to add tests for admin state and status reporting. Also changed
some IPSec create UTs because they were not cleaning up correctly upon test
failures (only seen with a live CSR).

In the future, when the Cisco CSR REST API supports admin up/down support,
the IPSec connections will not be deleted, but instead will be shut down, in
response to an admin down event (and then brought up, for admin up). During
the down time, the state will be reported correctly and no run-time state
recording needed.

Change-Id: I294bfb400c31ef36dfe5d9e85b34845e5aef8515
Closes-Bug: 1291619
Fixed TypeError when creating MlnxException

MlnxException expect a 'err_msg' keyword argument.

Change-Id: I4570219c0a6a466391b43cbdaa5372b85566c421
Closes-Bug: #1283990
Signe-off-by: Roey Chen <roeyc@mellanox.com>
Changed the message line of RouterInUse class

Implements: Changed the message line of RouterInUse class,
so user will not get confused with active or inactive ports
while deleting the router.

Closes-Bug: #1236372
Change-Id: I7a82550e2c6051f9e4940a8f1dd4401059e0a8d8
Deals with fails in update_*_postcommit ops

It makes all mechanism drivers called even when one
of the mechanism drivers fails during a post commit
operation for updating network/subnet/port. This is
a stopgap measure until a more comprehensive approach
is adopted and implemented.

Change-Id: Ia9080a91ce768d4007b0525548acfe7443a2973c
Partial-Bug: 1227336
Fix quota_health_monitor opt name in neutron.conf

Reasons:
- quota_healt_monitor does not exist

Changes:
- Use quota_health_monitor instead of quota_health_monitors

Change-Id: I31d6a0394a786d26f7a063afbd3b6e07fae49b9b
Restore NOT NULL constraint lost by earlier migrations

Bring back nullable=False for columns in tables poolstatisticss
and ipsec_site_connections that disapeared because of
migrations abc88c33f74f and 338d7508968c correspondingly.

Closes-bug: #1288681

Change-Id: Idc4608616c2b4c06e7404157b2f708d46e91accc
Use os.uname() instead of calling uname in subprocess

Related-Bug: #1291535

Change-Id: I57e18c0b95904f318e3fff08cd18b32e28f48834
use floatingip's ID as key instead of itself

Change-Id: I267f174a0e2e611ec007404c7b44e2c73a359c38
Closes-Bug: 1294526
OFA agent: use hexadecimal IP address in tunnel port name

The remote IP address is used to form the tunnel port name
With some OVS/Linux combinations there is a 15 character limit
on port names, so a name like 'gre-192.168.10.10' does not work.
This fix uses the shorter hexadecimal representation of
the IP address instead.
This problem was reported and fixed for OVS agent.

Closes-Bug: 1294474

Change-Id: Ieab1eb8a5c430f69aff61a317cc28f23ba95ad2d
Permit ICMPv6 RAs only from known routers

Currently ingress ICMPv6 RAs are permitted from any IPs by
default to allow VMs to accept ICMPv6 RA from provider network.
In this way, VM can accept RAs from attacker VM and configure
a network prefix specified by the attacher VM.

Remove permitting ICMPv6 RAs from any IPs and add security rule
to only permit ICMPv6 RA from:

1. If the port's subnet is configured with ipv6_ra_mode value
(i.e.value is slaac, dhcpv6-stateful, or dhcpv6-stateless), RA
is sending from dnsmasq controlled by OpenStack. In this case,
allow RA from the link local address of gateway port (if the
gateway port is created).

2. If the subnet's gateway port is not managed by OpenStack, allow
the ICMPv6 RA sent from the subnet gateway IP if it's a link local
address. The administrator needs to configure the gateway IP as
link local address in this case to make the RA rule work.

Change-Id: I1d5c7aaa8e4cf057204eb746c0faab2c70409a94
Closes-Bug: 1262759
Remove duplicated tests for check_ovs_vxlan_version

test_ovs_lib, test_ovs_neutron_agent and test_ofa_neutron_agent
have duplicated same unit tests for check_ovs_vxlan_version.
This commits removes tests from ovs/ofa_neutron_agent.

Change-Id: Ia028a4afc1c8154f895187c979d23b626ab4ae3a
Closes-Bug: #1301337
fixes broken neutron-netns-cleanup

Some configuration parameters used in neutron.agent.linux.utils
were missing. The namespace attribute in the FakeNetwork object
was missing, and used in neutron.agent.linux.dhcp. Also, the
plugin object was missing for release_dhcp_port operation.

We provide a fake plugin object to accept current and any future
plugin calls as this is meant to be an standalone tool that
should work without any RPC connectivity.

FakeNetwork was switched for neutron.agent.linux.dhcp.NetModel
to follow any future changes in NetModel.

Two wrong called_once_with_args calls without assert were fixed.

Change-Id: Ia51ea9bd4c8eea6b250858964ad5286c933702e0
Closes-Bug: #1291915
Partial-Bug: #1297875
Remove invalid copyright headers under API module

Change-Id: I629b639f6c94654117fbafb8b21840f7ba6b045a
Partial-bug: #1262424
fixes tests using called_once_ without assert

A few tests were using mock's called_once, or called_once_with_args
instead of assert_called_once or assert_called_once_with_args. Those
methods return a bool that needs to be actively checked.

The tests are fixed to avoid them from passing if the call condition
is not met.

Change-Id: I21e5257b26b2a08cc8f0b108233d1d5cc0b97b89
Closes-bug: #1297875
Delete routers that are requested but not reported as active

There are two cases that I can think of that result in a router being
requested but not reported as active.  One is that admin_state_up has
been set to False.  In this case, the router is never removed and
continues to be operational.

The other case is if a router is changed and then deleted before the
change is processed.  In this case, it is prudent to be sure that the
router is queued for deletion.

Change-Id: I4738f599a18f0d130cc8ad4d4dafc488eec75ffd
Closes-Bug: #1215387