Add support for router scheduling in Cisco N1kv Plugin

Added functionality for router and network scheduling
in Cisco N1kv Plugin.

Change-Id: I1a8d27670d10ca26fb62a8d02230a1aaf3e7bbca
Closes-Bug: #1286412
Correctly inherit __table_args__ from parent class

Where unique constraints are added to certain tables by populating
__table_args__, we need to ensure we inherit the top level
__table_args__ that define the default storage engine to use when
creating tables.

Change-Id: Ib886b84922830b60282b4f882591e43f5041e713
Fixes: bug 1288358
Fix _validate_mac_address method

The method _validate_mac_address previously used: netaddr.EUI(data)
which would convert data passed in to the correct mac_address representation.
For example if data=123 it would return: EUI('00-00-00-00-00-7B'). To fix
this issue I used netaddr.valid_mac() instead which returns a bool if a mac is
valid or not and does not raise. Note this file needs some improvements to
improve how exception handling is done that will come later.

Change-Id: I4fb868e40abbad9e743028cc768f47ca9b3e0e70
Closes-bug: 1291163
Advanced Services documentation

Adds the beginnings of documentation for the Firewall as a Service,
Loadbalancer as a Service, and VPN as a Service.

Part of blueprint developer-documentation

Change-Id: I5e46df2dc4f87f961490ee75791a7e825ea94e1e
Cisco VPN driver correct reporting for admin state chg

Depends on reference implementation change (81124 review) that will pass VPN
service admin up/down changes to the service driver (for subsequent passing
to the device driver).

This change will save the runtime state of the IPSec connections that have
been removed due to a VPN service down change, so that this can be reported
to the plugin properly. Otherwise, without the change, there is no info
on the downed connection and no change report so the plugin thinks the
connection is still active.

In addition, the status for the VPN service will reflect whether there are
any IPSec connections ACTIVE. If one or more are acive, the service will
be active, otherwise it will be DOWN.

Updated UT to add tests for admin state and status reporting. Also changed
some IPSec create UTs because they were not cleaning up correctly upon test
failures (only seen with a live CSR).

In the future, when the Cisco CSR REST API supports admin up/down support,
the IPSec connections will not be deleted, but instead will be shut down, in
response to an admin down event (and then brought up, for admin up). During
the down time, the state will be reported correctly and no run-time state
recording needed.

Change-Id: I294bfb400c31ef36dfe5d9e85b34845e5aef8515
Closes-Bug: 1291619
Fixed TypeError when creating MlnxException

MlnxException expect a 'err_msg' keyword argument.

Change-Id: I4570219c0a6a466391b43cbdaa5372b85566c421
Closes-Bug: #1283990
Signe-off-by: Roey Chen <roeyc@mellanox.com>
Deals with fails in update_*_postcommit ops

It makes all mechanism drivers called even when one
of the mechanism drivers fails during a post commit
operation for updating network/subnet/port. This is
a stopgap measure until a more comprehensive approach
is adopted and implemented.

Change-Id: Ia9080a91ce768d4007b0525548acfe7443a2973c
Partial-Bug: 1227336
OFA agent: use hexadecimal IP address in tunnel port name

The remote IP address is used to form the tunnel port name
With some OVS/Linux combinations there is a 15 character limit
on port names, so a name like 'gre-192.168.10.10' does not work.
This fix uses the shorter hexadecimal representation of
the IP address instead.
This problem was reported and fixed for OVS agent.

Closes-Bug: 1294474

Change-Id: Ieab1eb8a5c430f69aff61a317cc28f23ba95ad2d
Permit ICMPv6 RAs only from known routers

Currently ingress ICMPv6 RAs are permitted from any IPs by
default to allow VMs to accept ICMPv6 RA from provider network.
In this way, VM can accept RAs from attacker VM and configure
a network prefix specified by the attacher VM.

Remove permitting ICMPv6 RAs from any IPs and add security rule
to only permit ICMPv6 RA from:

1. If the port's subnet is configured with ipv6_ra_mode value
(i.e.value is slaac, dhcpv6-stateful, or dhcpv6-stateless), RA
is sending from dnsmasq controlled by OpenStack. In this case,
allow RA from the link local address of gateway port (if the
gateway port is created).

2. If the subnet's gateway port is not managed by OpenStack, allow
the ICMPv6 RA sent from the subnet gateway IP if it's a link local
address. The administrator needs to configure the gateway IP as
link local address in this case to make the RA rule work.

Change-Id: I1d5c7aaa8e4cf057204eb746c0faab2c70409a94
Closes-Bug: 1262759
Remove duplicated tests for check_ovs_vxlan_version

test_ovs_lib, test_ovs_neutron_agent and test_ofa_neutron_agent
have duplicated same unit tests for check_ovs_vxlan_version.
This commits removes tests from ovs/ofa_neutron_agent.

Change-Id: Ia028a4afc1c8154f895187c979d23b626ab4ae3a
Closes-Bug: #1301337
fixes broken neutron-netns-cleanup

Some configuration parameters used in neutron.agent.linux.utils
were missing. The namespace attribute in the FakeNetwork object
was missing, and used in neutron.agent.linux.dhcp. Also, the
plugin object was missing for release_dhcp_port operation.

We provide a fake plugin object to accept current and any future
plugin calls as this is meant to be an standalone tool that
should work without any RPC connectivity.

FakeNetwork was switched for neutron.agent.linux.dhcp.NetModel
to follow any future changes in NetModel.

Two wrong called_once_with_args calls without assert were fixed.

Change-Id: Ia51ea9bd4c8eea6b250858964ad5286c933702e0
Closes-Bug: #1291915
Partial-Bug: #1297875
Delete routers that are requested but not reported as active

There are two cases that I can think of that result in a router being
requested but not reported as active.  One is that admin_state_up has
been set to False.  In this case, the router is never removed and
continues to be operational.

The other case is if a router is changed and then deleted before the
change is processed.  In this case, it is prudent to be sure that the
router is queued for deletion.

Change-Id: I4738f599a18f0d130cc8ad4d4dafc488eec75ffd
Closes-Bug: #1215387
Replace HTTPSConnection in NEC plugin

Replace HTTPSConnection in NEC plugin PFC driver with Requests.

SSL Verification is from now on enabled by default.

This changes the default behaviour and is the primary intention of this
change: verify SSL certificates.

This might break existing configuration/setups where the SSL certificate
used by the NEC PFC driver would not pass the verification.

SecurityImpact
DocImpact
Partial-Bug: 1188189

Change-Id: I1e5fdc9c2ed5b812aa6509d1639bd499acc5c337
Set ns_name in RouterInfo as attribute

Closes-Bug: #1302007
Change-Id: I02a9b92eea06010569d3d9c5a987e69f89b23be5
Redundant SG rule create calls in unit tests

This patch removes the redundant calls in the test cases.

Closes-Bug: #1302091
Change-Id: I509843b427dc454c0e6b2fd2cbff1bbbb284337f
Fix Jenkins translation jobs

The job neutron-propose-translation-update
does not update from
transifex since our po files contain duplicate entries where
obsolete entries duplicate normal entries.

Remove all obsolete entries to fix the job.

Add test to pep8 that checks that no new breakages get
introduced.

Change-Id: I9c680eeefecfa124c5b2900b7fa7a0a8f7e8ebd6
Closes-Bug: #1299349
Add a note that rpc_workers option is experimental

blueprint multiple-rpc-workers

Change-Id: Id354b96fc591752e1e79b072997423b6447d5de9
Merge "Replace HTTPSConnection in NEC plugin"
Merge "Fix Jenkins translation jobs"
Merge "Add a note that rpc_workers option is experimental"