Ensure assertion matches dict iter order in test

Fixes a test_linux_ip_lib test that made an assertion
on a command that was called that could fail depending
on the order of the dictionary when it was iterated over.

This patch makes the assertion match the order that the
command is constructed by iterating through the dictionary
as well.

Partial-Bug: #1348818
Change-Id: I7baa518169c193f7e98d38632e1db16eb57ffee7
Raise NotImplementedError instead of NotImplemented

NotImplementedError is the name of the exception
(https://docs.python.org/2/library/exceptions.html).

NotImplemented is the name of a constant
(https://docs.python.org/2/library/constants.html).

It makes no sense to raise a constant. The exception should
be raised instead.

Change-Id: I4969e26eb7b46f008ea3c8bd0093490c425f7069
Closes-Bug: #1339855
Fix config option names in ml2_conf_sriov.ini

Config option names in ml2_conf_sriov.ini file are
not in sync with definitions in source code.

Change-Id: Ic8f7b6b8e9acd022623daabd2b209b864caa0b06
Closes-Bug: #1357339
Change nexus_dict to accept port lists

When users configured a server to have two logical connections to a
single switch, the nexus driver would never know about the second
connection because the nexus_dict stored the interface as a single
value, which would just get overwritten.  This has been fixed by
allowing the port value to be a comma seperated list.  All
operations on ports have been update to loop over multiple ports
per switch. New test added for host with dual connections to one
switch.

Change-Id: Iefb30452083747b45496600c81f8d0a6f378bd08
Closes-Bug: 1288393
Add config for visibility of cisco-policy-profile

This change adds a configuration option to cisco_plugin.ini to control the
visibility of cisco-policy-profile among tenants. The default is false or
unrestricted, so all tenants can view all policy profiles. If the option
is set to true, tenants can only view policy profiles that are assigned
to that tenant. The admin user can always view all policy profiles. This
was implemented by adding a check of the configuration option in
get_policy_profiles().

Change-Id: I5d77544d75366d39714def971eb949cfdc40023e
Implements: blueprint cisco-policy-profile-visibility
One Convergence: Skip all tests with 'v6' in name

Adds a check to the test setup for the One Convergence tests
to look for v6 in the name of the test and skip it if present.
This prevents IPv6 developers from having to explicitly skip
each new IPv6 test in the One Convergence unit tests until the
plugin gains IPv6 support.

Closes-bug: #1361366
Change-Id: I5c17d7290302597d5c85ef2c1df95f4f71e1a69b
Fixes Hyper-V agent issue on Hyper-V 2008 R2

The vmutils.HyperVUtils class used on versions of Hyper-V prior of 2012
is missing the "remove_all_security_rules" method.

Change-Id: Ib14e643c400b230c912589f9480acf59d6e7b147
Closes-Bug: #1360817
Set firewall state to CREATED when dealing with DVR

When DVR is enabled as a default option for creating routers, firewall
resources will need to have a new initial state, so that reconciliation
can be done once all L3 agents have processed the firewall rules.

The new state has been introduced to preserve API bw compatibility
with centralized routers.

Partial-bug: #1360351
Supports-blueprint: neutron-dvr-fwaas

Change-Id: I53122570dd3a2311eedb24ccd925bcdc9ad4f70c
Remove status initialization from plugin's create_firewall

This is overwritten by the DB class method, so here is
not necessary.

Change-Id: I7bda448dab81992c8fb6ef8d771138ff070360ba
Increase ovsdb_monitor.SimpleInterfaceMonitor start timeout

The current timeout fails during functional testing with
slightly higher load. Increasing it will lower the timeout
chances during high load conditions. Changed from 5 seconds
to respawn_interval/2. DEFAULT_OVSDBMON_RESPAWN = 30 , so
the default timeout will be 15 seconds.

Change-Id: I6a9e2977b275e96dcf01c4df90a33169c42287d6
Closes-Bug: #1358206
Fix IpNetnsCommand to execute without root_wrapper when no netns

IpNetnsCommand accept execution with a network namespace, and
that requires root privileges and a root_wrapper.
IpNetnsCommand does accept no namespace too, in that case, the
root_wrapper doesn't have to be present necessarily, unless the
command we're executing requires root privileges itself.

This patch fixes the check condition on IpNetnsCommand execute
method.

Change-Id: I5ab2f3f1daf4a5a080611dbcd3dbd43292f6766a
Closes-Bug: #1358196
metering driver default value is different in code and config file

We defined the metering driver is IptablesMeteringDriver in config,
but in code, the driver is NoopMeteringDriver.

Change-Id: Ia4fb6751e8a9919f844ef27a303e2fa95b46670e
Closes-Bug: #1360958
Networks are not scheduled to DHCP agents for Cisco N1KV plugin

With the config option 'network_auto_schedule = False' in
neutron.conf, networks do not get scheduled to available DHCP
agents. The fix is to explicitly schedule the network as part
of the subnet creation flow.

Change-Id: Id1f94a5844111a916f984d6dd7bda2cb4e11e1ee
Closes-Bug: #1356609
Make log level in linux.utils.execute configurable

Function linux.utils.execute always logs failures on error level.
Some callers use this function to check resource existance and
interpret failure as normal flow. Log level is made configurable
for such cases.

Change-Id: I8e4cd7b42234426f8fe58d353a64e898f02f8998
Closes-bug: 1339045
Fix heal_script for MySQL specifics

After running upgrade head->downgrade havana->upgrade head
on MySQL heal_script fails with several mistakes.

This change fix them. More details in related bug description.

Closes-bug: #1354218

Change-Id: I91cb21c4bc744f240bfb8bc6b2ed24b6e01f6095
Refactor test_type_gre/vxlan to reduce duplicate code

gre and vxlan type drivers have similar implementation for multiple
methods and associated tests. This change abstracts these tests.

Change-Id: Ic0e2119a81540c509c214008cce9dc50f55dd6de
Fixed template of IPsecSiteConnectionNotFound message

Closes bug 1361044

Change-Id: I667f066e6187e953d467428e9990fa76adfc365b
Heal script: Drop fks before operating on columns

This patch fixes a small glitch in the healing script.
If the script detects that a foreign key must be removed,
and the columns that it references must be removed as well,
then the foreign key removal would fail as the column would
not exist anymore.

This patch simply ensures foreign key are dropped before all
the remaining table/column operations. New foreign keys are
instead added after all table/column operations are completed.

Change-Id: I3cce742146c70b71900cf53e50f9a6a61bc6a378
Closes-Bug: # 1354188
Inline "for val in [ref]" statements

This change increases readibility by inlining "for val in [ref]":

 for val in [ref]:
   f(val)

becomes:

 f(ref)

Change-Id: I8e1f95bd7eb99a25c6460beb2ac3230c53740181
Cisco VPN with in-band CSR (interim solution)

Currently, the Cisco VPN drivers use two routers for the proof of concept
solution. A Neutron router provides access to the public and private
subnets, and a Cisco CSR (out-of-band) provides the VPN tunneling.

The end goal is to integrate the Cisco VPN drivers with the Cisco L3
routing plugin being developed (as a separate blueprint), allowing an
in-band CSR to be used as a Neutron router for VPN functionality.

This commit provides an incremental approach to that goal, by modifying
the Cisco VPN drivers to be able to dynamically obtain CSR info from
an INI file, instead of statically reading the INI file at start-up.

A CSR VM can be created out-of-band (or in-band using Nova) and the INI
file can be updated with the router info. Then, the Cisco VPN driver
can use that information (dynamically) to create IPSec connections.

Once the Cisco L3 router plugin is available, the INI file will be
removed, and two calls to the plugin will be used to obtain the needed
router information, for an integrated solution.

The main advantages are:
    - Dynamically use the CSR for VPN.
    - Less manual intervention and setup.
    - Easy migration to final solution.
    - No dependency on the Cisco L3 router plugin implementation.

Note 1: The INI unit tests are moved from device driver to service
        driver and modified.

Note 2: I added a unit test for deleting IPSec site-to-site connection,
        which was missing (pass).

Note 3: For more details on the change, you can view this Google Doc:
        http://goo.gl/DXir8c

Change-Id: I307fc79952e3e12a0f77679ac1fc2b314fa63684
Partially-Implements: blueprint cisco-vpnaas-with-cisco-csr-router