Advanced Services documentation

Adds the beginnings of documentation for the Firewall as a Service,
Loadbalancer as a Service, and VPN as a Service.

Part of blueprint developer-documentation

Change-Id: I5e46df2dc4f87f961490ee75791a7e825ea94e1e
De-duplicate unit tests for ports in Big Switch

This eliminates the separate classes that existed
for the VIF type testing. Each class was going
through all of the port tests when none of the
logic those tests were exercising was affected by
the VIF types.

This cut the number of tests run in test_restproxy_plugin
by close to 44% without a reduction in code coverage.

Closes-Bug: #1295448
Change-Id: I8c84e1599568fad36b6dd3d51e4ba8a3c012c6c5
Cisco VPN driver correct reporting for admin state chg

Depends on reference implementation change (81124 review) that will pass VPN
service admin up/down changes to the service driver (for subsequent passing
to the device driver).

This change will save the runtime state of the IPSec connections that have
been removed due to a VPN service down change, so that this can be reported
to the plugin properly. Otherwise, without the change, there is no info
on the downed connection and no change report so the plugin thinks the
connection is still active.

In addition, the status for the VPN service will reflect whether there are
any IPSec connections ACTIVE. If one or more are acive, the service will
be active, otherwise it will be DOWN.

Updated UT to add tests for admin state and status reporting. Also changed
some IPSec create UTs because they were not cleaning up correctly upon test
failures (only seen with a live CSR).

In the future, when the Cisco CSR REST API supports admin up/down support,
the IPSec connections will not be deleted, but instead will be shut down, in
response to an admin down event (and then brought up, for admin up). During
the down time, the state will be reported correctly and no run-time state
recording needed.

Change-Id: I294bfb400c31ef36dfe5d9e85b34845e5aef8515
Closes-Bug: 1291619
Fixed TypeError when creating MlnxException

MlnxException expect a 'err_msg' keyword argument.

Change-Id: I4570219c0a6a466391b43cbdaa5372b85566c421
Closes-Bug: #1283990
Signe-off-by: Roey Chen <roeyc@mellanox.com>
Changed the message line of RouterInUse class

Implements: Changed the message line of RouterInUse class,
so user will not get confused with active or inactive ports
while deleting the router.

Closes-Bug: #1236372
Change-Id: I7a82550e2c6051f9e4940a8f1dd4401059e0a8d8
Fix quota_health_monitor opt name in neutron.conf

Reasons:
- quota_healt_monitor does not exist

Changes:
- Use quota_health_monitor instead of quota_health_monitors

Change-Id: I31d6a0394a786d26f7a063afbd3b6e07fae49b9b
Restore NOT NULL constraint lost by earlier migrations

Bring back nullable=False for columns in tables poolstatisticss
and ipsec_site_connections that disapeared because of
migrations abc88c33f74f and 338d7508968c correspondingly.

Closes-bug: #1288681

Change-Id: Idc4608616c2b4c06e7404157b2f708d46e91accc
Use os.uname() instead of calling uname in subprocess

Related-Bug: #1291535

Change-Id: I57e18c0b95904f318e3fff08cd18b32e28f48834
use floatingip's ID as key instead of itself

Change-Id: I267f174a0e2e611ec007404c7b44e2c73a359c38
Closes-Bug: 1294526
Permit ICMPv6 RAs only from known routers

Currently ingress ICMPv6 RAs are permitted from any IPs by
default to allow VMs to accept ICMPv6 RA from provider network.
In this way, VM can accept RAs from attacker VM and configure
a network prefix specified by the attacher VM.

Remove permitting ICMPv6 RAs from any IPs and add security rule
to only permit ICMPv6 RA from:

1. If the port's subnet is configured with ipv6_ra_mode value
(i.e.value is slaac, dhcpv6-stateful, or dhcpv6-stateless), RA
is sending from dnsmasq controlled by OpenStack. In this case,
allow RA from the link local address of gateway port (if the
gateway port is created).

2. If the subnet's gateway port is not managed by OpenStack, allow
the ICMPv6 RA sent from the subnet gateway IP if it's a link local
address. The administrator needs to configure the gateway IP as
link local address in this case to make the RA rule work.

Change-Id: I1d5c7aaa8e4cf057204eb746c0faab2c70409a94
Closes-Bug: 1262759
fixes broken neutron-netns-cleanup

Some configuration parameters used in neutron.agent.linux.utils
were missing. The namespace attribute in the FakeNetwork object
was missing, and used in neutron.agent.linux.dhcp. Also, the
plugin object was missing for release_dhcp_port operation.

We provide a fake plugin object to accept current and any future
plugin calls as this is meant to be an standalone tool that
should work without any RPC connectivity.

FakeNetwork was switched for neutron.agent.linux.dhcp.NetModel
to follow any future changes in NetModel.

Two wrong called_once_with_args calls without assert were fixed.

Change-Id: Ia51ea9bd4c8eea6b250858964ad5286c933702e0
Closes-Bug: #1291915
Partial-Bug: #1297875
Remove invalid copyright headers under API module

Change-Id: I629b639f6c94654117fbafb8b21840f7ba6b045a
Partial-bug: #1262424
fixes tests using called_once_ without assert

A few tests were using mock's called_once, or called_once_with_args
instead of assert_called_once or assert_called_once_with_args. Those
methods return a bool that needs to be actively checked.

The tests are fixed to avoid them from passing if the call condition
is not met.

Change-Id: I21e5257b26b2a08cc8f0b108233d1d5cc0b97b89
Closes-bug: #1297875
Delete routers that are requested but not reported as active

There are two cases that I can think of that result in a router being
requested but not reported as active.  One is that admin_state_up has
been set to False.  In this case, the router is never removed and
continues to be operational.

The other case is if a router is changed and then deleted before the
change is processed.  In this case, it is prudent to be sure that the
router is queued for deletion.

Change-Id: I4738f599a18f0d130cc8ad4d4dafc488eec75ffd
Closes-Bug: #1215387
Imported Translations from Transifex

Change-Id: Ifcadfb837fc2864214c6d070d90388110742b537
Merge "Use os.uname() instead of calling uname in subprocess"
Merge "Changed the message line of RouterInUse class"
Merge "Remove invalid copyright headers under API module"
Merge "Restore NOT NULL constraint lost by earlier migrations"
ignore build directory for pep8

this mirrors the excludes from nova.

Change-Id: I0ca5f02918842fc708c704fcf2845936dc1c5965