Add port-security extension API test cases

Netron ml2 plugin introduces a new extension port-security from Kilo cycle,
this patch add the API test cases for it. It verifies the default value of the
attribute, for network and port. And It also verifies the confict between
setting port-security and sec-group/address-pairs.

Change-Id: Ie0ec090e8fdce7dbdbce14ef47f38e8e57f262d4
Partially Implements: blueprint ml2-ovs-portsecurity
Depends-On: I3035317c83d22804855517434bd8578719ce0436

diff --git a/neutron/tests/api/test_extension_driver_port_security.py b/neutron/tests/api/test_extension_driver_port_security.py
new file mode 100644 (file)
index 0000000..10ccb22
--- /dev/null
+++ b/neutron/tests/api/test_extension_driver_port_security.py
@@ -0,0 +1,98 @@
+# Copyright 2015 OpenStack Foundation
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest_lib.common.utils import data_utils
+from tempest_lib import exceptions as lib_exc
+
+from neutron.tests.api import base_security_groups as base
+from neutron.tests.tempest import config
+from neutron.tests.tempest import test
+
+
+CONF = config.CONF
+FAKE_IP = '10.0.0.1'
+FAKE_MAC = '00:25:64:e8:19:dd'
+
+
+class PortSecTest(base.BaseSecGroupTest):
+
+    @classmethod
+    def resource_setup(cls):
+        super(PortSecTest, cls).resource_setup()
+
+    def _create_network(self, network_name=None, port_security_enabled=True):
+        """Wrapper utility that returns a test network."""
+        network_name = network_name or data_utils.rand_name('test-network')
+
+        body = self.client.create_network(
+            name=network_name, port_security_enabled=port_security_enabled)
+        network = body['network']
+        self.networks.append(network)
+        return network
+
+    @test.attr(type='smoke')
+    @test.idempotent_id('7c338ddf-e64e-4118-bd33-e49a1f2f1495')
+    @test.requires_ext(extension='port-security', service='network')
+    def test_port_sec_default_value(self):
+        # Default port-sec value is True, and the attr of the port will inherit
+        # from the port-sec of the network when it not be specified in API
+        network = self.create_network()
+        self.create_subnet(network)
+        self.assertTrue(network['port_security_enabled'])
+        port = self.create_port(network)
+        self.assertTrue(port['port_security_enabled'])
+
+    @test.attr(type='smoke')
+    @test.idempotent_id('e60eafd2-31de-4c38-8106-55447d033b57')
+    @test.requires_ext(extension='port-security', service='network')
+    def test_port_sec_specific_value(self):
+        network = self.create_network()
+
+        self.assertTrue(network['port_security_enabled'])
+        self.create_subnet(network)
+        port = self.create_port(network, port_security_enabled=False)
+        self.assertFalse(port['port_security_enabled'])
+
+        # Create a network with port-sec set to False
+        network = self._create_network(port_security_enabled=False)
+
+        self.assertFalse(network['port_security_enabled'])
+        self.create_subnet(network)
+        port = self.create_port(network, port_security_enabled=True)
+        self.assertTrue(port['port_security_enabled'])
+
+    @test.attr(type=['negative', 'smoke'])
+    @test.idempotent_id('05642059-1bfc-4581-9bc9-aaa5db08dd60')
+    @test.requires_ext(extension='port-security', service='network')
+    def test_port_sec_update_port_failed(self):
+        network = self.create_network()
+        self.create_subnet(network)
+        port = self.create_port(network)
+
+        # Exception when set port-sec to False with sec-group defined
+        self.assertRaises(lib_exc.Conflict,
+                          self.update_port, port, port_security_enabled=False)
+
+        updated_port = self.update_port(
+            port, security_groups=[], port_security_enabled=False)
+        self.assertFalse(updated_port['port_security_enabled'])
+
+        allowed_address_pairs = [{'ip_address': FAKE_IP,
+                                  'mac_address': FAKE_MAC}]
+
+        # Exception when set address-pairs with port-sec is False
+        self.assertRaises(lib_exc.Conflict,
+                          self.update_port, port,
+                          allowed_address_pairs=allowed_address_pairs)