def _get_data_from_binding_profile(self, context, port):
     if (ovn_const.OVN_PORT_BINDING_PROFILE not in port or
             not attr.is_attr_set(
                 port[ovn_const.OVN_PORT_BINDING_PROFILE])):
         return None, None
     parent_name = (
         port[ovn_const.OVN_PORT_BINDING_PROFILE].get('parent_name'))
     tag = port[ovn_const.OVN_PORT_BINDING_PROFILE].get('tag')
     if not any((parent_name, tag)):
         # An empty profile is fine.
         return None, None
     if not all((parent_name, tag)):
         # If one is set, they both must be set.
         msg = _('Invalid binding:profile. parent_name and tag are '
                 'both required.')
         raise n_exc.InvalidInput(error_message=msg)
     if not isinstance(parent_name, six.string_types):
         msg = _('Invalid binding:profile. parent_name "%s" must be '
                 'a string.') % parent_name
         raise n_exc.InvalidInput(error_message=msg)
     try:
         tag = int(tag)
         if tag < 0 or tag > 4095:
             raise ValueError
     except ValueError:
         # The tag range is defined by ovn-nb.ovsschema.
         # https://github.com/openvswitch/ovs/blob/ovn/ovn/ovn-nb.ovsschema
         msg = _('Invalid binding:profile. tag "%s" must be '
                 'an int between 1 and 4096, inclusive.') % tag
         raise n_exc.InvalidInput(error_message=msg)
     # Make sure we can successfully look up the port indicated by
     # parent_name.  Just let it raise the right exception if there is a
     # problem.
     self.get_port(context, parent_name)
     return parent_name, tag

 def _get_data_from_binding_profile(self, context, port):
     if df_const.DF_PORT_BINDING_PROFILE not in port or not attr.is_attr_set(port[df_const.DF_PORT_BINDING_PROFILE]):
         return None, None
     parent_name = port[df_const.DF_PORT_BINDING_PROFILE].get("parent_name")
     tag = port[df_const.DF_PORT_BINDING_PROFILE].get("tag")
     if not any((parent_name, tag)):
         # An empty profile is fine.
         return None, None
     if not all((parent_name, tag)):
         # If one is set, they both must be set.
         msg = _("Invalid binding:profile. parent_name and tag are " "both required.")
         raise n_exc.InvalidInput(error_message=msg)
     if not isinstance(parent_name, six.string_types):
         msg = _('Invalid binding:profile. parent_name "%s" must be ' "a string.") % parent_name
         raise n_exc.InvalidInput(error_message=msg)
     try:
         tag = int(tag)
         if tag < 0 or tag > 4095:
             raise ValueError
     except ValueError:
         msg = _('Invalid binding:profile. tag "%s" must be ' "an int between 1 and 4096, inclusive.") % tag
         raise n_exc.InvalidInput(error_message=msg)
     # Make sure we can successfully look up the port indicated by
     # parent_name.  Just let it raise the right exception if there is a
     # problem.
     self.get_port(context, parent_name)
     return parent_name, tag

    def update_network_precommit(self, context):
        if context.original['name'] != context.current['name']:
            nsx_switch_ids = nsx_utils.get_nsx_switch_ids(
               context._plugin_context.session,
               self.cluster,
               context.current['id']
            )

            if not nsx_switch_ids or len(nsx_switch_ids) < 1:
                 LOG.warn(_("Unable to find NSX mappings for neutron "
                             "network:%s"), context.original['id'])

            try:
                switchlib.update_lswitch(
                    self.cluster,
                    lswitch_ids[0],
                    context.current['name']
                )
            except api_exc.NsxApiException as e:
                 LOG.warn(_("Logical switch update on NSX backend failed. "
                            "Neutron network id:%(net_id)s; "
                            "NSX lswitch id:%(lswitch_id)s;"
                            "Error:%(error)s"),
                            {'net_id': context.current['id'],
                             'lswitch_id': lswitch_ids[0],
                             'error': e})

    def _nsx_delete_port(self, context, port_data):
        # FIXME(salvatore-orlando): On the NSX platform we do not really have
        # external networks. So deleting regular ports from external networks
        # does not make sense. However we cannot raise as this would break
        # unit tests.

        # NOTE(rods): reporting mark's comment on havana version of this patch.
        # Akanda does want ports for external networks so this method is
        # basically same with external check removed

        # ---------------------------------------------------------------------
        # Original code:
        # if self._network_is_external(context, port_data['network_id']):
        #     LOG.info(_("NSX plugin does not support regular VIF ports on "
        #                "external networks. Port %s will be down."),
        #              port_data['network_id'])
        #     return
        # ---------------------------------------------------------------------

        nsx_switch_id, nsx_port_id = nsx_utils.get_nsx_switch_and_port_id(
            context.session, self.cluster, port_data['id'])
        if not nsx_port_id:
            LOG.debug(_("Port '%s' was already deleted on NSX platform"), id)
            return
        # TODO(bgh): if this is a bridged network and the lswitch we just got
        # back will have zero ports after the delete we should garbage collect
        # the lswitch.
        try:
            switchlib.delete_port(self.cluster, nsx_switch_id, nsx_port_id)
            LOG.debug(_("_nsx_delete_port completed for port %(port_id)s "
                        "on network %(net_id)s"),
                      {'port_id': port_data['id'],
                       'net_id': port_data['network_id']})
        except n_exc.NotFound:
            LOG.warning(_("Port %s not found in NSX"), port_data['id'])

 def _validate_binding_profile(self, context):
     # Validate binding:profile if it exists in precommit so that we can
     # fail port creation if the contents are invalid.
     port = context.current
     if ovn_const.OVN_PORT_BINDING_PROFILE not in port:
         return
     parent_name = (
         port[ovn_const.OVN_PORT_BINDING_PROFILE].get('parent_name'))
     tag = port[ovn_const.OVN_PORT_BINDING_PROFILE].get('tag')
     if not any((parent_name, tag)):
         # An empty profile is fine.
         return
     if not all((parent_name, tag)):
         # If one is set, they both must be set.
         msg = _('Invalid binding:profile. parent_name and tag are '
                 'both required.')
         raise n_exc.InvalidInput(error_message=msg)
     if not isinstance(parent_name, six.string_types):
         msg = _('Invalid binding:profile. parent_name "%s" must be '
                 'a string.') % parent_name
         raise n_exc.InvalidInput(error_message=msg)
     if not isinstance(tag, int) or tag < 0 or tag > 4095:
         # The tag range is defined by ovn-nb.ovsschema.
         # https://github.com/openvswitch/ovs/blob/ovn/ovn/ovn-nb.ovsschema
         msg = _('Invalid binding:profile. tag "%s" must be '
                 'an int between 1 and 4096, inclusive.') % tag
         raise n_exc.InvalidInput(error_message=msg)
     # Make sure we can successfully look up the port indicated by
     # parent_name.  Just let it raise the right exception if there is a
     # problem.
     context._plugin.get_port(context._plugin_context, parent_name)

def allocate_edge_vnic_with_tunnel_index(session, edge_id, network_id):
    """Allocate an avaliable edge vnic with tunnel index to network."""

    # TODO(berlin): temporary solution to let metadata and dhcp use
    # different vnics
    net_list = get_nsxv_internal_network(
        session, constants.InternalEdgePurposes.INTER_EDGE_PURPOSE)
    metadata_net_id = net_list[0]['network_id'] if net_list else None

    with session.begin(subtransactions=True):
        query = session.query(nsxv_models.NsxvEdgeVnicBinding)
        query = query.filter(
            nsxv_models.NsxvEdgeVnicBinding.edge_id == edge_id,
            nsxv_models.NsxvEdgeVnicBinding.network_id == expr.null())
        if metadata_net_id:
            vnic_binding = get_edge_vnic_binding(
                session, edge_id, metadata_net_id)
            if vnic_binding:
                vnic_index = vnic_binding.vnic_index
                query = query.filter(
                    nsxv_models.NsxvEdgeVnicBinding.vnic_index != vnic_index)

        binding = query.first()
        if not binding:
            msg = (_("Failed to allocate one available vnic on edge_id: "
                     ":%(edge_id)s to network_id: %(network_id)s") %
                   {'edge_id': edge_id, 'network_id': network_id})
            LOG.exception(msg)
            raise nsx_exc.NsxPluginException(err_msg=msg)
        binding['network_id'] = network_id
        session.add(binding)
        session.flush()
    return binding

    def create_network_precommit(self, context):
        """Add a network to NSX

        This method does not handle provider networks correctly and
        is out-of-scope for now.
        """
        net_data = context.current

        if net_data['admin_state_up'] is False:
             LOG.warning(_("Network with admin_state_up=False are not yet "
                           "supported by this plugin. Ignoring setting for "
                           "network %s"), net_data.get('name', '<unknown>'))

        transport_zone_config = self._convert_to_transport_zones(net_data)

        nsx_switch = switchlib.create_lswitch(
            self.cluster,
            net_data['id'],
            net_data['tenant_id'],
            net_data.get('name'),
            transport_zone_config,
            shared=bool(net_data.get('shared'))
        )

        nsx_db.add_neutron_nsx_network_mapping(
           context._plugin_context.session,
           net_data['id'],
           nsx_switch['uuid']
        )

    def update_port_postcommit(self, context):
        try:
            dvs = self._lookup_dvs_for_context(context.network)
        except exceptions.NotSupportedNetworkType as e:
            LOG.info(
                _LI("Port %(id)s not updated. Reason: %(reason)s") % {"id": context.current["id"], "reason": e.message}
            )
        except exceptions.NoDVSForPhysicalNetwork:
            raise exceptions.InvalidSystemState(
                details=_(
                    "Port %(port_id)s belong to VMWare VM, but there is no " "mapping from network %(net_id)s to DVS."
                )
                % {"port_id": context.current["id"], "net_id": context.network.current["id"]}
            )
        else:
            self._update_admin_state_up(dvs, context)

            force = context.original["status"] == n_const.PORT_STATUS_DOWN
            # self._update_security_groups(dvs, context, force=force)
            if (
                context.current["binding:vif_type"] == "unbound"
                and context.current["status"] == n_const.PORT_STATUS_DOWN
            ):
                context._plugin.update_port_status(
                    context._plugin_context, context.current["id"], n_const.PORT_STATUS_ACTIVE
                )

 def delete_lport(self, lport_name=None, lswitch=None,
                  ext_id=None, if_exists=True):
     if (lport_name is not None):
         return cmd.DelLogicalPortCommand(self, lport_name,
                                          lswitch, if_exists)
     else:
         raise RuntimeError(_("Currently only supports "
                              "delete by lport-name"))

 def _convert_firewall_action(self, action):
     if action == FWAAS_ALLOW:
         return VSE_FWAAS_ALLOW
     elif action == FWAAS_DENY:
         return VSE_FWAAS_DENY
     else:
         msg = _("Invalid action value %s in a firewall rule") % action
         raise vcns_exc.VcnsBadRequest(resource='firewall_rule', msg=msg)

 def insert_rule(self, context, rule_info, edge_id, fwr):
     if rule_info.get("insert_before"):
         self._add_rule_above(context, rule_info["insert_before"], edge_id, fwr)
     elif rule_info.get("insert_after"):
         self._add_rule_below(context, rule_info["insert_after"], edge_id, fwr)
     else:
         msg = _("Can't execute insert rule operation " "without reference rule_id")
         raise vcns_exc.VcnsBadRequest(resource="firewall_rule", msg=msg)

 def _restore_firewall_action(self, action):
     if action == VSE_FWAAS_ALLOW:
         return FWAAS_ALLOW
     elif action == VSE_FWAAS_DENY:
         return FWAAS_DENY
     else:
         msg = _("Invalid action value %s in " "a vshield firewall rule") % action
         raise vcns_exc.VcnsBadRequest(resource="firewall_rule", msg=msg)

def get_nsxv_edge_firewallrule_binding_by_vseid(
        session, edge_id, rule_vseid):
    with session.begin(subtransactions=True):
        try:
            return (session.query(nsxv_models.NsxvEdgeFirewallRuleBinding).
                    filter_by(edge_id=edge_id, rule_vseid=rule_vseid).one())
        except exc.NoResultFound:
            msg = _("Rule Resource binding not found!")
            raise nsx_exc.NsxPluginException(err_msg=msg)

    def run_idl(self, txn):
        try:
            port = idlutils.row_by_value(self.api.idl, 'Logical_Port',
                                         'name', self.lport)
        except idlutils.RowNotFound:
            msg = _("Logical Port %s does not exist") % self.lport
            raise RuntimeError(msg)
        try:
            lrouter_port = idlutils.row_by_value(self.api.idl,
                                                 'Logical_Router_Port',
                                                 'name', self.lport)
        except idlutils.RowNotFound:
            msg = _("Logical Router Port %s does not exist") % self.lport
            raise RuntimeError(msg)

        options = {'router-port': str(lrouter_port.uuid)}
        setattr(port, 'options', options)
        setattr(port, 'type', 'router')

    def create_floatingip(self, context, floatingip):
        LOG.debug('create_floatingip %s', (floatingip,))
        fip = floatingip['floatingip']
        tenant_id = self._get_tenant_id_for_create(context, fip)
        fip_id = uuidutils.generate_uuid()

        f_net_id = fip['floating_network_id']
        if not self._core_plugin._network_is_external(context, f_net_id):
            msg = _("Network %s is not a valid external network") % f_net_id
            raise q_exc.BadRequest(resource='floatingip', msg=msg)

        # NOTE(dhellmann): Custom
        #
        # FIXME(dhellmann): This should probably verify that the subnet
        # being used is on the network the user requested.
        ip_to_use = self._allocate_floatingip_from_configured_subnets(context)

        with context.session.begin(subtransactions=True):
            # This external port is never exposed to the tenant.
            # it is used purely for internal system and admin use when
            # managing floating IPs.
            external_port = self._core_plugin.create_port(context.elevated(), {
                'port':
                {'tenant_id': '',  # tenant intentionally not set
                 'network_id': f_net_id,
                 'mac_address': attributes.ATTR_NOT_SPECIFIED,
                 # NOTE(dhellmann): Custom
                 'fixed_ips': [ip_to_use],
                 'admin_state_up': True,
                 'device_id': fip_id,
                 'device_owner': DEVICE_OWNER_FLOATINGIP,
                 'name': ''}})
            # Ensure IP addresses are allocated on external port
            if not external_port['fixed_ips']:
                raise q_exc.ExternalIpAddressExhausted(net_id=f_net_id)

            floating_fixed_ip = external_port['fixed_ips'][0]
            floating_ip_address = floating_fixed_ip['ip_address']
            floatingip_db = FloatingIP(
                id=fip_id,
                tenant_id=tenant_id,
                floating_network_id=fip['floating_network_id'],
                floating_ip_address=floating_ip_address,
                floating_port_id=external_port['id'])
            fip['tenant_id'] = tenant_id
            # Update association with internal port
            # and define external IP address
            self._update_fip_assoc(context, fip,
                                   floatingip_db, external_port)
            context.session.add(floatingip_db)

        router_id = floatingip_db['router_id']
        if router_id:
            self.l3_rpc_notifier.routers_updated(
                context, [router_id],
                'create_floatingip')
        return self._make_floatingip_dict(floatingip_db)

 def _create_load_balancer(cls, wait=True, **lb_kwargs):
     try:
         lb = cls.load_balancers_client.create_load_balancer(**lb_kwargs)
         if wait:
             cls._wait_for_load_balancer_status(lb.get('id'))
     except Exception:
         raise Exception(_("Failed to create load balancer..."))
     cls._lbs_to_delete.append(lb.get('id'))
     return lb

 def _wait_for_load_balancer_status(cls, load_balancer_id,
                                    provisioning_status='ACTIVE',
                                    operating_status='ONLINE',
                                    delete=False):
     interval_time = 10
     timeout = 300
     end_time = time.time() + timeout
     lb = {}
     while time.time() < end_time:
         try:
             lb = cls.load_balancers_client.get_load_balancer(
                 load_balancer_id)
             if not lb:
                     # loadbalancer not found
                 if delete:
                     break
                 else:
                     raise Exception(
                         _("loadbalancer {lb_id} not"
                           " found").format(
                               lb_id=load_balancer_id))
             if (lb.get('provisioning_status') == provisioning_status and
                     lb.get('operating_status') == operating_status):
                 break
             time.sleep(interval_time)
         except exceptions.NotFound as e:
             # if wait is for delete operation do break
             if delete:
                 break
             else:
                 # raise original exception
                 raise e
     else:
         raise Exception(
             _("Wait for load balancer ran for {timeout} seconds and did "
               "not observe {lb_id} reach {provisioning_status} "
               "provisioning status and {operating_status} "
               "operating status.").format(
                   timeout=timeout,
                   lb_id=load_balancer_id,
                   provisioning_status=provisioning_status,
                   operating_status=operating_status))
     return lb

 def remove_port_filter(self, port):
     LOG.debug("OFW Removing device (%s) filter: %s", port['device'],
               port)
     if not self._filtered_ports.get(port['device']):
         LOG.info(_('Attempted to remove port filter which is not '
                    'filtered %r'), port)
         return
     self._remove_flows(port)
     self._filtered_ports.pop(port['device'])
     self._filtered_in_ports.pop(port['device'])

 def load(self, *args, **kwargs):
     for app in self.apps_list:
         app_class_name = self.apps_location_prefix + "." + app
         try:
             app_class = importutils.import_class(app_class_name)
             app = app_class(*args, **kwargs)
             self.apps.append(app)
         except ImportError as e:
             LOG.exception(_LE("Error loading application by class, %s"), e)
             raise ImportError(_("Application class not found."))

 def delete_port_postcommit(self, context):
     try:
         dvs = self._lookup_dvs_for_context(context.network)
     except exceptions.NoDVSForPhysicalNetwork:
         raise exceptions.InvalidSystemState(details=_(
             'Port %(port_id)s belong to VMWare VM, but there is no '
             'mapping from network %(net_id)s to DVS.') % {
                 'port_id': context.current['id'],
                 'net_id': context.network.current['id']})
     self._update_security_groups(dvs, context, force=True)
     dvs.release_port(context.current)