def delete_port_postcommit(self, context):
        """Delete a port.

        :param context: PortContext instance describing the current
        state of the port, prior to the call to delete it.

        Called after the transaction completes. Call can block, though
        will block the entire process so care should be taken to not
        drastically affect performance.  Runtime errors are not
        expected, and will not prevent the resource from being
        deleted.
        """
        port = context.current
        with self._nb_ovn.transaction(check_error=True) as txn:
            txn.add(self._nb_ovn.delete_lswitch_port(port['id'],
                    utils.ovn_name(port['network_id'])))
            txn.add(self._nb_ovn.delete_acl(
                    utils.ovn_name(port['network_id']), port['id']))

        admin_context = n_context.get_admin_context()
        sg_ids = port.get('security_groups', [])
        num_fixed_ips = len(port.get('fixed_ips'))
        if num_fixed_ips:
            for sg_id in sg_ids:
                ovn_acl.refresh_remote_security_group(
                    self._plugin, admin_context, self._nb_ovn, sg_id)

def add_acl_dhcp(port, subnet):
    # Allow DHCP responses through from source IPs on the local subnet.
    # We do this even if DHCP isn't enabled.  It could be enabled later.
    # We could hook into handling when it's enabled/disabled for a subnet,
    # but this code is temporary anyway.  It's likely no longer needed
    # once OVN native DHCP support merges, which is under development and
    # review already.
    # TODO(russellb) Remove this once OVN native DHCP support is merged.
    acl_list = []
    acl = {"lswitch": utils.ovn_name(port['network_id']),
           "lport": port['id'],
           "priority": ovn_const.ACL_PRIORITY_ALLOW,
           "action": ovn_const.ACL_ACTION_ALLOW,
           "log": False,
           "direction": 'to-lport',
           "match": ('outport == "%s" && ip4 && ip4.src == %s && '
                     'udp && udp.src == 67 && udp.dst == 68'
                     ) % (port['id'], subnet['cidr']),
           "external_ids": {'neutron:lport': port['id']}}
    acl_list.append(acl)
    acl = {"lswitch": utils.ovn_name(port['network_id']),
           "lport": port['id'],
           "priority": ovn_const.ACL_PRIORITY_ALLOW,
           "action": ovn_const.ACL_ACTION_ALLOW,
           "log": False,
           "direction": 'from-lport',
           "match": ('inport == "%s" && ip4 && '
                     '(ip4.dst == 255.255.255.255 || '
                     'ip4.dst == %s) && '
                     'udp && udp.src == 68 && udp.dst == 67'
                     ) % (port['id'], subnet['cidr']),
           "external_ids": {'neutron:lport': port['id']}}
    acl_list.append(acl)
    return acl_list

    def delete_port_postcommit(self, context):
        """Delete a port.

        :param context: PortContext instance describing the current
        state of the port, prior to the call to delete it.

        Called after the transaction completes. Call can block, though
        will block the entire process so care should be taken to not
        drastically affect performance.  Runtime errors are not
        expected, and will not prevent the resource from being
        deleted.
        """
        port = context.current
        with self._nb_ovn.transaction(check_error=True) as txn:
            txn.add(self._nb_ovn.delete_lswitch_port(port['id'],
                    utils.ovn_name(port['network_id'])))
            txn.add(self._nb_ovn.delete_acl(
                    utils.ovn_name(port['network_id']), port['id']))

            if port.get('fixed_ips'):
                addresses = ovn_acl.acl_port_ips(port)
                for sg_id in port.get('security_groups', []):
                    for ip_version in addresses:
                        if addresses[ip_version]:
                            txn.add(self._nb_ovn.update_address_set(
                                name=utils.ovn_addrset_name(sg_id, ip_version),
                                addrs_add=None,
                                addrs_remove=addresses[ip_version]))

    def delete_port(self, context, port_id, l3_port_check=True):
        port = self.get_port(context, port_id)
        try:
            # If this is a port on a provider network, we just need to delete
            # the special logical switch for this port, and the 2 ports on the
            # switch will get garbage collected.  Note that if the switch
            # doesn't exist, we'll get an exception without actually having to
            # execute a transaction with the remote db.  The check is local.
            self._ovn.delete_lswitch(
                utils.ovn_name(port['id']), if_exists=False).execute(
                    check_error=True, log_errors=False)
        except RuntimeError:
            # If the switch doesn't exist, we'll get a RuntimeError, meaning
            # we just need to delete a port.
            with self._ovn.transaction(check_error=True) as txn:
                txn.add(self._ovn.delete_lport(port_id,
                        utils.ovn_name(port['network_id'])))
                txn.add(self._ovn.delete_acl(
                        utils.ovn_name(port['network_id']), port['id']))

        sg_ids = port.get('security_groups', [])

        with context.session.begin(subtransactions=True):
            self.disassociate_floatingips(context, port_id)
            super(OVNPlugin, self).delete_port(context, port_id)

        for sg_id in sg_ids:
            self._refresh_remote_security_group(context, sg_id)

 def _get_update_data_without_compare(self):
     lswitch_ovsdb_dict = {}
     for switch_name in self.lswitch_names:
         switch_name = utils.ovn_name(switch_name)
         lswitch = idlutils.row_by_value(self.api.idl, 'Logical_Switch',
                                         'name', switch_name)
         lswitch_ovsdb_dict[switch_name] = lswitch
     if self.is_add_acl:
         acl_add_values_dict = {}
         for port in self.port_list:
             switch_name = utils.ovn_name(port['network_id'])
             if switch_name not in acl_add_values_dict:
                 acl_add_values_dict[switch_name] = []
             if port['id'] in self.acl_new_values_dict:
                 acl_add_values_dict[switch_name].append(
                     self.acl_new_values_dict[port['id']])
         acl_del_objs_dict = {}
     else:
         acl_add_values_dict = {}
         acl_del_objs_dict = {}
         del_acl_matches = []
         for acl_dict in self.acl_new_values_dict.values():
             del_acl_matches.append(acl_dict['match'])
         for switch_name, lswitch in six.iteritems(lswitch_ovsdb_dict):
             if switch_name not in acl_del_objs_dict:
                 acl_del_objs_dict[switch_name] = []
             lswitch.verify('acls')
             acls = getattr(lswitch, 'acls', [])
             for acl in acls:
                 if getattr(acl, 'match') in del_acl_matches:
                     acl_del_objs_dict[switch_name].append(acl)
     return lswitch_ovsdb_dict, acl_del_objs_dict, acl_add_values_dict

    def delete_port(self, context, port_id, l3_port_check=True):
        port = self.get_port(context, port_id)
        try:
            # If this is a port on a provider network, we just need to delete
            # the special logical switch for this port, and the 2 ports on the
            # switch will get garbage collected.  Note that if the switch
            # doesn't exist, we'll get an exception without actually having to
            # execute a transaction with the remote db.  The check is local.
            self._ovn.delete_lswitch(utils.ovn_name(port["id"]), if_exists=False).execute(
                check_error=True, log_errors=False
            )
        except RuntimeError:
            # If the switch doesn't exist, we'll get a RuntimeError, meaning
            # we just need to delete a port.
            with self._ovn.transaction(check_error=True) as txn:
                txn.add(self._ovn.delete_lport(port_id, utils.ovn_name(port["network_id"])))
                txn.add(self._ovn.delete_acl(utils.ovn_name(port["network_id"]), port["id"]))

        # NOTE(russellb): If this port had a security group applied with a rule
        # that used "remote_group_id", technically we could update the ACLs for
        # all ports on that security group to remove references to this port
        # we're deleting.  However, it's harmless to leave it for now and saves
        # some additional churn in the OVN db.  References to this port will
        # get automatically removed the next time something else triggers a
        # refresh of ACLs for ports on that security group.

        with context.session.begin(subtransactions=True):
            self.disassociate_floatingips(context, port_id)
            super(OVNPlugin, self).delete_port(context, port_id)

    def delete_port_postcommit(self, context):
        """Delete a port.

        :param context: PortContext instance describing the current
        state of the port, prior to the call to delete it.

        Called after the transaction completes. Call can block, though
        will block the entire process so care should be taken to not
        drastically affect performance.  Runtime errors are not
        expected, and will not prevent the resource from being
        deleted.
        """
        port = context.current
        with self._nb_ovn.transaction(check_error=True) as txn:
            txn.add(self._nb_ovn.delete_lswitch_port(port['id'],
                    utils.ovn_name(port['network_id'])))
            txn.add(self._nb_ovn.delete_acl(
                    utils.ovn_name(port['network_id']), port['id']))

            if port.get('fixed_ips'):
                addresses = ovn_acl.acl_port_ips(port)
                for sg_id in port.get('security_groups', []):
                    for ip_version in addresses:
                        if addresses[ip_version]:
                            txn.add(self._nb_ovn.update_address_set(
                                name=utils.ovn_addrset_name(sg_id, ip_version),
                                addrs_add=None,
                                addrs_remove=addresses[ip_version]))

            # NOTE(lizk): Always try to clean port dhcp options, to make sure
            # no orphaned DHCP_Options row related to port left behind, which
            # may be created in get_port_dhcpv4_options.
            cmd = self._get_delete_lsp_dhcpv4_options_cmd(port)
            if cmd:
                txn.add(cmd)

    def get_acls_for_lswitches(self, lswitch_names):
        """Get the existing set of acls that belong to the logical switches

        @param lswitch_names: List of logical switch names
        @type lswitch_names: []
        @var acl_values_dict: A dictionary indexed by port_id containing the
                              list of acl values in string format that belong
                              to that port
        @var acl_obj_dict: A dictionary indexed by acl value containing the
                           corresponding acl idl object.
        @var lswitch_ovsdb_dict: A dictionary mapping from logical switch
                                 name to lswitch idl object
        @return: (acl_values_dict, acl_obj_dict, lswitch_ovsdb_dict)
        """
        acl_values_dict = {}
        acl_obj_dict = {}
        lswitch_ovsdb_dict = {}
        for lswitch_name in lswitch_names:
            try:
                lswitch = idlutils.row_by_value(self.idl,
                                                'Logical_Switch',
                                                'name',
                                                utils.ovn_name(lswitch_name))
            except idlutils.RowNotFound:
                # It is possible for the logical switch to be deleted
                # while we are searching for it by name in idl.
                continue
            lswitch_ovsdb_dict[lswitch_name] = lswitch
            acls = getattr(lswitch, 'acls', [])

            # Iterate over each acl in a lswitch and store the acl in
            # a key:value representation for e.g. acl_string. This
            # key:value representation can invoke the code -
            # self._ovn.add_acl(**acl_string)
            for acl in acls:
                ext_ids = getattr(acl, 'external_ids', {})
                port_id = ext_ids.get('neutron:lport')
                acl_list = acl_values_dict.setdefault(port_id, [])
                acl_string = {'lport': port_id,
                              'lswitch': utils.ovn_name(lswitch_name)}
                for acl_key in six.iterkeys(getattr(acl, "_data", {})):
                    try:
                        acl_string[acl_key] = getattr(acl, acl_key)
                    except AttributeError:
                        pass
                acl_obj_dict[str(acl_string)] = acl
                acl_list.append(acl_string)
        return acl_values_dict, acl_obj_dict, lswitch_ovsdb_dict

    def add_router_interface(self, context, router_id, interface_info):
        router_interface_info = super(OVNPlugin, self).add_router_interface(
            context, router_id, interface_info)

        if not config.is_ovn_l3():
            LOG.debug("OVN L3 mode is disabled, skipping "
                      "add_router_interface")
            return router_interface_info

        port = self.get_port(context, router_interface_info['port_id'])
        subnet_id = port['fixed_ips'][0]['subnet_id']
        subnet = self.get_subnet(context, subnet_id)
        lrouter = utils.ovn_name(router_id)
        cidr = netaddr.IPNetwork(subnet['cidr'])
        network = "%s/%s" % (port['fixed_ips'][0]['ip_address'],
                             str(cidr.prefixlen))

        lrouter_port_name = utils.ovn_lrouter_port_name(port['id'])
        with self._ovn.transaction(check_error=True) as txn:
            txn.add(self._ovn.add_lrouter_port(name=lrouter_port_name,
                                               lrouter=lrouter,
                                               mac=port['mac_address'],
                                               network=network))

            txn.add(self._ovn.set_lrouter_port_in_lport(port['id'],
                                                        lrouter_port_name))
        return router_interface_info

 def test_acl_update_compare_acls(self):
     fake_sg_rule = \
         fakes.FakeSecurityGroupRule.create_one_security_group_rule().info()
     fake_port = fakes.FakePort.create_one_port().info()
     fake_add_acl = fakes.FakeOvsdbRow.create_one_ovsdb_row(
         attrs={'match': 'add_acl'})
     fake_del_acl = fakes.FakeOvsdbRow.create_one_ovsdb_row(
         attrs={'match': 'del_acl'})
     fake_lswitch = fakes.FakeOvsdbRow.create_one_ovsdb_row(
         attrs={'name': ovn_utils.ovn_name(fake_port['network_id']),
                'acls': []})
     add_acl = ovn_acl.add_sg_rule_acl_for_port(
         fake_port, fake_sg_rule, 'add_acl')
     self.ovn_api.get_acls_for_lswitches.return_value = (
         {fake_port['id']: [fake_del_acl.match]},
         {fake_del_acl.match: fake_del_acl},
         {fake_lswitch.name.replace('neutron-', ''): fake_lswitch})
     cmd = commands.UpdateACLsCommand(
         self.ovn_api, [fake_port['network_id']],
         [fake_port], {fake_port['id']: [add_acl]},
         need_compare=True)
     self.transaction.insert.return_value = fake_add_acl
     cmd.run_idl(self.transaction)
     self.transaction.insert.assert_called_once_with(
         self.ovn_api.acl_table)
     fake_lswitch.verify.assert_called_with('acls')
     self.assertEqual([fake_add_acl.uuid], fake_lswitch.acls)

 def _delete_lrouter_in_ovn(self, id, is_gateway_router=False):
     if is_gateway_router:
         lrouter_name = utils.ovn_gateway_router_name(id)
     else:
         lrouter_name = utils.ovn_name(id)
     with self._ovn.transaction(check_error=True) as txn:
         txn.add(self._ovn.delete_lrouter(lrouter_name))

    def create_port_in_ovn(self, port, ovn_port_info):
        external_ids = {ovn_const.OVN_PORT_NAME_EXT_ID_KEY: port['name']}
        lswitch_name = utils.ovn_name(port['network_id'])
        admin_context = n_context.get_admin_context()
        sg_cache = {}
        sg_ports_cache = {}
        subnet_cache = {}

        with self._nb_ovn.transaction(check_error=True) as txn:
            # The lport_name *must* be neutron port['id'].  It must match the
            # iface-id set in the Interfaces table of the Open_vSwitch
            # database which nova sets to be the port ID.
            txn.add(self._nb_ovn.create_lswitch_port(
                    lport_name=port['id'],
                    lswitch_name=lswitch_name,
                    addresses=ovn_port_info.addresses,
                    external_ids=external_ids,
                    parent_name=ovn_port_info.parent_name,
                    tag=ovn_port_info.tag,
                    enabled=port.get('admin_state_up'),
                    options=ovn_port_info.options,
                    type=ovn_port_info.type,
                    port_security=ovn_port_info.port_security))
            acls_new = ovn_acl.add_acls(self._plugin, admin_context,
                                        port, sg_cache, sg_ports_cache,
                                        subnet_cache)
            for acl in acls_new:
                txn.add(self._nb_ovn.add_acl(**acl))

        if len(port.get('fixed_ips')):
            for sg_id in port.get('security_groups', []):
                ovn_acl.refresh_remote_security_group(
                    self._plugin, admin_context, self._nb_ovn,
                    sg_id, sg_cache, sg_ports_cache,
                    subnet_cache, [port['id']])

 def _add_acl_dhcp(self, context, port, txn, subnet_cache):
     # Allow DHCP responses through from source IPs on the local subnet.
     # We do this even if DHCP isn't enabled.  It could be enabled later.
     # We could hook into handling when it's enabled/disabled for a subnet,
     # but this code is temporary anyway.  It's likely no longer needed
     # once OVN native DHCP support merges, which is under development and
     # review already.
     # TODO(russellb) Remove this once OVN native DHCP support is merged.
     for ip in port['fixed_ips']:
         if ip['subnet_id'] in subnet_cache:
             subnet = subnet_cache[ip['subnet_id']]
         else:
             subnet = self.get_subnet(context, ip['subnet_id'])
             subnet_cache[ip['subnet_id']] = subnet
         if subnet['ip_version'] != 4:
             continue
         txn.add(self._ovn.add_acl(
             lswitch=utils.ovn_name(port['network_id']),
             lport=port['id'],
             priority=ACL_PRIORITY_ALLOW,
             action='allow',
             log=False,
             direction='to-lport',
             match=('outport == "%s" && ip4 && ip4.src == %s && '
                    'udp && udp.src == 67 && udp.dst == 68'
                    ) % (port['id'], subnet['cidr']),
             external_ids={'neutron:lport': port['id']}))

    def _get_lrouter_connected_to_nexthop(self, context, router_id,
                                          router_ports, nexthop):
        """Find lrouter connected to nexthop

        @param router_id: router id
        @param router_ports: router ports in router
        @param nexthop: nexthop
        @return: distributed logical router name or gateway router name or None
        """

        lrouter_name = None
        for port in router_ports:
            found_nexthop = False
            for fixed_ip in port.get('fixed_ips', []):
                subnet_id = fixed_ip['subnet_id']
                subnet = self._plugin.get_subnet(context.elevated(), subnet_id)
                network = netaddr.IPNetwork(subnet['cidr'])
                if netaddr.IPAddress(nexthop) in network:
                    if port['device_owner'] == n_const.DEVICE_OWNER_ROUTER_GW:
                        # Nexthop is in external network
                        lrouter_name = utils.ovn_gateway_router_name(router_id)
                    else:
                        # Next hop is in tenant network
                        lrouter_name = utils.ovn_name(router_id)
                    found_nexthop = True
                    break
            if found_nexthop:
                break
        if not lrouter_name:
            raise exc.L3RouterPluginStaticRouteError(nexthop=nexthop,
                                                     router=router_id)

        return lrouter_name

 def test_get_router_chassis_binding(self):
     self._load_nb_db()
     chassis = self.nb_ovn_idl.get_router_chassis_binding(
         utils.ovn_name('lr-id-a'))
     self.assertEqual(chassis, 'host-1')
     chassis = self.nb_ovn_idl.get_router_chassis_binding(
         utils.ovn_name('lr-id-c'))
     self.assertEqual(chassis, 'host-2')
     chassis = self.nb_ovn_idl.get_router_chassis_binding(
         utils.ovn_name('lr-id-d'))
     self.assertEqual(chassis, None)
     chassis = self.nb_ovn_idl.get_router_chassis_binding(
         utils.ovn_name('lr-id-e'))
     self.assertEqual(chassis, None)
     chassis = self.nb_ovn_idl.get_router_chassis_binding('bad')
     self.assertEqual(chassis, None)

    def add_router_interface(self, context, router_id, interface_info):
        router_interface_info = super(OVNPlugin, self).add_router_interface(
            context, router_id, interface_info)

        if not config.is_ovn_l3():
            LOG.debug(_("OVN L3 mode is disabled, skipping "
                        "add_router_interface"))
            return router_interface_info

        port = self.get_port(context, router_interface_info['port_id'])
        subnet_id = port['fixed_ips'][0]['subnet_id']
        subnet = self.get_subnet(context, subnet_id)
        lrouter = utils.ovn_name(router_id)
        cidr = netaddr.IPNetwork(subnet['cidr'])
        network = "%s/%s" % (port['fixed_ips'][0]['ip_address'],
                             str(cidr.prefixlen))

        self._ovn.add_lrouter_port(port['id'], lrouter,
                                   mac=port['mac_address'],
                                   network=network).execute(check_error=True)
        # TODO(chandrav)
        # The following code is to update the options column in the lport
        # table with {router-port: "UUID of logical_router_port"}. Ideally this
        # should have been handled ine one transaction with add_lrouter_port,
        # but due to a bug in idl, we are forced to update it in a separate
        # transaction. After the transaction is committed idl does not update
        # the UUID that is part of a string from old to new.
        self._ovn.set_lrouter_port_in_lport(port['id']).execute(
            check_error=True)
        return router_interface_info

 def _update_acls_for_security_group(self, context, security_group_id,
                                     sg_ports_cache=None,
                                     exclude_ports=None,
                                     subnet_cache=None):
     # Update ACLs for all ports using this security group.  Note that the
     # ovsdb IDL suppresses the transaction down to what has actually
     # changed.
     if exclude_ports is None:
         exclude_ports = []
     filters = {'security_group_id': [security_group_id]}
     sg_ports = self._get_port_security_group_bindings(context, filters)
     with self._ovn.transaction(check_error=True) as txn:
         sg_cache = {}
         if sg_ports_cache is None:
             sg_ports_cache = {}
         if subnet_cache is None:
             subnet_cache = {}
         for binding in sg_ports:
             if binding['port_id'] in exclude_ports:
                 continue
             port = self.get_port(context, binding['port_id'])
             txn.add(self._ovn.delete_acl(
                     utils.ovn_name(port['network_id']), port['id']))
             self._add_acls(context, port, txn, sg_cache, sg_ports_cache,
                            subnet_cache)

    def _sync_networks(self, ctx):
        LOG.debug("OVN-NB Sync networks started")

        lswitches = self.ovn_api.get_all_logical_switches_ids()

        for network in self.core_plugin.get_networks(ctx):
            net_context = driver_context.NetworkContext(self.core_plugin, ctx, network)
            try:
                if self.mode == SYNC_MODE_REPAIR:
                    self.driver.create_network_postcommit(net_context)
                res = lswitches.pop(utils.ovn_name(net_context.current["id"]), None)
                if self.mode == SYNC_MODE_LOG:
                    if res is None:
                        LOG.warn(
                            _LW("Network found in Neutron but not in OVN" "DB, network_id=%s"),
                            net_context.current["id"],
                        )

            except RuntimeError:
                LOG.warn(_LW("Create network postcommit failed for " "network %s"), network["id"])

        # Only delete logical switch if it was previously created by neutron
        with self.ovn_api.transaction() as txn:
            for lswitch, ext_ids in lswitches.items():
                if ovn_const.OVN_NETWORK_NAME_EXT_ID_KEY in ext_ids:
                    if self.mode == SYNC_MODE_REPAIR:
                        txn.add(self.ovn_api.delete_lswitch(lswitch))
                    if self.mode == SYNC_MODE_LOG:
                        LOG.warn(
                            _LW("Network found in OVN but not in Neutron," " network_name=%s"),
                            (ext_ids[ovn_const.OVN_NETWORK_NAME_EXT_ID_KEY]),
                        )

        LOG.debug("OVN-NB Sync networks finished")

    def _disjoin_lrouter_and_gw_lrouter(self, router, transit_net_ports):
        router_id = router['id']
        lrouter_name = utils.ovn_name(router_id)
        gw_lrouter_name = utils.ovn_gateway_router_name(router_id)

        gtrp_ip = transit_net_ports['gtsp']['ip']
        gtrp_name = utils.ovn_lrouter_port_name(utils.ovn_gtsp_name(router_id))
        dtrp_name = utils.ovn_lrouter_port_name(utils.ovn_dtsp_name(router_id))

        lswitch_name = utils.ovn_transit_ls_name(router_id)
        dtsp_name = utils.ovn_dtsp_name(router_id)
        gtsp_name = utils.ovn_gtsp_name(router_id)

        with self._ovn.transaction(check_error=True) as txn:
            # 1. Delete default static route in gateway router
            txn.add(self._ovn.delete_static_route(
                lrouter_name, ip_prefix="0.0.0.0/0", nexthop=gtrp_ip))
            # 2. Delete gtrp port
            txn.add(self._ovn.delete_lrouter_port(gtrp_name, gw_lrouter_name))
            # 3. Delete dtrp port
            txn.add(self._ovn.delete_lrouter_port(dtrp_name, lrouter_name))
            # 4. Delete gtsp port
            txn.add(self._ovn.delete_lswitch_port(gtsp_name, lswitch_name))
            # 5. Delete dtsp port
            txn.add(self._ovn.delete_lswitch_port(dtsp_name, lswitch_name))
            # 6. Delete transit logical switch
            txn.add(self._ovn.delete_lswitch(lswitch_name))

 def delete_network(self, context, network_id):
     with context.session.begin(subtransactions=True):
         super(OVNPlugin, self).delete_network(context,
                                               network_id)
     self._ovn.delete_lswitch(
         utils.ovn_name(network_id), if_exists=True).execute(
             check_error=True)