Test security group creation with insufficient rules quota

As for each new security group there are 2 default rules created
we need to make sure that security group will not be created if
security group rules quota is insufficient for 2 additional rules

Depends-on: https://review.opendev.org/722652

Change-Id: Ie4dab7d27a6bc58899967220aa8e8f004dd91433

neutron_tempest_plugin/api/test_security_groups_negative.py

@@ -16,6 +16,7 @@
 from neutron_lib import constants
 from neutron_lib.db import constants as db_const
 from tempest.lib.common.utils import data_utils
+from tempest.lib.common.utils import test_utils
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
 
@@ -170,3 +171,21 @@ class NegativeSecGroupQuotaTest(test_security_groups.BaseSecGroupQuota):
         values = [-2, 2147483648, "value"]
         for value in values:
             self.assertRaises(lib_exc.BadRequest, self._set_sg_quota, value)
+
+
+class NegativeSecGroupRulesQuotaTest(
+        test_security_groups.BaseSecGroupRulesQuota):
+
+    credentials = ['primary', 'admin']
+    required_extensions = ['security-group', 'quotas']
+
+    def setUp(self):
+        super(NegativeSecGroupRulesQuotaTest, self).setUp()
+        self.addCleanup(test_utils.call_and_ignore_notfound_exc,
+                        self.admin_client.reset_quotas, self.client.tenant_id)
+        self._set_sg_rules_quota(10)
+
+    @decorators.idempotent_id('8336e6ea-2e0a-4a1a-8673-a6f81b577d57')
+    def test_sg_creation_with_insufficient_sg_rules_quota(self):
+        self._set_sg_rules_quota(0)
+        self.assertRaises(lib_exc.Conflict, self.create_security_group)