Firewall as a Service (FWaaS) APIs and DB Model

Implements: blueprint quantum-fwaas

blueprint: quantum-fwaas-plugin

This is the first iteration of the FWaaS implementation and
is geared towards implementing the model that will be
required to at least address the reference implementation.

This iteration will not include implementation of the following
features:
* grouping or dynamic objects
* application/service objects

Change-Id: I57a62d6e9d3f1e6c4dd44cd5c745710a3d9e488e

etc/policy.json

@@ -58,6 +58,26 @@
     "create_router:external_gateway_info:enable_snat": "rule:admin_only",
     "update_router:external_gateway_info:enable_snat": "rule:admin_only",
 
+    "create_firewall": "",
+    "get_firewall": "rule:admin_or_owner",
+    "create_firewall:shared": "rule:admin_only",
+    "get_firewall:shared": "rule:admin_only",
+    "update_firewall": "rule:admin_or_owner",
+    "delete_firewall": "rule:admin_or_owner",
+
+    "create_firewall_policy": "",
+    "get_firewall_policy": "rule:admin_or_owner",
+    "create_firewall_policy:shared": "rule:admin_or_owner",
+    "update_firewall_policy": "rule:admin_or_owner",
+    "delete_firewall_policy": "rule:admin_or_owner",
+
+    "create_firewall_rule": "",
+    "get_firewall_rule": "rule:admin_or_owner",
+    "create_firewall_rule:shared": "rule:admin_or_owner",
+    "get_firewall_rule:shared": "rule:admin_or_owner",
+    "update_firewall_rule": "rule:admin_or_owner",
+    "delete_firewall_rule": "rule:admin_or_owner",
+
     "create_qos_queue": "rule:admin_only",
     "get_qos_queue": "rule:admin_only",
 

neutron/common/topics.py

@@ -25,6 +25,7 @@ UPDATE = 'update'
 AGENT = 'q-agent-notifier'
 PLUGIN = 'q-plugin'
 DHCP = 'q-dhcp-notifer'
+FIREWALL_PLUGIN = 'q-firewall-plugin'
 
 L3_AGENT = 'l3_agent'
 DHCP_AGENT = 'dhcp_agent'

neutron/db/firewall/__init__.py

@@ -0,0 +1,16 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 OpenStack Foundation
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.

neutron/db/firewall/firewall_db.py

@@ -0,0 +1,470 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 Big Switch Networks, Inc.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# @author: Sumit Naiksatam, sumitnaiksatam@gmail.com, Big Switch Networks, Inc.
+
+import sqlalchemy as sa
+from sqlalchemy.ext.orderinglist import ordering_list
+from sqlalchemy import orm
+from sqlalchemy.orm import exc
+
+from neutron.db import db_base_plugin_v2 as base_db
+from neutron.db import model_base
+from neutron.db import models_v2
+from neutron.extensions import firewall
+from neutron import manager
+from neutron.openstack.common import log as logging
+from neutron.openstack.common import uuidutils
+from neutron.plugins.common import constants as const
+
+
+LOG = logging.getLogger(__name__)
+
+
+class FirewallRule(model_base.BASEV2, models_v2.HasId, models_v2.HasTenant):
+    """Represents a Firewall rule."""
+    __tablename__ = 'firewall_rules'
+    name = sa.Column(sa.String(255))
+    description = sa.Column(sa.String(1024))
+    firewall_policy_id = sa.Column(sa.String(36),
+                                   sa.ForeignKey('firewall_policies.id'),
+                                   nullable=True)
+    shared = sa.Column(sa.Boolean)
+    protocol = sa.Column(sa.String(40))
+    ip_version = sa.Column(sa.Integer, nullable=False)
+    source_ip_address = sa.Column(sa.String(46))
+    destination_ip_address = sa.Column(sa.String(46))
+    source_port_range_min = sa.Column(sa.Integer)
+    source_port_range_max = sa.Column(sa.Integer)
+    destination_port_range_min = sa.Column(sa.Integer)
+    destination_port_range_max = sa.Column(sa.Integer)
+    action = sa.Column(sa.Enum('allow', 'deny', name='firewallrules_action'))
+    enabled = sa.Column(sa.Boolean)
+    position = sa.Column(sa.Integer)
+
+
+class Firewall(model_base.BASEV2, models_v2.HasId, models_v2.HasTenant):
+    """Represents a Firewall resource."""
+    __tablename__ = 'firewalls'
+    name = sa.Column(sa.String(255))
+    description = sa.Column(sa.String(1024))
+    shared = sa.Column(sa.Boolean)
+    admin_state_up = sa.Column(sa.Boolean)
+    status = sa.Column(sa.String(16))
+    firewall_policy_id = sa.Column(sa.String(36),
+                                   sa.ForeignKey('firewall_policies.id'),
+                                   nullable=True)
+
+
+class FirewallPolicy(model_base.BASEV2, models_v2.HasId, models_v2.HasTenant):
+    """Represents a Firewall Policy resource."""
+    __tablename__ = 'firewall_policies'
+    name = sa.Column(sa.String(255))
+    description = sa.Column(sa.String(1024))
+    shared = sa.Column(sa.Boolean)
+    firewall_rules = orm.relationship(
+        FirewallRule,
+        backref=orm.backref('firewall_policies', cascade='all, delete'),
+        order_by='FirewallRule.position',
+        collection_class=ordering_list('position', count_from=1))
+    audited = sa.Column(sa.Boolean)
+    firewalls = orm.relationship(Firewall, backref='firewall_policies')
+
+
+class Firewall_db_mixin(firewall.FirewallPluginBase, base_db.CommonDbMixin):
+    """Mixin class for Firewall DB implementation."""
+
+    @property
+    def _core_plugin(self):
+        return manager.NeutronManager.get_plugin()
+
+    def _get_firewall(self, context, id):
+        try:
+            return self._get_by_id(context, Firewall, id)
+        except exc.NoResultFound:
+            raise firewall.FirewallNotFound(firewall_id=id)
+
+    def _get_firewall_policy(self, context, id):
+        try:
+            return self._get_by_id(context, FirewallPolicy, id)
+        except exc.NoResultFound:
+            raise firewall.FirewallPolicyNotFound(firewall_policy_id=id)
+
+    def _get_firewall_rule(self, context, id):
+        try:
+            return self._get_by_id(context, FirewallRule, id)
+        except exc.NoResultFound:
+            raise firewall.FirewallRuleNotFound(firewall_rule_id=id)
+
+    def _make_firewall_dict(self, fw, fields=None):
+        res = {'id': fw['id'],
+               'tenant_id': fw['tenant_id'],
+               'name': fw['name'],
+               'description': fw['description'],
+               'shared': fw['shared'],
+               'admin_state_up': fw['admin_state_up'],
+               'status': fw['status'],
+               'firewall_policy_id': fw['firewall_policy_id']}
+        return self._fields(res, fields)
+
+    def _make_firewall_policy_dict(self, firewall_policy, fields=None):
+        fw_rules = [rule['id'] for rule in firewall_policy['firewall_rules']]
+        firewalls = [fw['id'] for fw in firewall_policy['firewalls']]
+        res = {'id': firewall_policy['id'],
+               'tenant_id': firewall_policy['tenant_id'],
+               'name': firewall_policy['name'],
+               'description': firewall_policy['description'],
+               'shared': firewall_policy['shared'],
+               'audited': firewall_policy['audited'],
+               'firewall_rules': fw_rules,
+               'firewall_list': firewalls}
+        return self._fields(res, fields)
+
+    def _make_firewall_rule_dict(self, firewall_rule, fields=None):
+        position = None
+        # We return the position only if the firewall_rule is bound to a
+        # firewall_policy.
+        if firewall_rule['firewall_policy_id']:
+            position = firewall_rule['position']
+        src_port_range = self._get_port_range_from_min_max_ports(
+            firewall_rule['source_port_range_min'],
+            firewall_rule['source_port_range_max'])
+        dst_port_range = self._get_port_range_from_min_max_ports(
+            firewall_rule['destination_port_range_min'],
+            firewall_rule['destination_port_range_max'])
+        res = {'id': firewall_rule['id'],
+               'tenant_id': firewall_rule['tenant_id'],
+               'name': firewall_rule['name'],
+               'description': firewall_rule['description'],
+               'firewall_policy_id': firewall_rule['firewall_policy_id'],
+               'shared': firewall_rule['shared'],
+               'protocol': firewall_rule['protocol'],
+               'ip_version': firewall_rule['ip_version'],
+               'source_ip_address': firewall_rule['source_ip_address'],
+               'destination_ip_address':
+               firewall_rule['destination_ip_address'],
+               'source_port': src_port_range,
+               'destination_port': dst_port_range,
+               'action': firewall_rule['action'],
+               'position': position,
+               'enabled': firewall_rule['enabled']}
+        return self._fields(res, fields)
+
+    def _set_rules_for_policy(self, context, firewall_policy_db, rule_id_list):
+        fwp_db = firewall_policy_db
+        with context.session.begin(subtransactions=True):
+            if not rule_id_list:
+                fwp_db.firewall_rules = []
+                fwp_db.audited = False
+                return
+            # We will first check if the new list of rules is valid
+            filters = {'id': [r_id for r_id in rule_id_list]}
+            rules_in_db = self._get_collection_query(context, FirewallRule,
+                                                     filters=filters)
+            rules_dict = dict((fwr_db['id'], fwr_db) for fwr_db in rules_in_db)
+            for fwrule_id in rule_id_list:
+                if fwrule_id not in rules_dict:
+                    # If we find an invalid rule in the list we
+                    # do not perform the update since this breaks
+                    # the integrity of this list.
+                    raise firewall.FirewallRuleNotFound(firewall_rule_id=
+                                                        fwrule_id)
+            # New list of rules is valid so we will first reset the existing
+            # list and then add each rule in order.
+            # Note that the list could be empty in which case we interpret
+            # it as clearing existing rules.
+            fwp_db.firewall_rules = []
+            for fwrule_id in rule_id_list:
+                fwp_db.firewall_rules.append(rules_dict[fwrule_id])
+            fwp_db.audited = False
+
+    def _process_rule_for_policy(self, context, firewall_policy_id,
+                                 firewall_rule_db, position):
+        with context.session.begin(subtransactions=True):
+            fwp_query = context.session.query(
+                FirewallPolicy).with_lockmode('update')
+            fwp_db = fwp_query.filter_by(id=firewall_policy_id).one()
+            if position:
+                # Note that although position numbering starts at 1,
+                # internal ordering of the list starts at 0, so we compensate.
+                fwp_db.firewall_rules.insert(position - 1, firewall_rule_db)
+            else:
+                fwp_db.firewall_rules.remove(firewall_rule_db)
+            fwp_db.firewall_rules.reorder()
+            fwp_db.audited = False
+        return self._make_firewall_policy_dict(fwp_db)
+
+    def _get_min_max_ports_from_range(self, port_range):
+        if not port_range:
+            return [None, None]
+        ports = port_range.split(':')
+        ports[0] = int(ports[0])
+        if len(ports) < 2:
+            ports.append(ports[0])
+        else:
+            ports[1] = int(ports[1])
+        return ports
+
+    def _get_port_range_from_min_max_ports(self, min_port, max_port):
+        if not min_port:
+            return None
+        if min_port == max_port:
+            return str(min_port)
+        else:
+            return str(min_port) + ':' + str(max_port)
+
+    def create_firewall(self, context, firewall):
+        LOG.debug(_("create_firewall() called"))
+        fw = firewall['firewall']
+        tenant_id = self._get_tenant_id_for_create(context, fw)
+        with context.session.begin(subtransactions=True):
+            firewall_db = Firewall(id=uuidutils.generate_uuid(),
+                                   tenant_id=tenant_id,
+                                   name=fw['name'],
+                                   description=fw['description'],
+                                   firewall_policy_id=
+                                   fw['firewall_policy_id'],
+                                   admin_state_up=fw['admin_state_up'],
+                                   status=const.PENDING_CREATE)
+            context.session.add(firewall_db)
+        return self._make_firewall_dict(firewall_db)
+
+    def update_firewall(self, context, id, firewall):
+        LOG.debug(_("update_firewall() called"))
+        fw = firewall['firewall']
+        with context.session.begin(subtransactions=True):
+            fw_query = context.session.query(
+                Firewall).with_lockmode('update')
+            firewall_db = fw_query.filter_by(id=id).one()
+            firewall_db.update(fw)
+        return self._make_firewall_dict(firewall_db)
+
+    def delete_firewall(self, context, id):
+        LOG.debug(_("delete_firewall() called"))
+        with context.session.begin(subtransactions=True):
+            fw_query = context.session.query(
+                Firewall).with_lockmode('update')
+            firewall_db = fw_query.filter_by(id=id).one()
+            # Note: Plugin should ensure that it's okay to delete if the
+            # firewall is active
+            context.session.delete(firewall_db)
+
+    def get_firewall(self, context, id, fields=None):
+        LOG.debug(_("get_firewall() called"))
+        fw = self._get_firewall(context, id)
+        return self._make_firewall_dict(fw, fields)
+
+    def get_firewalls(self, context, filters=None, fields=None):
+        LOG.debug(_("get_firewalls() called"))
+        return self._get_collection(context, Firewall,
+                                    self._make_firewall_dict,
+                                    filters=filters, fields=fields)
+
+    def get_firewalls_count(self, context, filters=None):
+        LOG.debug(_("get_firewalls_count() called"))
+        return self._get_collection_count(context, Firewall,
+                                          filters=filters)
+
+    def create_firewall_policy(self, context, firewall_policy):
+        LOG.debug(_("create_firewall_policy() called"))
+        fwp = firewall_policy['firewall_policy']
+        tenant_id = self._get_tenant_id_for_create(context, fwp)
+        with context.session.begin(subtransactions=True):
+            fwp_db = FirewallPolicy(id=uuidutils.generate_uuid(),
+                                    tenant_id=tenant_id,
+                                    name=fwp['name'],
+                                    description=fwp['description'],
+                                    shared=fwp['shared'])
+            context.session.add(fwp_db)
+            self._set_rules_for_policy(context, fwp_db,
+                                       fwp['firewall_rules'])
+            fwp_db.audited = fwp['audited']
+        return self._make_firewall_policy_dict(fwp_db)
+
+    def update_firewall_policy(self, context, id, firewall_policy):
+        LOG.debug(_("update_firewall_policy() called"))
+        fwp = firewall_policy['firewall_policy']
+        with context.session.begin(subtransactions=True):
+            fwp_db = self._get_firewall_policy(context, id)
+            if 'firewall_rules' in fwp:
+                self._set_rules_for_policy(context, fwp_db,
+                                           fwp['firewall_rules'])
+                del fwp['firewall_rules']
+            fwp_db.update(fwp)
+        return self._make_firewall_policy_dict(fwp_db)
+
+    def delete_firewall_policy(self, context, id):
+        LOG.debug(_("delete_firewall_policy() called"))
+        with context.session.begin(subtransactions=True):
+            fwp = self._get_firewall_policy(context, id)
+            # Ensure that the firewall_policy  is not
+            # being used
+            qry = context.session.query(Firewall)
+            if qry.filter_by(firewall_policy_id=id).first():
+                raise firewall.FirewallPolicyInUse(firewall_policy_id=id)
+            else:
+                context.session.delete(fwp)
+
+    def get_firewall_policy(self, context, id, fields=None):
+        LOG.debug(_("get_firewall_policy() called"))
+        fwp = self._get_firewall_policy(context, id)
+        return self._make_firewall_policy_dict(fwp, fields)
+
+    def get_firewall_policies(self, context, filters=None, fields=None):
+        LOG.debug(_("get_firewall_policies() called"))
+        return self._get_collection(context, FirewallPolicy,
+                                    self._make_firewall_policy_dict,
+                                    filters=filters, fields=fields)
+
+    def get_firewalls_policies_count(self, context, filters=None):
+        LOG.debug(_("get_firewall_policies_count() called"))
+        return self._get_collection_count(context, FirewallPolicy,
+                                          filters=filters)
+
+    def create_firewall_rule(self, context, firewall_rule):
+        LOG.debug(_("create_firewall_rule() called"))
+        fwr = firewall_rule['firewall_rule']
+        tenant_id = self._get_tenant_id_for_create(context, fwr)
+        src_port_min, src_port_max = self._get_min_max_ports_from_range(
+            fwr['source_port'])
+        dst_port_min, dst_port_max = self._get_min_max_ports_from_range(
+            fwr['destination_port'])
+        with context.session.begin(subtransactions=True):
+            fwr_db = FirewallRule(id=uuidutils.generate_uuid(),
+                                  tenant_id=tenant_id,
+                                  name=fwr['name'],
+                                  description=fwr['description'],
+                                  shared=fwr['shared'],
+                                  protocol=fwr['protocol'],
+                                  ip_version=fwr['ip_version'],
+                                  source_ip_address=fwr['source_ip_address'],
+                                  destination_ip_address=
+                                  fwr['destination_ip_address'],
+                                  source_port_range_min=src_port_min,
+                                  source_port_range_max=src_port_max,
+                                  destination_port_range_min=dst_port_min,
+                                  destination_port_range_max=dst_port_max,
+                                  action=fwr['action'],
+                                  enabled=fwr['enabled'])
+            context.session.add(fwr_db)
+        return self._make_firewall_rule_dict(fwr_db)
+
+    def update_firewall_rule(self, context, id, firewall_rule):
+        LOG.debug(_("update_firewall_rule() called"))
+        fwr = firewall_rule['firewall_rule']
+        if 'source_port' in fwr:
+            src_port_min, src_port_max = self._get_min_max_ports_from_range(
+                fwr['source_port'])
+            fwr['source_port_range_min'] = src_port_min
+            fwr['source_port_range_max'] = src_port_max
+            del fwr['source_port']
+        if 'destination_port' in fwr:
+            dst_port_min, dst_port_max = self._get_min_max_ports_from_range(
+                fwr['destination_port'])
+            fwr['destination_port_range_min'] = dst_port_min
+            fwr['destination_port_range_max'] = dst_port_max
+            del fwr['destination_port']
+        with context.session.begin(subtransactions=True):
+            fwr_db = self._get_firewall_rule(context, id)
+            fwr_db.update(fwr)
+            if fwr_db.firewall_policy_id:
+                fwp_db = self._get_firewall_policy(context,
+                                                   fwr_db.firewall_policy_id)
+                fwp_db.audited = False
+        return self._make_firewall_rule_dict(fwr_db)
+
+    def delete_firewall_rule(self, context, id):
+        LOG.debug(_("delete_firewall_rule() called"))
+        with context.session.begin(subtransactions=True):
+            fwr = self._get_firewall_rule(context, id)
+            if fwr.firewall_policy_id:
+                raise firewall.FirewallRuleInUse(firewall_rule_id=id)
+            context.session.delete(fwr)
+
+    def get_firewall_rule(self, context, id, fields=None):
+        LOG.debug(_("get_firewall_rule() called"))
+        fwr = self._get_firewall_rule(context, id)
+        return self._make_firewall_rule_dict(fwr, fields)
+
+    def get_firewall_rules(self, context, filters=None, fields=None):
+        LOG.debug(_("get_firewall_rules() called"))
+        return self._get_collection(context, FirewallRule,
+                                    self._make_firewall_rule_dict,
+                                    filters=filters, fields=fields)
+
+    def get_firewalls_rules_count(self, context, filters=None):
+        LOG.debug(_("get_firewall_rules_count() called"))
+        return self._get_collection_count(context, FirewallRule,
+                                          filters=filters)
+
+    def _validate_insert_remove_rule_request(self, id, rule_info):
+        if not rule_info or 'firewall_rule_id' not in rule_info:
+            raise firewall.FirewallRuleInfoMissing()
+
+    def insert_rule(self, context, id, rule_info):
+        LOG.debug(_("insert_rule() called"))
+        self._validate_insert_remove_rule_request(id, rule_info)
+        firewall_rule_id = rule_info['firewall_rule_id']
+        insert_before = True
+        ref_firewall_rule_id = None
+        if not firewall_rule_id:
+            raise firewall.FirewallRuleNotFound(firewall_rule_id=None)
+        if 'insert_before' in rule_info:
+            ref_firewall_rule_id = rule_info['insert_before']
+        if not ref_firewall_rule_id and 'insert_after' in rule_info:
+            # If insert_before is set, we will ignore insert_after.
+            ref_firewall_rule_id = rule_info['insert_after']
+            insert_before = False
+        with context.session.begin(subtransactions=True):
+            fwr_db = self._get_firewall_rule(context, firewall_rule_id)
+            if fwr_db.firewall_policy_id:
+                raise firewall.FirewallRuleInUse(firewall_rule_id=fwr_db['id'])
+            if ref_firewall_rule_id:
+                # If reference_firewall_rule_id is set, the new rule
+                # is inserted depending on the value of insert_before.
+                # If insert_before is set, the new rule is inserted before
+                # reference_firewall_rule_id, and if it is not set the new
+                # rule is inserted after reference_firewall_rule_id.
+                ref_fwr_db = self._get_firewall_rule(
+                    context, ref_firewall_rule_id)
+                if insert_before:
+                    position = ref_fwr_db.position
+                else:
+                    position = ref_fwr_db.position + 1
+            else:
+                # If reference_firewall_rule_id is not set, it is assumed
+                # that the new rule needs to be inserted at the top.
+                # insert_before field is ignored.
+                # So default insertion is always at the top.
+                # Also note that position numbering starts at 1.
+                position = 1
+            return self._process_rule_for_policy(context, id, fwr_db,
+                                                 position)
+
+    def remove_rule(self, context, id, rule_info):
+        LOG.debug(_("remove_rule() called"))
+        self._validate_insert_remove_rule_request(id, rule_info)
+        firewall_rule_id = rule_info['firewall_rule_id']
+        if not firewall_rule_id:
+            raise firewall.FirewallRuleNotFound(firewall_rule_id=None)
+        with context.session.begin(subtransactions=True):
+            fwr_db = self._get_firewall_rule(context, firewall_rule_id)
+            if fwr_db.firewall_policy_id != id:
+                raise firewall.FirewallRuleNotAssociatedWithPolicy(
+                    firewall_rule_id=fwr_db['id'],
+                    firewall_policy_id=id)
+            return self._process_rule_for_policy(context, id, fwr_db, None)

neutron/db/migration/alembic_migrations/versions/39cf3f799352_fwaas_havana_2_model.py

@@ -0,0 +1,105 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 OpenStack Foundation
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+
+"""FWaaS Havana-2 model
+
+Revision ID: 39cf3f799352
+Revises: e6b16a30d97
+Create Date: 2013-07-10 16:16:51.302943
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = '39cf3f799352'
+down_revision = 'e6b16a30d97'
+
+# Change to ['*'] if this migration applies to all plugins
+
+migration_for_plugins = ['*']
+
+from alembic import op
+import sqlalchemy as sa
+
+from neutron.db import migration
+
+
+def downgrade(active_plugin=None, options=None):
+    if not migration.should_run(active_plugin, migration_for_plugins):
+        return
+
+    op.drop_table('firewall_rules')
+    op.drop_table('firewalls')
+    op.drop_table('firewall_policies')
+
+
+def upgrade(active_plugin=None, options=None):
+    if not migration.should_run(active_plugin, migration_for_plugins):
+        return
+
+    op.create_table(
+        'firewall_policies',
+        sa.Column('tenant_id', sa.String(length=255), nullable=True),
+        sa.Column('id', sa.String(length=36), nullable=False),
+        sa.Column('name', sa.String(length=255), nullable=True),
+        sa.Column('description', sa.String(length=1024), nullable=True),
+        sa.Column('shared', sa.Boolean(), autoincrement=False, nullable=True),
+        sa.Column('audited', sa.Boolean(), autoincrement=False,
+                  nullable=True),
+        sa.PrimaryKeyConstraint('id'))
+    op.create_table(
+        'firewalls', sa.Column('tenant_id', sa.String(length=255),
+                               nullable=True),
+        sa.Column('id', sa.String(length=36), nullable=False),
+        sa.Column('name', sa.String(length=255), nullable=True),
+        sa.Column('description', sa.String(length=1024), nullable=True),
+        sa.Column('shared', sa.Boolean(), autoincrement=False, nullable=True),
+        sa.Column('admin_state_up', sa.Boolean(), autoincrement=False,
+                  nullable=True),
+        sa.Column('status', sa.String(length=16), nullable=True),
+        sa.Column('firewall_policy_id', sa.String(length=36), nullable=True),
+        sa.ForeignKeyConstraint(['firewall_policy_id'],
+                                ['firewall_policies.id'],
+                                name='firewalls_ibfk_1'),
+        sa.PrimaryKeyConstraint('id'))
+    op.create_table(
+        'firewall_rules',
+        sa.Column('tenant_id', sa.String(length=255), nullable=True),
+        sa.Column('id', sa.String(length=36), nullable=False),
+        sa.Column('name', sa.String(length=255), nullable=True),
+        sa.Column('description', sa.String(length=1024), nullable=True),
+        sa.Column('firewall_policy_id', sa.String(length=36), nullable=True),
+        sa.Column('shared', sa.Boolean(), autoincrement=False,
+                  nullable=True),
+        sa.Column('protocol', sa.String(length=24), nullable=True),
+        sa.Column('ip_version', sa.Integer(), autoincrement=False,
+                  nullable=False),
+        sa.Column('source_ip_address', sa.String(length=46), nullable=True),
+        sa.Column('destination_ip_address', sa.String(length=46),
+                  nullable=True),
+        sa.Column('source_port_range_min', sa.Integer(), nullable=True),
+        sa.Column('source_port_range_max', sa.Integer(), nullable=True),
+        sa.Column('destination_port_range_min', sa.Integer(), nullable=True),
+        sa.Column('destination_port_range_max', sa.Integer(), nullable=True),
+        sa.Column('action', sa.Enum(), nullable=True),
+        sa.Column('enabled', sa.Boolean(), autoincrement=False,
+                  nullable=True),
+        sa.Column('position', sa.Integer(), autoincrement=False,
+                  nullable=True),
+        sa.ForeignKeyConstraint(['firewall_policy_id'],
+                                ['firewall_policies.id'],
+                                name='firewall_rules_ibfk_1'),
+        sa.PrimaryKeyConstraint('id'))

neutron/extensions/firewall.py

@@ -0,0 +1,448 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 Big Switch Networks, Inc.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# @author: Sumit Naiksatam, sumitnaiksatam@gmail.com, Big Switch Networks, Inc.
+
+import abc
+
+from oslo.config import cfg
+
+from neutron.api import extensions
+from neutron.api.v2 import attributes as attr
+from neutron.api.v2 import base
+from neutron.common import exceptions as qexception
+from neutron import manager
+from neutron.openstack.common import log as logging
+from neutron.plugins.common import constants
+from neutron.services.service_base import ServicePluginBase
+
+
+LOG = logging.getLogger(__name__)
+
+
+# Firewall Exceptions
+class FirewallNotFound(qexception.NotFound):
+    message = _("Firewall %(firewall_id)s could not be found.")
+
+
+class FirewallInUse(qexception.InUse):
+    message = _("Firewall %(firewall_id)s is still active.")
+
+
+class FirewallInPendingState(qexception.Conflict):
+    message = _("Operation cannot be performed since associated Firewall "
+                "%(firewall_id)s is in %(pending_state)s.")
+
+
+class FirewallPolicyNotFound(qexception.NotFound):
+    message = _("Firewall Policy %(firewall_policy_id)s could not be found.")
+
+
+class FirewallPolicyInUse(qexception.InUse):
+    message = _("Firewall Policy %(firewall_policy_id)s is being used.")
+
+
+class FirewallRuleNotFound(qexception.NotFound):
+    message = _("Firewall Rule %(firewall_rule_id)s could not be found.")
+
+
+class FirewallRuleInUse(qexception.InUse):
+    message = _("Firewall Rule %(firewall_rule_id)s is being used.")
+
+
+class FirewallRuleNotAssociatedWithPolicy(qexception.InvalidInput):
+    message = _("Firewall Rule %(firewall_rule_id)s is not associated "
+                " with Firewall Policy %(firewall_policy_id)s.")
+
+
+class FirewallRuleInvalidProtocol(qexception.InvalidInput):
+    message = _("Firewall Rule protocol %(protocol)s is not supported. "
+                "Only protocol values %(values)s and their integer "
+                "representation (0 to 255) are supported.")
+
+
+class FirewallRuleInvalidAction(qexception.InvalidInput):
+    message = _("Firewall rule action %(action)s is not supported. "
+                "Only action values %(values)s are supported.")
+
+
+class FirewallInvalidPortValue(qexception.InvalidInput):
+    message = _("Invalid value for port %(port)s.")
+
+
+class FirewallRuleInfoMissing(qexception.InvalidInput):
+    message = _("Missing rule info argument for insert/remove "
+                "rule opertaion.")
+
+
+fw_valid_protocol_values = [None, constants.TCP, constants.UDP, constants.ICMP]
+fw_valid_action_values = [constants.FWAAS_ALLOW, constants.FWAAS_DENY]
+
+
+def convert_protocol(value):
+    if value is None:
+        return
+    if value.isdigit():
+        val = int(value)
+        if 0 <= val <= 255:
+            return val
+        else:
+            raise FirewallRuleInvalidProtocol(protocol=value,
+                                              values=
+                                              fw_valid_protocol_values)
+    elif value.lower() in fw_valid_protocol_values:
+        return value.lower()
+    else:
+        raise FirewallRuleInvalidProtocol(protocol=value,
+                                          values=
+                                          fw_valid_protocol_values)
+
+
+def convert_action_to_case_insensitive(value):
+    if value is None:
+        return
+    else:
+        return value.lower()
+
+
+def convert_port_to_string(value):
+    if value is None:
+        return
+    else:
+        return str(value)
+
+
+def _validate_port_range(data, key_specs=None):
+    if data is None:
+        return
+    data = str(data)
+    ports = data.split(':')
+    for p in ports:
+        try:
+            val = int(p)
+        except (ValueError, TypeError):
+            msg = _("Port '%s' is not a valid number") % p
+            LOG.debug(msg)
+            return msg
+        if val <= 0 or val > 65535:
+            msg = _("Invalid port '%s'") % p
+            LOG.debug(msg)
+            return msg
+
+
+def _validate_ip_or_subnet_or_none(data, valid_values=None):
+    if data is None:
+        return None
+    msg_ip = attr._validate_ip_address(data, valid_values)
+    if not msg_ip:
+        return
+    msg_subnet = attr._validate_subnet(data, valid_values)
+    if not msg_subnet:
+        return
+    return _("%(msg_ip)s and %(msg_subnet)s") % {'msg_ip': msg_ip,
+                                                 'msg_subnet': msg_subnet}
+
+
+attr.validators['type:port_range'] = _validate_port_range
+attr.validators['type:ip_or_subnet_or_none'] = _validate_ip_or_subnet_or_none
+
+
+RESOURCE_ATTRIBUTE_MAP = {
+    'firewall_rules': {
+        'id': {'allow_post': False, 'allow_put': False,
+               'validate': {'type:uuid': None},
+               'is_visible': True, 'primary_key': True},
+        'tenant_id': {'allow_post': True, 'allow_put': False,
+                      'required_by_policy': True,
+                      'is_visible': True},
+        'name': {'allow_post': True, 'allow_put': True,
+                 'validate': {'type:string': None},
+                 'is_visible': True, 'default': ''},
+        'description': {'allow_post': True, 'allow_put': True,
+                        'validate': {'type:string': None},
+                        'is_visible': True, 'default': ''},
+        'firewall_policy_id': {'allow_post': False, 'allow_put': False,
+                               'validate': {'type:uuid_or_none': None},
+                               'is_visible': True},
+        'shared': {'allow_post': True, 'allow_put': True,
+                   'default': False, 'convert_to': attr.convert_to_boolean,
+                   'is_visible': True, 'required_by_policy': True,
+                   'enforce_policy': True},
+        'protocol': {'allow_post': True, 'allow_put': True,
+                     'is_visible': True, 'default': None,
+                     'convert_to': convert_protocol,
+                     'validate': {'type:values': fw_valid_protocol_values}},
+        'ip_version': {'allow_post': True, 'allow_put': True,
+                       'default': 4, 'convert_to': attr.convert_to_int,
+                       'validate': {'type:values': [4, 6]},
+                       'is_visible': True},
+        'source_ip_address': {'allow_post': True, 'allow_put': True,
+                              'validate': {'type:ip_or_subnet_or_none': None},
+                              'is_visible': True, 'default': None},
+        'destination_ip_address': {'allow_post': True, 'allow_put': True,
+                                   'validate': {'type:ip_or_subnet_or_none':
+                                                None},
+                                   'is_visible': True, 'default': None},
+        'source_port': {'allow_post': True, 'allow_put': True,
+                        'validate': {'type:port_range': None},
+                        'convert_to': convert_port_to_string,
+                        'default': None, 'is_visible': True},
+        'destination_port': {'allow_post': True, 'allow_put': True,
+                             'validate': {'type:port_range': None},
+                             'convert_to': convert_port_to_string,
+                             'default': None, 'is_visible': True},
+        'position': {'allow_post': False, 'allow_put': False,
+                     'default': None, 'is_visible': True},
+        'action': {'allow_post': True, 'allow_put': True,
+                   'convert_to': convert_action_to_case_insensitive,
+                   'validate': {'type:values': fw_valid_action_values},
+                   'is_visible': True, 'default': 'deny'},
+        'enabled': {'allow_post': True, 'allow_put': True,
+                    'default': True, 'convert_to': attr.convert_to_boolean,
+                    'is_visible': True},
+    },
+    'firewall_policies': {
+        'id': {'allow_post': False, 'allow_put': False,
+               'validate': {'type:uuid': None},
+               'is_visible': True,
+               'primary_key': True},
+        'tenant_id': {'allow_post': True, 'allow_put': False,
+                      'required_by_policy': True,
+                      'is_visible': True},
+        'name': {'allow_post': True, 'allow_put': True,
+                 'validate': {'type:string': None},
+                 'is_visible': True, 'default': ''},
+        'description': {'allow_post': True, 'allow_put': True,
+                        'validate': {'type:string': None},
+                        'is_visible': True, 'default': ''},
+        'shared': {'allow_post': True, 'allow_put': True,
+                   'default': False, 'convert_to': attr.convert_to_boolean,
+                   'is_visible': True, 'required_by_policy': True,
+                   'enforce_policy': True},
+        'firewall_rules': {'allow_post': True, 'allow_put': True,
+                           'convert_to': attr.convert_none_to_empty_list,
+                           'default': None, 'is_visible': True},
+        'audited': {'allow_post': True, 'allow_put': True,
+                    'default': False, 'convert_to': attr.convert_to_boolean,
+                    'is_visible': True},
+    },
+    'firewalls': {
+        'id': {'allow_post': False, 'allow_put': False,
+               'validate': {'type:uuid': None},
+               'is_visible': True,
+               'primary_key': True},
+        'tenant_id': {'allow_post': True, 'allow_put': False,
+                      'required_by_policy': True,
+                      'is_visible': True},
+        'name': {'allow_post': True, 'allow_put': True,
+                 'validate': {'type:string': None},
+                 'is_visible': True, 'default': ''},
+        'description': {'allow_post': True, 'allow_put': True,
+                        'validate': {'type:string': None},
+                        'is_visible': True, 'default': ''},
+        'admin_state_up': {'allow_post': True, 'allow_put': True,
+                           'default': True,
+                           'convert_to': attr.convert_to_boolean,
+                           'is_visible': True},
+        'status': {'allow_post': False, 'allow_put': False,
+                   'is_visible': True},
+        'shared': {'allow_post': True, 'allow_put': True,
+                   'default': False, 'convert_to': attr.convert_to_boolean,
+                   'is_visible': False, 'required_by_policy': True,
+                   'enforce_policy': True},
+        'firewall_policy_id': {'allow_post': True, 'allow_put': True,
+                               'validate': {'type:uuid_or_none': None},
+                               'is_visible': True},
+    },
+}
+
+firewall_quota_opts = [
+    cfg.IntOpt('quota_firewall',
+               default=1,
+               help=_('Number of firewalls allowed per tenant, -1 for '
+                      'unlimited')),
+    cfg.IntOpt('quota_firewall_policy',
+               default=1,
+               help=_('Number of firewall policies allowed per tenant, -1 '
+                      'for unlimited')),
+    cfg.IntOpt('quota_firewall_rule',
+               default=-1,
+               help=_('Number of firewall rules allowed per tenant, -1 '
+                      'for unlimited')),
+]
+cfg.CONF.register_opts(firewall_quota_opts, 'QUOTAS')
+
+
+class Firewall(extensions.ExtensionDescriptor):
+
+    @classmethod
+    def get_name(cls):
+        return "Firewall service"
+
+    @classmethod
+    def get_alias(cls):
+        return "fwaas"
+
+    @classmethod
+    def get_description(cls):
+        return "Extension for Firewall service"
+
+    @classmethod
+    def get_namespace(cls):
+        return "http://wiki.openstack.org/Neutron/FWaaS/API_1.0"
+
+    @classmethod
+    def get_updated(cls):
+        return "2013-02-25T10:00:00-00:00"
+
+    @classmethod
+    def get_resources(cls):
+        my_plurals = []
+        for plural in RESOURCE_ATTRIBUTE_MAP:
+            if plural == 'firewall_policies':
+                singular = 'firewall_policy'
+            else:
+                singular = plural[:-1]
+            my_plurals.append((plural, singular))
+        attr.PLURALS.update(dict(my_plurals))
+        resources = []
+        plugin = manager.NeutronManager.get_service_plugins()[
+            constants.FIREWALL]
+        for collection_name in RESOURCE_ATTRIBUTE_MAP:
+            # Special handling needed for resources with 'y' ending
+            if collection_name == 'firewall_policies':
+                resource_name = 'firewall_policy'
+            else:
+                resource_name = collection_name[:-1]
+
+            params = RESOURCE_ATTRIBUTE_MAP[collection_name]
+
+            member_actions = {}
+            if resource_name == 'firewall_policy':
+                member_actions = {'insert_rule': 'PUT',
+                                  'remove_rule': 'PUT'}
+
+            controller = base.create_resource(
+                collection_name, resource_name, plugin, params,
+                member_actions=member_actions,
+                allow_pagination=cfg.CONF.allow_pagination,
+                allow_sorting=cfg.CONF.allow_sorting)
+
+            resource = extensions.ResourceExtension(
+                collection_name,
+                controller,
+                path_prefix=constants.COMMON_PREFIXES[constants.FIREWALL],
+                member_actions=member_actions,
+                attr_map=params)
+            resources.append(resource)
+
+        return resources
+
+    @classmethod
+    def get_plugin_interface(cls):
+        return FirewallPluginBase
+
+    def update_attributes_map(self, attributes):
+        super(Firewall, self).update_attributes_map(
+            attributes, extension_attrs_map=RESOURCE_ATTRIBUTE_MAP)
+
+    def get_extended_resources(self, version):
+        if version == "2.0":
+            return RESOURCE_ATTRIBUTE_MAP
+        else:
+            return {}
+
+
+class FirewallPluginBase(ServicePluginBase):
+    __metaclass__ = abc.ABCMeta
+
+    def get_plugin_name(self):
+        return constants.FIREWALL
+
+    def get_plugin_type(self):
+        return constants.FIREWALL
+
+    def get_plugin_description(self):
+        return 'Firewall service plugin'
+
+    @abc.abstractmethod
+    def get_firewalls(self, context, filters=None, fields=None):
+        pass
+
+    @abc.abstractmethod
+    def get_firewall(self, context, id, fields=None):
+        pass
+
+    @abc.abstractmethod
+    def create_firewall(self, context, firewall):
+        pass
+
+    @abc.abstractmethod
+    def update_firewall(self, context, id, firewall):
+        pass
+
+    @abc.abstractmethod
+    def delete_firewall(self, context, id):
+        pass
+
+    @abc.abstractmethod
+    def get_firewall_rules(self, context, filters=None, fields=None):
+        pass
+
+    @abc.abstractmethod
+    def get_firewall_rule(self, context, id, fields=None):
+        pass
+
+    @abc.abstractmethod
+    def create_firewall_rule(self, context, firewall_rule):
+        pass
+
+    @abc.abstractmethod
+    def update_firewall_rule(self, context, id, firewall_rule):
+        pass
+
+    @abc.abstractmethod
+    def delete_firewall_rule(self, context, id):
+        pass
+
+    @abc.abstractmethod
+    def get_firewall_policy(self, context, id, fields=None):
+        pass
+
+    @abc.abstractmethod
+    def get_firewall_policies(self, context, filters=None, fields=None):
+        pass
+
+    @abc.abstractmethod
+    def create_firewall_policy(self, context, firewall_policy):
+        pass
+
+    @abc.abstractmethod
+    def update_firewall_policy(self, context, id, firewall_policy):
+        pass
+
+    @abc.abstractmethod
+    def delete_firewall_policy(self, context, id):
+        pass
+
+    @abc.abstractmethod
+    def insert_rule(self, context, id, rule_info):
+        pass
+
+    @abc.abstractmethod
+    def remove_rule(self, context, id, rule_info):
+        pass

neutron/plugins/common/constants.py

@@ -19,20 +19,23 @@
 CORE = "CORE"
 DUMMY = "DUMMY"
 LOADBALANCER = "LOADBALANCER"
+FIREWALL = "FIREWALL"
 
 #maps extension alias to service type
 EXT_TO_SERVICE_MAPPING = {
     'dummy': DUMMY,
-    'lbaas': LOADBALANCER
+    'lbaas': LOADBALANCER,
+    'fwaas': FIREWALL
 }
 
 # TODO(salvatore-orlando): Move these (or derive them) from conf file
-ALLOWED_SERVICES = [CORE, DUMMY, LOADBALANCER]
+ALLOWED_SERVICES = [CORE, DUMMY, LOADBALANCER, FIREWALL]
 
 COMMON_PREFIXES = {
     CORE: "",
     DUMMY: "/dummy_svc",
     LOADBALANCER: "/lb",
+    FIREWALL: "/fw",
 }
 
 # Service operation status constants
@@ -42,3 +45,12 @@ PENDING_UPDATE = "PENDING_UPDATE"
 PENDING_DELETE = "PENDING_DELETE"
 INACTIVE = "INACTIVE"
 ERROR = "ERROR"
+
+# FWaaS firewall rule action
+FWAAS_ALLOW = "allow"
+FWAAS_DENY = "deny"
+
+# L3 Protocol name constants
+TCP = "tcp"
+UDP = "udp"
+ICMP = "icmp"

neutron/services/firewall/__init__.py

@@ -0,0 +1,16 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2013 OpenStack Foundation.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.

neutron/services/firewall/fwaas_plugin.py

@@ -0,0 +1,285 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 Big Switch Networks, Inc.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# @author: Sumit Naiksatam, sumitnaiksatam@gmail.com, Big Switch Networks, Inc.
+
+from oslo.config import cfg
+
+from neutron.common import rpc as q_rpc
+from neutron.common import topics
+from neutron.db import api as qdbapi
+from neutron.db.firewall import firewall_db
+from neutron.extensions import firewall as fw_ext
+from neutron.openstack.common import log as logging
+from neutron.openstack.common import rpc
+from neutron.openstack.common.rpc import proxy
+from neutron.plugins.common import constants as const
+
+
+LOG = logging.getLogger(__name__)
+
+
+class FirewallCallbacks(object):
+    RPC_API_VERSION = '1.0'
+
+    def __init__(self, plugin):
+        self.plugin = plugin
+
+    def create_rpc_dispatcher(self):
+        return q_rpc.PluginRpcDispatcher([self])
+
+    def set_firewall_status(self, context, firewall_id, status, **kwargs):
+        """Agent uses this to set a firewall's status."""
+        LOG.debug(_("set_firewall_status() called"))
+        with context.session.begin(subtransactions=True):
+            fw_db = self.plugin._get_firewall(context, firewall_id)
+            if status in (const.ACTIVE, const.INACTIVE):
+                fw_db.status = status
+                return True
+            else:
+                fw_db.status = const.ERROR
+                return False
+
+    def firewall_deleted(self, context, firewall_id, **kwargs):
+        """Agent uses this to indicate firewall is deleted."""
+        LOG.debug(_("firewall_deleted() called"))
+        with context.session.begin(subtransactions=True):
+            fw_db = self.plugin._get_firewall(context, firewall_id)
+            if fw_db.status == const.PENDING_DELETE:
+                self.plugin.delete_db_firewall_object(context, firewall_id)
+                return True
+            else:
+                fw_db.status = const.ERROR
+                LOG.warn(_('Firewall %s unexpectedly deleted by agent.'),
+                         firewall_id)
+                return False
+
+    def get_firewalls_for_tenant(self, context, **kwargs):
+        """Agent uses this to get all firewalls and rules for a tenant."""
+        LOG.debug(_("get_firewalls_for_tenant() called"))
+        fw_list = [
+            self.plugin._make_firewall_dict_with_rules(context, fw['id'])
+            for fw in self.plugin.get_firewalls(context)
+        ]
+        return fw_list
+
+    def get_firewalls_for_tenant_without_rules(self, context, **kwargs):
+        """Agent uses this to get all firewalls for a tenant."""
+        LOG.debug(_("get_firewalls_for_tenant_without_rules() called"))
+        fw_list = [fw for fw in self.plugin.get_firewalls(context)]
+        return fw_list
+
+
+class FirewallAgentApi(proxy.RpcProxy):
+    """Plugin side of plugin to agent RPC API."""
+
+    API_VERSION = '1.0'
+
+    def __init__(self, topic, host):
+        super(FirewallAgentApi, self).__init__(topic, self.API_VERSION)
+        self.host = host
+
+    def create_firewall(self, context, firewall):
+        return self.fanout_cast(
+            context,
+            self.make_msg('create_firewall', firewall=firewall,
+                          host=self.host),
+            topic=self.topic
+        )
+
+    def update_firewall(self, context, firewall):
+        return self.fanout_cast(
+            context,
+            self.make_msg('update_firewall', firewall=firewall,
+                          host=self.host),
+            topic=self.topic
+        )
+
+    def delete_firewall(self, context, firewall):
+        return self.fanout_cast(
+            context,
+            self.make_msg('delete_firewall', firewall=firewall,
+                          host=self.host),
+            topic=self.topic
+        )
+
+
+class FirewallPlugin(firewall_db.Firewall_db_mixin):
+
+    """Implementation of the Neutron Firewall Service Plugin.
+
+    This class manages the workflow of FWaaS request/response.
+    Most DB related works are implemented in class
+    firewall_db.Firewall_db_mixin.
+    """
+    supported_extension_aliases = ["fwaas"]
+
+    def __init__(self):
+        """Do the initialization for the firewall service plugin here."""
+        qdbapi.register_models()
+
+        self.callbacks = FirewallCallbacks(self)
+
+        self.conn = rpc.create_connection(new=True)
+        self.conn.create_consumer(
+            topics.FIREWALL_PLUGIN,
+            self.callbacks.create_rpc_dispatcher(),
+            fanout=False)
+        self.conn.consume_in_thread()
+
+        self.agent_rpc = FirewallAgentApi(
+            topics.L3_AGENT,
+            cfg.CONF.host
+        )
+
+    def _make_firewall_dict_with_rules(self, context, firewall_id):
+        firewall = self.get_firewall(context, firewall_id)
+        fw_policy_id = firewall['firewall_policy_id']
+        if fw_policy_id:
+            fw_policy = self.get_firewall_policy(context, fw_policy_id)
+            fw_rules_list = [self.get_firewall_rule(
+                context, rule_id) for rule_id in fw_policy['firewall_rules']]
+            firewall['firewall_rule_list'] = fw_rules_list
+        else:
+            firewall['firewall_rule_list'] = []
+        # FIXME(Sumit): If the size of the firewall object we are creating
+        # here exceeds the largest message size supported by rabbit/qpid
+        # then we will have a problem.
+        return firewall
+
+    def _rpc_update_firewall(self, context, firewall_id):
+        status_update = {"firewall": {"status": const.PENDING_UPDATE}}
+        fw = super(FirewallPlugin, self).update_firewall(context, firewall_id,
+                                                         status_update)
+        if fw:
+            fw_with_rules = (
+                self._make_firewall_dict_with_rules(context,
+                                                    firewall_id))
+            self.agent_rpc.update_firewall(context, fw_with_rules)
+
+    def _rpc_update_firewall_policy(self, context, firewall_policy_id):
+        firewall_policy = self.get_firewall_policy(context, firewall_policy_id)
+        if firewall_policy:
+            for firewall_id in firewall_policy['firewall_list']:
+                self._rpc_update_firewall(context, firewall_id)
+
+    def _ensure_update_firewall(self, context, firewall_id):
+        fwall = self.get_firewall(context, firewall_id)
+        if fwall['status'] in [const.PENDING_CREATE,
+                               const.PENDING_UPDATE,
+                               const.PENDING_DELETE]:
+            raise fw_ext.FirewallInPendingState(firewall_id=firewall_id,
+                                                pending_state=fwall['status'])
+
+    def _ensure_update_firewall_policy(self, context, firewall_policy_id):
+        firewall_policy = self.get_firewall_policy(context, firewall_policy_id)
+        if firewall_policy and 'firewall_list' in firewall_policy:
+            for firewall_id in firewall_policy['firewall_list']:
+                self._ensure_update_firewall(context, firewall_id)
+
+    def _ensure_update_or_delete_firewall_rule(self, context,
+                                               firewall_rule_id):
+        fw_rule = self.get_firewall_rule(context, firewall_rule_id)
+        if 'firewall_policy_id' in fw_rule and fw_rule['firewall_policy_id']:
+            self._ensure_update_firewall_policy(context,
+                                                fw_rule['firewall_policy_id'])
+
+    def create_firewall(self, context, firewall):
+        LOG.debug(_("create_firewall() called"))
+        firewall['firewall']['status'] = const.PENDING_CREATE
+        fw = super(FirewallPlugin, self).create_firewall(context, firewall)
+        fw_with_rules = (
+            self._make_firewall_dict_with_rules(context, fw['id']))
+        self.agent_rpc.create_firewall(context, fw_with_rules)
+        return fw
+
+    def update_firewall(self, context, id, firewall):
+        LOG.debug(_("update_firewall() called"))
+        self._ensure_update_firewall(context, id)
+        firewall['firewall']['status'] = const.PENDING_UPDATE
+        fw = super(FirewallPlugin, self).update_firewall(context, id, firewall)
+        fw_with_rules = (
+            self._make_firewall_dict_with_rules(context, fw['id']))
+        self.agent_rpc.update_firewall(context, fw_with_rules)
+        return fw
+
+    def delete_db_firewall_object(self, context, id):
+        firewall = self.get_firewall(context, id)
+        if firewall['status'] in [const.PENDING_DELETE]:
+            super(FirewallPlugin, self).delete_firewall(context, id)
+
+    def delete_firewall(self, context, id):
+        LOG.debug(_("delete_firewall() called"))
+        status_update = {"firewall": {"status": const.PENDING_DELETE}}
+        fw = super(FirewallPlugin, self).update_firewall(context, id,
+                                                         status_update)
+        fw_with_rules = (
+            self._make_firewall_dict_with_rules(context, fw['id']))
+        self.agent_rpc.delete_firewall(context, fw_with_rules)
+
+    def update_firewall_policy(self, context, id, firewall_policy):
+        LOG.debug(_("update_firewall_policy() called"))
+        self._ensure_update_firewall_policy(context, id)
+        fwp = super(FirewallPlugin,
+                    self).update_firewall_policy(context, id, firewall_policy)
+        self._rpc_update_firewall_policy(context, id)
+        return fwp
+
+    def update_firewall_rule(self, context, id, firewall_rule):
+        LOG.debug(_("update_firewall_rule() called"))
+        self._ensure_update_or_delete_firewall_rule(context, id)
+        fwr = super(FirewallPlugin,
+                    self).update_firewall_rule(context, id, firewall_rule)
+        firewall_policy_id = fwr['firewall_policy_id']
+        if firewall_policy_id:
+            self._rpc_update_firewall_policy(context, firewall_policy_id)
+        return fwr
+
+    def delete_firewall_rule(self, context, id):
+        LOG.debug(_("delete_firewall_rule() called"))
+        self._ensure_update_or_delete_firewall_rule(context, id)
+        fwr = self.get_firewall_rule(context, id)
+        firewall_policy_id = fwr['firewall_policy_id']
+        super(FirewallPlugin, self).delete_firewall_rule(context, id)
+        # At this point we have already deleted the rule in the DB,
+        # however it's still not deleted on the backend firewall.
+        # Until it gets deleted on the backend we will be setting
+        # the firewall in PENDING_UPDATE state. The backend firewall
+        # implementation is responsible for setting the appropriate
+        # configuration (e.g. do not allow any traffic) until the rule
+        # is deleted. Once the rule is deleted, the backend should put
+        # the firewall back in ACTIVE state. While the firewall is in
+        # PENDING_UPDATE state, the firewall behavior might differ based
+        # on the backend implementation.
+        if firewall_policy_id:
+            self._rpc_update_firewall_policy(context, firewall_policy_id)
+
+    def insert_rule(self, context, id, rule_info):
+        LOG.debug(_("insert_rule() called"))
+        self._ensure_update_firewall_policy(context, id)
+        fwp = super(FirewallPlugin,
+                    self).insert_rule(context, id, rule_info)
+        self._rpc_update_firewall_policy(context, id)
+        return fwp
+
+    def remove_rule(self, context, id, rule_info):
+        LOG.debug(_("remove_rule() called"))
+        self._ensure_update_firewall_policy(context, id)
+        fwp = super(FirewallPlugin,
+                    self).remove_rule(context, id, rule_info)
+        self._rpc_update_firewall_policy(context, id)
+        return fwp

neutron/tests/unit/db/firewall/__init__.py

@@ -0,0 +1,15 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2013 OpenStack Foundation
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.

neutron/tests/unit/db/firewall/test_db_firewall.py

@@ -0,0 +1,965 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 Big Switch Networks, Inc.
+# All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the spec
+#
+# @author: Sumit Naiksatam, sumitnaiksatam@gmail.com, Big Switch Networks, Inc.
+
+import contextlib
+import logging
+
+import webob.exc
+
+from neutron.api import extensions as api_ext
+from neutron.common import config
+from neutron import context
+from neutron.db.firewall import firewall_db as fdb
+import neutron.extensions
+from neutron.extensions import firewall
+from neutron.openstack.common import importutils
+from neutron.plugins.common import constants
+from neutron.tests.unit import test_db_plugin
+
+
+LOG = logging.getLogger(__name__)
+DB_FW_PLUGIN_KLASS = (
+    "neutron.db.firewall.firewall_db.Firewall_db_mixin"
+)
+extensions_path = ':'.join(neutron.extensions.__path__)
+DESCRIPTION = 'default description'
+SHARED = True
+PROTOCOL = 'tcp'
+IP_VERSION = 4
+SOURCE_IP_ADDRESS_RAW = '1.1.1.1'
+DESTINATION_IP_ADDRESS_RAW = '2.2.2.2'
+SOURCE_PORT = '55000:56000'
+DESTINATION_PORT = '56000:57000'
+ACTION = 'allow'
+AUDITED = True
+ENABLED = True
+ADMIN_STATE_UP = True
+
+
+class FirewallPluginDbTestCase(test_db_plugin.NeutronDbPluginV2TestCase):
+    resource_prefix_map = dict(
+        (k, constants.COMMON_PREFIXES[constants.FIREWALL])
+        for k in firewall.RESOURCE_ATTRIBUTE_MAP.keys()
+    )
+
+    def setUp(self, core_plugin=None, fw_plugin=None):
+        if not fw_plugin:
+            fw_plugin = DB_FW_PLUGIN_KLASS
+        service_plugins = {'fw_plugin_name': fw_plugin}
+
+        fdb.Firewall_db_mixin.supported_extension_aliases = ["fwaas"]
+        super(FirewallPluginDbTestCase, self).setUp(
+            service_plugins=service_plugins
+        )
+
+        self.plugin = importutils.import_object(fw_plugin)
+        ext_mgr = api_ext.PluginAwareExtensionManager(
+            extensions_path,
+            {constants.FIREWALL: self.plugin}
+        )
+        app = config.load_paste_app('extensions_test_app')
+        self.ext_api = api_ext.ExtensionMiddleware(app, ext_mgr=ext_mgr)
+
+    def _test_list_resources(self, resource, items,
+                             neutron_context=None,
+                             query_params=None):
+        if resource.endswith('y'):
+            resource_plural = resource.replace('y', 'ies')
+        else:
+            resource_plural = resource + 's'
+
+        res = self._list(resource_plural,
+                         neutron_context=neutron_context,
+                         query_params=query_params)
+        resource = resource.replace('-', '_')
+        self.assertEqual(sorted([i['id'] for i in res[resource_plural]]),
+                         sorted([i[resource]['id'] for i in items]))
+
+    def _get_test_firewall_rule_attrs(self, name='firewall_rule1'):
+        attrs = {'name': name,
+                 'tenant_id': self._tenant_id,
+                 'shared': SHARED,
+                 'protocol': PROTOCOL,
+                 'ip_version': IP_VERSION,
+                 'source_ip_address': SOURCE_IP_ADDRESS_RAW,
+                 'destination_ip_address': DESTINATION_IP_ADDRESS_RAW,
+                 'source_port': SOURCE_PORT,
+                 'destination_port': DESTINATION_PORT,
+                 'action': ACTION,
+                 'enabled': ENABLED}
+        return attrs
+
+    def _get_test_firewall_policy_attrs(self, name='firewall_policy1'):
+        attrs = {'name': name,
+                 'description': DESCRIPTION,
+                 'tenant_id': self._tenant_id,
+                 'shared': SHARED,
+                 'firewall_rules': [],
+                 'audited': AUDITED}
+        return attrs
+
+    def _get_test_firewall_attrs(self, name='firewall_1'):
+        attrs = {'name': name,
+                 'tenant_id': self._tenant_id,
+                 'admin_state_up': ADMIN_STATE_UP,
+                 'status': 'PENDING_CREATE'}
+
+        return attrs
+
+    def _create_firewall_policy(self, fmt, name, description, shared,
+                                firewall_rules, audited,
+                                expected_res_status=None, **kwargs):
+        data = {'firewall_policy': {'name': name,
+                                    'description': description,
+                                    'tenant_id': self._tenant_id,
+                                    'shared': shared,
+                                    'firewall_rules': firewall_rules,
+                                    'audited': audited}}
+
+        fw_policy_req = self.new_create_request('firewall_policies', data, fmt)
+        fw_policy_res = fw_policy_req.get_response(self.ext_api)
+        if expected_res_status:
+            self.assertEqual(fw_policy_res.status_int, expected_res_status)
+
+        return fw_policy_res
+
+    def _replace_firewall_status(self, attrs, old_status, new_status):
+        if attrs['status'] is old_status:
+            attrs['status'] = new_status
+        return attrs
+
+    @contextlib.contextmanager
+    def firewall_policy(self, fmt=None, name='firewall_policy1',
+                        description=DESCRIPTION, shared=True,
+                        firewall_rules=None, audited=True,
+                        no_delete=False, **kwargs):
+        if firewall_rules is None:
+            firewall_rules = []
+        if not fmt:
+            fmt = self.fmt
+        res = self._create_firewall_policy(fmt, name, description, shared,
+                                           firewall_rules, audited,
+                                           **kwargs)
+        if res.status_int >= 400:
+            raise webob.exc.HTTPClientError(code=res.status_int)
+        firewall_policy = self.deserialize(fmt or self.fmt, res)
+        try:
+            yield firewall_policy
+        finally:
+            if not no_delete:
+                self._delete('firewall_policies',
+                             firewall_policy['firewall_policy']['id'])
+
+    def _create_firewall_rule(self, fmt, name, shared, protocol,
+                              ip_version, source_ip_address,
+                              destination_ip_address, source_port,
+                              destination_port, action, enabled,
+                              expected_res_status=None, **kwargs):
+        data = {'firewall_rule': {'name': name,
+                                  'tenant_id': self._tenant_id,
+                                  'shared': shared,
+                                  'protocol': protocol,
+                                  'ip_version': ip_version,
+                                  'source_ip_address': source_ip_address,
+                                  'destination_ip_address':
+                                  destination_ip_address,
+                                  'source_port': source_port,
+                                  'destination_port': destination_port,
+                                  'action': action,
+                                  'enabled': enabled}}
+
+        fw_rule_req = self.new_create_request('firewall_rules', data, fmt)
+        fw_rule_res = fw_rule_req.get_response(self.ext_api)
+        if expected_res_status:
+            self.assertEqual(fw_rule_res.status_int, expected_res_status)
+
+        return fw_rule_res
+
+    @contextlib.contextmanager
+    def firewall_rule(self, fmt=None, name='firewall_rule1',
+                      shared=SHARED, protocol=PROTOCOL, ip_version=IP_VERSION,
+                      source_ip_address=SOURCE_IP_ADDRESS_RAW,
+                      destination_ip_address=DESTINATION_IP_ADDRESS_RAW,
+                      source_port=SOURCE_PORT,
+                      destination_port=DESTINATION_PORT,
+                      action=ACTION, enabled=ENABLED,
+                      no_delete=False, **kwargs):
+        if not fmt:
+            fmt = self.fmt
+        res = self._create_firewall_rule(fmt, name, shared, protocol,
+                                         ip_version, source_ip_address,
+                                         destination_ip_address,
+                                         source_port, destination_port,
+                                         action, enabled, **kwargs)
+        if res.status_int >= 400:
+            raise webob.exc.HTTPClientError(code=res.status_int)
+        firewall_rule = self.deserialize(fmt or self.fmt, res)
+        try:
+            yield firewall_rule
+        finally:
+            if not no_delete:
+                self._delete('firewall_rules',
+                             firewall_rule['firewall_rule']['id'])
+
+    def _create_firewall(self, fmt, name, description, firewall_policy_id,
+                         admin_state_up=True, expected_res_status=None,
+                         **kwargs):
+        data = {'firewall': {'name': name,
+                             'description': description,
+                             'firewall_policy_id': firewall_policy_id,
+                             'admin_state_up': admin_state_up,
+                             'tenant_id': self._tenant_id}}
+
+        firewall_req = self.new_create_request('firewalls', data, fmt)
+        firewall_res = firewall_req.get_response(self.ext_api)
+        if expected_res_status:
+            self.assertEqual(firewall_res.status_int, expected_res_status)
+
+        return firewall_res
+
+    @contextlib.contextmanager
+    def firewall(self, fmt=None, name='firewall_1', description=DESCRIPTION,
+                 firewall_policy_id=None, admin_state_up=True,
+                 no_delete=False, **kwargs):
+        if not fmt:
+            fmt = self.fmt
+        res = self._create_firewall(fmt, name, description, firewall_policy_id,
+                                    admin_state_up, **kwargs)
+        if res.status_int >= 400:
+            raise webob.exc.HTTPClientError(code=res.status_int)
+        firewall = self.deserialize(fmt or self.fmt, res)
+        try:
+            yield firewall
+        finally:
+            if not no_delete:
+                self._delete('firewalls', firewall['firewall']['id'])
+
+    def _rule_action(self, action, id, firewall_rule_id, insert_before=None,
+                     insert_after=None, expected_code=webob.exc.HTTPOk.code,
+                     expected_body=None, body_data=None):
+        # We intentionally do this check for None since we want to distinguish
+        # from empty dictionary
+        if body_data is None:
+            if action == 'insert':
+                body_data = {'firewall_rule_id': firewall_rule_id,
+                             'insert_before': insert_before,
+                             'insert_after': insert_after}
+            else:
+                body_data = {'firewall_rule_id': firewall_rule_id}
+
+        req = self.new_action_request('firewall_policies',
+                                      body_data, id,
+                                      "%s_rule" % action)
+        res = req.get_response(self.ext_api)
+        self.assertEqual(res.status_int, expected_code)
+        response = self.deserialize(self.fmt, res)
+        if expected_body:
+            self.assertEqual(response, expected_body)
+        return response
+
+    def _compare_firewall_rule_lists(self, firewall_policy_id,
+                                     list1, list2):
+        position = 0
+        for r1, r2 in zip(list1, list2):
+            rule = r1['firewall_rule']
+            rule['firewall_policy_id'] = firewall_policy_id
+            position += 1
+            rule['position'] = position
+            for k in rule:
+                self.assertEqual(rule[k], r2[k])
+
+
+class TestFirewallDBPlugin(FirewallPluginDbTestCase):
+
+    def test_create_firewall_policy(self):
+        name = "firewall_policy1"
+        attrs = self._get_test_firewall_policy_attrs(name)
+
+        with self.firewall_policy(name=name, shared=SHARED,
+                                  firewall_rules=None,
+                                  audited=AUDITED) as firewall_policy:
+            for k, v in attrs.iteritems():
+                self.assertEqual(firewall_policy['firewall_policy'][k], v)
+
+    def test_create_firewall_policy_with_rules(self):
+        name = "firewall_policy1"
+        attrs = self._get_test_firewall_policy_attrs(name)
+
+        with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                  no_delete=True),
+                               self.firewall_rule(name='fwr2',
+                                                  no_delete=True),
+                               self.firewall_rule(name='fwr3',
+                                                  no_delete=True)) as fr:
+            fw_rule_ids = [r['firewall_rule']['id'] for r in fr]
+            attrs['firewall_rules'] = fw_rule_ids
+            with self.firewall_policy(name=name, shared=SHARED,
+                                      firewall_rules=fw_rule_ids,
+                                      audited=AUDITED,
+                                      no_delete=True) as fwp:
+                for k, v in attrs.iteritems():
+                    self.assertEqual(fwp['firewall_policy'][k], v)
+
+    def test_show_firewall_policy(self):
+        name = "firewall_policy1"
+        attrs = self._get_test_firewall_policy_attrs(name)
+
+        with self.firewall_policy(name=name, shared=SHARED,
+                                  firewall_rules=None,
+                                  audited=AUDITED) as fwp:
+            req = self.new_show_request('firewall_policies',
+                                        fwp['firewall_policy']['id'],
+                                        fmt=self.fmt)
+            res = self.deserialize(self.fmt, req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_policy'][k], v)
+
+    def test_list_firewall_policies(self):
+        with contextlib.nested(self.firewall_policy(name='fwp1',
+                                                    description='fwp'),
+                               self.firewall_policy(name='fwp2',
+                                                    description='fwp'),
+                               self.firewall_policy(name='fwp3',
+                                                    description='fwp')
+                               ) as fw_policies:
+            self._test_list_resources('firewall_policy',
+                                      fw_policies,
+                                      query_params='description=fwp')
+
+    def test_update_firewall_policy(self):
+        name = "new_firewall_policy1"
+        attrs = self._get_test_firewall_policy_attrs(name)
+
+        with self.firewall_policy(shared=SHARED,
+                                  firewall_rules=None,
+                                  audited=AUDITED) as fwp:
+            data = {'firewall_policy': {'name': name}}
+            req = self.new_update_request('firewall_policies', data,
+                                          fwp['firewall_policy']['id'])
+            res = self.deserialize(self.fmt, req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_policy'][k], v)
+
+    def test_update_firewall_policy_with_rules(self):
+        attrs = self._get_test_firewall_policy_attrs()
+
+        with self.firewall_policy() as fwp:
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr3',
+                                                      no_delete=True)) as fr:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr]
+                attrs['firewall_rules'] = fw_rule_ids
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                attrs['audited'] = False
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall_policy'][k], v)
+
+    def test_update_firewall_policy_replace_rules(self):
+        attrs = self._get_test_firewall_policy_attrs()
+
+        with self.firewall_policy() as fwp:
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True)) as fr1:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr1]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                req.get_response(self.ext_api)
+            with contextlib.nested(self.firewall_rule(name='fwr3',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr4',
+                                                      no_delete=True)) as fr2:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr2]
+                attrs['firewall_rules'] = fw_rule_ids
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                attrs['audited'] = False
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall_policy'][k], v)
+
+    def test_update_firewall_policy_with_non_existing_rule(self):
+        attrs = self._get_test_firewall_policy_attrs()
+
+        with self.firewall_policy() as fwp:
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True)) as fr:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr]
+                fw_rule_ids.append('12345')  # non-existent rule
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                res = req.get_response(self.ext_api)
+                #check that the firewall_rule was not found
+                self.assertEqual(res.status_int, 404)
+                #check if none of the rules got added to the policy
+                req = self.new_show_request('firewall_policies',
+                                            fwp['firewall_policy']['id'],
+                                            fmt=self.fmt)
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall_policy'][k], v)
+
+    def test_delete_firewall_policy(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            req = self.new_delete_request('firewall_policies', fwp_id)
+            res = req.get_response(self.ext_api)
+            self.assertEqual(res.status_int, 204)
+            self.assertRaises(firewall.FirewallPolicyNotFound,
+                              self.plugin.get_firewall_policy,
+                              ctx, fwp_id)
+
+    def test_delete_firewall_policy_with_rule(self):
+        ctx = context.get_admin_context()
+        attrs = self._get_test_firewall_policy_attrs()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall_rule(name='fwr1', no_delete=True) as fr:
+                fr_id = fr['firewall_rule']['id']
+                fw_rule_ids = [fr_id]
+                attrs['firewall_rules'] = fw_rule_ids
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                req.get_response(self.ext_api)
+                fw_rule = self.plugin.get_firewall_rule(ctx, fr_id)
+                self.assertEqual(fw_rule['firewall_policy_id'], fwp_id)
+                req = self.new_delete_request('firewall_policies', fwp_id)
+                res = req.get_response(self.ext_api)
+                self.assertEqual(res.status_int, 204)
+                self.assertRaises(firewall.FirewallPolicyNotFound,
+                                  self.plugin.get_firewall_policy,
+                                  ctx, fwp_id)
+                fw_rule = self.plugin.get_firewall_rule(ctx, fr_id)
+                self.assertEqual(fw_rule['firewall_policy_id'], None)
+
+    def test_delete_firewall_policy_with_firewall_association(self):
+        attrs = self._get_test_firewall_attrs()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               ADMIN_STATE_UP):
+                req = self.new_delete_request('firewall_policies', fwp_id)
+                res = req.get_response(self.ext_api)
+                self.assertEqual(res.status_int, 409)
+
+    def test_create_firewall_rule(self):
+        attrs = self._get_test_firewall_rule_attrs()
+
+        with self.firewall_rule() as firewall_rule:
+            for k, v in attrs.iteritems():
+                self.assertEqual(firewall_rule['firewall_rule'][k], v)
+
+        attrs['source_port'] = None
+        attrs['destination_port'] = None
+        with self.firewall_rule(source_port=None,
+                                destination_port=None) as firewall_rule:
+            for k, v in attrs.iteritems():
+                self.assertEqual(firewall_rule['firewall_rule'][k], v)
+
+        attrs['source_port'] = '10000'
+        attrs['destination_port'] = '80'
+        with self.firewall_rule(source_port=10000,
+                                destination_port=80) as firewall_rule:
+            for k, v in attrs.iteritems():
+                self.assertEqual(firewall_rule['firewall_rule'][k], v)
+
+        attrs['source_port'] = '10000'
+        attrs['destination_port'] = '80'
+        with self.firewall_rule(source_port='10000',
+                                destination_port='80') as firewall_rule:
+            for k, v in attrs.iteritems():
+                self.assertEqual(firewall_rule['firewall_rule'][k], v)
+
+    def test_show_firewall_rule_with_fw_policy_not_associated(self):
+        attrs = self._get_test_firewall_rule_attrs()
+        with self.firewall_rule() as fw_rule:
+            req = self.new_show_request('firewall_rules',
+                                        fw_rule['firewall_rule']['id'],
+                                        fmt=self.fmt)
+            res = self.deserialize(self.fmt,
+                                   req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_rule'][k], v)
+
+    def test_show_firewall_rule_with_fw_policy_associated(self):
+        attrs = self._get_test_firewall_rule_attrs()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall_rule(no_delete=True) as fw_rule:
+                data = {'firewall_policy':
+                        {'firewall_rules':
+                         [fw_rule['firewall_rule']['id']]}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                req.get_response(self.ext_api)
+                req = self.new_show_request('firewall_rules',
+                                            fw_rule['firewall_rule']['id'],
+                                            fmt=self.fmt)
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall_rule'][k], v)
+
+    def test_list_firewall_rules(self):
+        with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                  no_delete=True),
+                               self.firewall_rule(name='fwr2',
+                                                  no_delete=True),
+                               self.firewall_rule(name='fwr3',
+                                                  no_delete=True)) as fr:
+            query_params = 'protocol=tcp'
+            self._test_list_resources('firewall_rule', fr,
+                                      query_params=query_params)
+
+    def test_update_firewall_rule(self):
+        name = "new_firewall_rule1"
+        attrs = self._get_test_firewall_rule_attrs(name)
+
+        attrs['source_port'] = '10:20'
+        attrs['destination_port'] = '30:40'
+        with self.firewall_rule(no_delete=True) as fwr:
+            data = {'firewall_rule': {'name': name,
+                                      'source_port': '10:20',
+                                      'destination_port': '30:40'}}
+            req = self.new_update_request('firewall_rules', data,
+                                          fwr['firewall_rule']['id'])
+            res = self.deserialize(self.fmt,
+                                   req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_rule'][k], v)
+
+        attrs['source_port'] = '10000'
+        attrs['destination_port'] = '80'
+        with self.firewall_rule(no_delete=True) as fwr:
+            data = {'firewall_rule': {'name': name,
+                                      'source_port': 10000,
+                                      'destination_port': 80}}
+            req = self.new_update_request('firewall_rules', data,
+                                          fwr['firewall_rule']['id'])
+            res = self.deserialize(self.fmt,
+                                   req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_rule'][k], v)
+
+        attrs['source_port'] = '10000'
+        attrs['destination_port'] = '80'
+        with self.firewall_rule(no_delete=True) as fwr:
+            data = {'firewall_rule': {'name': name,
+                                      'source_port': '10000',
+                                      'destination_port': '80'}}
+            req = self.new_update_request('firewall_rules', data,
+                                          fwr['firewall_rule']['id'])
+            res = self.deserialize(self.fmt,
+                                   req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_rule'][k], v)
+
+        attrs['source_port'] = None
+        attrs['destination_port'] = None
+        with self.firewall_rule(no_delete=True) as fwr:
+            data = {'firewall_rule': {'name': name,
+                                      'source_port': None,
+                                      'destination_port': None}}
+            req = self.new_update_request('firewall_rules', data,
+                                          fwr['firewall_rule']['id'])
+            res = self.deserialize(self.fmt,
+                                   req.get_response(self.ext_api))
+            for k, v in attrs.iteritems():
+                self.assertEqual(res['firewall_rule'][k], v)
+
+    def test_update_firewall_rule_with_policy_associated(self):
+        name = "new_firewall_rule1"
+        attrs = self._get_test_firewall_rule_attrs(name)
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall_rule(no_delete=True) as fwr:
+                fwr_id = fwr['firewall_rule']['id']
+                data = {'firewall_policy': {'firewall_rules': [fwr_id]}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                req.get_response(self.ext_api)
+                data = {'firewall_rule': {'name': name}}
+                req = self.new_update_request('firewall_rules', data,
+                                              fwr['firewall_rule']['id'])
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                attrs['firewall_policy_id'] = fwp_id
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall_rule'][k], v)
+                req = self.new_show_request('firewall_policies',
+                                            fwp['firewall_policy']['id'],
+                                            fmt=self.fmt)
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                self.assertEqual(res['firewall_policy']['firewall_rules'],
+                                 [fwr_id])
+                self.assertEqual(res['firewall_policy']['audited'], False)
+
+    def test_delete_firewall_rule(self):
+        ctx = context.get_admin_context()
+        with self.firewall_rule(no_delete=True) as fwr:
+            fwr_id = fwr['firewall_rule']['id']
+            req = self.new_delete_request('firewall_rules', fwr_id)
+            res = req.get_response(self.ext_api)
+            self.assertEqual(res.status_int, 204)
+            self.assertRaises(firewall.FirewallRuleNotFound,
+                              self.plugin.get_firewall_rule,
+                              ctx, fwr_id)
+
+    def test_delete_firewall_rule_with_policy_associated(self):
+        attrs = self._get_test_firewall_rule_attrs()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall_rule(no_delete=True) as fwr:
+                fwr_id = fwr['firewall_rule']['id']
+                data = {'firewall_policy': {'firewall_rules': [fwr_id]}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp['firewall_policy']['id'])
+                req.get_response(self.ext_api)
+                req = self.new_delete_request('firewall_rules', fwr_id)
+                res = req.get_response(self.ext_api)
+                self.assertEqual(res.status_int, 409)
+
+    def test_create_firewall(self):
+        name = "firewall1"
+        attrs = self._get_test_firewall_attrs(name)
+
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(name=name,
+                               firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               ADMIN_STATE_UP) as firewall:
+                for k, v in attrs.iteritems():
+                    self.assertEqual(firewall['firewall'][k], v)
+
+    def test_show_firewall(self):
+        name = "firewall1"
+        attrs = self._get_test_firewall_attrs(name)
+
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(name=name,
+                               firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               ADMIN_STATE_UP) as firewall:
+                req = self.new_show_request('firewalls',
+                                            firewall['firewall']['id'],
+                                            fmt=self.fmt)
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall'][k], v)
+
+    def test_list_firewalls(self):
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with contextlib.nested(self.firewall(name='fw1',
+                                                 firewall_policy_id=fwp_id,
+                                                 description='fw'),
+                                   self.firewall(name='fw2',
+                                                 firewall_policy_id=fwp_id,
+                                                 description='fw'),
+                                   self.firewall(name='fw3',
+                                                 firewall_policy_id=fwp_id,
+                                                 description='fw')) as fwalls:
+                self._test_list_resources('firewall', fwalls,
+                                          query_params='description=fw')
+
+    def test_update_firewall(self):
+        name = "new_firewall1"
+        attrs = self._get_test_firewall_attrs(name)
+
+        with self.firewall_policy() as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               ADMIN_STATE_UP) as firewall:
+                data = {'firewall': {'name': name}}
+                req = self.new_update_request('firewalls', data,
+                                              firewall['firewall']['id'])
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall'][k], v)
+
+    def test_delete_firewall(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall(firewall_policy_id=fwp_id,
+                               no_delete=True) as fw:
+                fw_id = fw['firewall']['id']
+                req = self.new_delete_request('firewalls', fw_id)
+                res = req.get_response(self.ext_api)
+                self.assertEqual(res.status_int, 204)
+                self.assertRaises(firewall.FirewallNotFound,
+                                  self.plugin.get_firewall,
+                                  ctx, fw_id)
+
+    def test_insert_rule_in_policy_with_prior_rules_added_via_update(self):
+        attrs = self._get_test_firewall_policy_attrs()
+        attrs['audited'] = False
+        attrs['firewall_list'] = []
+        with self.firewall_policy() as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['id'] = fwp_id
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True)) as fr1:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr1]
+                attrs['firewall_rules'] = fw_rule_ids[:]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                req.get_response(self.ext_api)
+                self._rule_action('insert', fwp_id, fw_rule_ids[0],
+                                  insert_before=fw_rule_ids[0],
+                                  insert_after=None,
+                                  expected_code=webob.exc.HTTPConflict.code,
+                                  expected_body=None)
+                with self.firewall_rule(name='fwr3', no_delete=True) as fwr3:
+                    fwr3_id = fwr3['firewall_rule']['id']
+                    attrs['firewall_rules'].insert(0, fwr3_id)
+                    self._rule_action('insert', fwp_id, fwr3_id,
+                                      insert_before=fw_rule_ids[0],
+                                      insert_after=None,
+                                      expected_code=webob.exc.HTTPOk.code,
+                                      expected_body=attrs)
+
+    def test_insert_rule_in_policy_failures(self):
+        with self.firewall_policy() as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall_rule(name='fwr1', no_delete=True) as fr1:
+                fr1_id = fr1['firewall_rule']['id']
+                fw_rule_ids = [fr1_id]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                req.get_response(self.ext_api)
+                # test inserting with empty request body
+                self._rule_action('insert', fwp_id, '123',
+                                  expected_code=webob.exc.HTTPBadRequest.code,
+                                  expected_body=None, body_data={})
+                # test inserting when firewall_rule_id is missing in
+                # request body
+                insert_data = {'insert_before': '123',
+                               'insert_after': '456'}
+                self._rule_action('insert', fwp_id, '123',
+                                  expected_code=webob.exc.HTTPBadRequest.code,
+                                  expected_body=None,
+                                  body_data=insert_data)
+                # test inserting when firewall_rule_id is None
+                insert_data = {'firewall_rule_id': None,
+                               'insert_before': '123',
+                               'insert_after': '456'}
+                self._rule_action('insert', fwp_id, '123',
+                                  expected_code=webob.exc.HTTPNotFound.code,
+                                  expected_body=None,
+                                  body_data=insert_data)
+                # test inserting when firewall_policy_id is incorrect
+                self._rule_action('insert', '123', fr1_id,
+                                  expected_code=webob.exc.HTTPNotFound.code,
+                                  expected_body=None)
+                # test inserting when firewall_policy_id is None
+                self._rule_action('insert', None, fr1_id,
+                                  expected_code=webob.exc.HTTPBadRequest.code,
+                                  expected_body=None)
+
+    def test_insert_rule_in_policy(self):
+        attrs = self._get_test_firewall_policy_attrs()
+        attrs['audited'] = False
+        attrs['firewall_list'] = []
+        with self.firewall_policy() as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['id'] = fwp_id
+            with contextlib.nested(self.firewall_rule(name='fwr0',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr3',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr4',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr5',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr6',
+                                                      no_delete=True)) as fwr:
+                # test insert when rule list is empty
+                fwr0_id = fwr[0]['firewall_rule']['id']
+                attrs['firewall_rules'].insert(0, fwr0_id)
+                self._rule_action('insert', fwp_id, fwr0_id,
+                                  insert_before=None,
+                                  insert_after=None,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs)
+                # test insert at top of rule list, insert_before and
+                # insert_after not provided
+                fwr1_id = fwr[1]['firewall_rule']['id']
+                attrs['firewall_rules'].insert(0, fwr1_id)
+                insert_data = {'firewall_rule_id': fwr1_id}
+                self._rule_action('insert', fwp_id, fwr0_id,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs, body_data=insert_data)
+                # test insert at top of list above existing rule
+                fwr2_id = fwr[2]['firewall_rule']['id']
+                attrs['firewall_rules'].insert(0, fwr2_id)
+                self._rule_action('insert', fwp_id, fwr2_id,
+                                  insert_before=fwr1_id,
+                                  insert_after=None,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs)
+                # test insert at bottom of list
+                fwr3_id = fwr[3]['firewall_rule']['id']
+                attrs['firewall_rules'].append(fwr3_id)
+                self._rule_action('insert', fwp_id, fwr3_id,
+                                  insert_before=None,
+                                  insert_after=fwr0_id,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs)
+                # test insert in the middle of the list using
+                # insert_before
+                fwr4_id = fwr[4]['firewall_rule']['id']
+                attrs['firewall_rules'].insert(1, fwr4_id)
+                self._rule_action('insert', fwp_id, fwr4_id,
+                                  insert_before=fwr1_id,
+                                  insert_after=None,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs)
+                # test insert in the middle of the list using
+                # insert_after
+                fwr5_id = fwr[5]['firewall_rule']['id']
+                attrs['firewall_rules'].insert(1, fwr5_id)
+                self._rule_action('insert', fwp_id, fwr5_id,
+                                  insert_before=None,
+                                  insert_after=fwr2_id,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs)
+                # test insert when both insert_before and
+                # insert_after are set
+                fwr6_id = fwr[6]['firewall_rule']['id']
+                attrs['firewall_rules'].insert(1, fwr6_id)
+                self._rule_action('insert', fwp_id, fwr6_id,
+                                  insert_before=fwr5_id,
+                                  insert_after=fwr5_id,
+                                  expected_code=webob.exc.HTTPOk.code,
+                                  expected_body=attrs)
+
+    def test_remove_rule_from_policy(self):
+        attrs = self._get_test_firewall_policy_attrs()
+        attrs['audited'] = False
+        attrs['firewall_list'] = []
+        with self.firewall_policy() as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['id'] = fwp_id
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr3',
+                                                      no_delete=True)) as fr1:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr1]
+                attrs['firewall_rules'] = fw_rule_ids[:]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                req.get_response(self.ext_api)
+                # test removing a rule from a policy that does not exist
+                self._rule_action('remove', '123', fw_rule_ids[1],
+                                  expected_code=webob.exc.HTTPNotFound.code,
+                                  expected_body=None)
+                # test removing a rule in the middle of the list
+                attrs['firewall_rules'].remove(fw_rule_ids[1])
+                self._rule_action('remove', fwp_id, fw_rule_ids[1],
+                                  expected_body=attrs)
+                # test removing a rule at the top of the list
+                attrs['firewall_rules'].remove(fw_rule_ids[0])
+                self._rule_action('remove', fwp_id, fw_rule_ids[0],
+                                  expected_body=attrs)
+                # test removing remaining rule in the list
+                attrs['firewall_rules'].remove(fw_rule_ids[2])
+                self._rule_action('remove', fwp_id, fw_rule_ids[2],
+                                  expected_body=attrs)
+                # test removing rule that is not associated with the policy
+                self._rule_action('remove', fwp_id, fw_rule_ids[2],
+                                  expected_code=webob.exc.HTTPBadRequest.code,
+                                  expected_body=None)
+
+    def test_remove_rule_from_policy_failures(self):
+        with self.firewall_policy() as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall_rule(name='fwr1', no_delete=True) as fr1:
+                fw_rule_ids = [fr1['firewall_rule']['id']]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                req.get_response(self.ext_api)
+                # test removing rule that does not exist
+                self._rule_action('remove', fwp_id, '123',
+                                  expected_code=webob.exc.HTTPNotFound.code,
+                                  expected_body=None)
+                # test removing rule with bad request
+                self._rule_action('remove', fwp_id, '123',
+                                  expected_code=webob.exc.HTTPBadRequest.code,
+                                  expected_body=None, body_data={})
+                # test removing rule with firewall_rule_id set to None
+                self._rule_action('remove', fwp_id, '123',
+                                  expected_code=webob.exc.HTTPNotFound.code,
+                                  expected_body=None,
+                                  body_data={'firewall_rule_id': None})
+
+
+class TestFirewallDBPluginXML(TestFirewallDBPlugin):
+    fmt = 'xml'

neutron/tests/unit/services/firewall/__init__.py

@@ -0,0 +1,15 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2013 OpenStack Foundation
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.

neutron/tests/unit/services/firewall/test_fwaas_plugin.py

@@ -0,0 +1,353 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 Big Switch Networks, Inc.
+# All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the spec
+#
+# @author: Sumit Naiksatam, sumitnaiksatam@gmail.com, Big Switch Networks, Inc.
+
+
+import contextlib
+
+import mock
+
+from neutron import context
+from neutron.extensions import firewall
+from neutron.plugins.common import constants as const
+from neutron.services.firewall import fwaas_plugin
+from neutron.tests import base
+from neutron.tests.unit.db.firewall import test_db_firewall
+
+
+FW_PLUGIN_KLASS = (
+    "neutron.services.firewall.fwaas_plugin.FirewallPlugin"
+)
+
+
+class TestFirewallCallbacks(test_db_firewall.FirewallPluginDbTestCase):
+
+    def setUp(self):
+        super(TestFirewallCallbacks,
+              self).setUp(fw_plugin=FW_PLUGIN_KLASS)
+        self.callbacks = self.plugin.callbacks
+
+    def test_set_firewall_status(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               test_db_firewall.ADMIN_STATE_UP) as fw:
+                fw_id = fw['firewall']['id']
+                res = self.callbacks.set_firewall_status(ctx, fw_id,
+                                                         const.ACTIVE,
+                                                         host='dummy')
+                fw_db = self.plugin.get_firewall(ctx, fw_id)
+                self.assertEqual(fw_db['status'], const.ACTIVE)
+                self.assertTrue(res)
+                res = self.callbacks.set_firewall_status(ctx, fw_id,
+                                                         const.ERROR)
+                fw_db = self.plugin.get_firewall(ctx, fw_id)
+                self.assertEqual(fw_db['status'], const.ERROR)
+                self.assertFalse(res)
+
+    def test_firewall_deleted(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=test_db_firewall.ADMIN_STATE_UP,
+                               no_delete=True) as fw:
+                fw_id = fw['firewall']['id']
+                with ctx.session.begin(subtransactions=True):
+                    fw_db = self.plugin._get_firewall(ctx, fw_id)
+                    fw_db['status'] = const.PENDING_DELETE
+                    ctx.session.flush()
+                    res = self.callbacks.firewall_deleted(ctx, fw_id,
+                                                          host='dummy')
+                    self.assertTrue(res)
+                    self.assertRaises(firewall.FirewallNotFound,
+                                      self.plugin.get_firewall,
+                                      ctx, fw_id)
+
+    def test_firewall_deleted_error(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=test_db_firewall.ADMIN_STATE_UP,
+                               no_delete=True) as fw:
+                fw_id = fw['firewall']['id']
+                res = self.callbacks.firewall_deleted(ctx, fw_id,
+                                                      host='dummy')
+                self.assertFalse(res)
+                fw_db = self.plugin._get_firewall(ctx, fw_id)
+                self.assertEqual(fw_db['status'], const.ERROR)
+
+    def test_get_firewall_for_tenant(self):
+        tenant_id = 'test-tenant'
+        ctx = context.Context('', tenant_id)
+        with self.firewall_policy(tenant_id=tenant_id, no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      tenant_id=tenant_id,
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      tenant_id=tenant_id,
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr3',
+                                                      tenant_id=tenant_id,
+                                                      no_delete=True)) as fr:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                res = req.get_response(self.ext_api)
+                attrs = self._get_test_firewall_attrs()
+                attrs['firewall_policy_id'] = fwp_id
+                with self.firewall(firewall_policy_id=fwp_id,
+                                   tenant_id=tenant_id,
+                                   admin_state_up=
+                                   test_db_firewall.ADMIN_STATE_UP,
+                                   no_delete=True) as fw:
+                    fw_id = fw['firewall']['id']
+                    res = self.callbacks.get_firewalls_for_tenant(ctx,
+                                                                  host='dummy')
+                    fw_rules = (
+                        self.plugin._make_firewall_dict_with_rules(ctx,
+                                                                   fw_id)
+                    )
+                    self.assertEqual(res[0], fw_rules)
+                    self._compare_firewall_rule_lists(
+                        fwp_id, fr, res[0]['firewall_rule_list'])
+
+    def test_get_firewall_for_tenant_without_rules(self):
+        tenant_id = 'test-tenant'
+        ctx = context.Context('', tenant_id)
+        with self.firewall_policy(tenant_id=tenant_id, no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs = self._get_test_firewall_attrs()
+            attrs['firewall_policy_id'] = fwp_id
+            with contextlib.nested(self.firewall(
+                firewall_policy_id=fwp_id,
+                tenant_id=tenant_id,
+                admin_state_up=test_db_firewall.ADMIN_STATE_UP,
+                no_delete=True), self.firewall(
+                    firewall_policy_id=fwp_id,
+                    tenant_id=tenant_id,
+                    admin_state_up=test_db_firewall.ADMIN_STATE_UP,
+                    no_delete=True)) as fws:
+                    fw_list = [fw['firewall'] for fw in fws]
+                    f = self.callbacks.get_firewalls_for_tenant_without_rules
+                    res = f(ctx, host='dummy')
+                    for fw in res:
+                        del fw['shared']
+                    self.assertEqual(res, fw_list)
+
+
+class TestFirewallAgentApi(base.BaseTestCase):
+    def setUp(self):
+        super(TestFirewallAgentApi, self).setUp()
+        self.addCleanup(mock.patch.stopall)
+
+        self.api = fwaas_plugin.FirewallAgentApi('topic', 'host')
+        self.mock_fanoutcast = mock.patch.object(self.api,
+                                                 'fanout_cast').start()
+        self.mock_msg = mock.patch.object(self.api, 'make_msg').start()
+
+    def test_init(self):
+        self.assertEqual(self.api.topic, 'topic')
+        self.assertEqual(self.api.host, 'host')
+
+    def _call_test_helper(self, method_name):
+        rv = getattr(self.api, method_name)(mock.sentinel.context, 'test')
+        self.assertEqual(rv, self.mock_fanoutcast.return_value)
+        self.mock_fanoutcast.assert_called_once_with(
+            mock.sentinel.context,
+            self.mock_msg.return_value,
+            topic='topic'
+        )
+
+        self.mock_msg.assert_called_once_with(
+            method_name,
+            firewall='test',
+            host='host'
+        )
+
+    def test_create_firewall(self):
+        self._call_test_helper('create_firewall')
+
+    def test_update_firewall(self):
+        self._call_test_helper('update_firewall')
+
+    def test_delete_firewall(self):
+        self._call_test_helper('delete_firewall')
+
+
+class TestFirewallPluginBase(test_db_firewall.TestFirewallDBPlugin):
+
+    def setUp(self):
+        super(TestFirewallPluginBase, self).setUp(fw_plugin=FW_PLUGIN_KLASS)
+        self.callbacks = self.plugin.callbacks
+
+    def test_update_firewall(self):
+        ctx = context.get_admin_context()
+        name = "new_firewall1"
+        attrs = self._get_test_firewall_attrs(name)
+
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               test_db_firewall.ADMIN_STATE_UP) as firewall:
+                fw_id = firewall['firewall']['id']
+                res = self.callbacks.set_firewall_status(ctx, fw_id,
+                                                         const.ACTIVE)
+                data = {'firewall': {'name': name}}
+                req = self.new_update_request('firewalls', data, fw_id)
+                res = self.deserialize(self.fmt,
+                                       req.get_response(self.ext_api))
+                attrs = self._replace_firewall_status(attrs,
+                                                      const.PENDING_CREATE,
+                                                      const.PENDING_UPDATE)
+                for k, v in attrs.iteritems():
+                    self.assertEqual(res['firewall'][k], v)
+
+    def test_update_firewall_fails_when_firewall_pending(self):
+        name = "new_firewall1"
+        attrs = self._get_test_firewall_attrs(name)
+
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               test_db_firewall.ADMIN_STATE_UP) as firewall:
+                fw_id = firewall['firewall']['id']
+                data = {'firewall': {'name': name}}
+                req = self.new_update_request('firewalls', data, fw_id)
+                res = req.get_response(self.ext_api)
+                self.assertEqual(res.status_int, 409)
+
+    def test_update_firewall_policy_fails_when_firewall_pending(self):
+        name = "new_firewall1"
+        attrs = self._get_test_firewall_attrs(name)
+
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               test_db_firewall.ADMIN_STATE_UP):
+                data = {'firewall_policy': {'name': name}}
+                req = self.new_update_request('firewall_policies',
+                                              data, fwp_id)
+                res = req.get_response(self.ext_api)
+                self.assertEqual(res.status_int, 409)
+
+    def test_update_firewall_rule_fails_when_firewall_pending(self):
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall_rule(name='fwr1', no_delete=True) as fr:
+                fr_id = fr['firewall_rule']['id']
+                fw_rule_ids = [fr_id]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                req.get_response(self.ext_api)
+                with self.firewall(firewall_policy_id=fwp_id,
+                                   admin_state_up=
+                                   test_db_firewall.ADMIN_STATE_UP,
+                                   no_delete=True):
+                    data = {'firewall_rule': {'protocol': 'udp'}}
+                    req = self.new_update_request('firewall_rules',
+                                                  data, fr_id)
+                    res = req.get_response(self.ext_api)
+                    self.assertEqual(res.status_int, 409)
+
+    def test_delete_firewall(self):
+        ctx = context.get_admin_context()
+        attrs = self._get_test_firewall_attrs()
+
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            attrs['firewall_policy_id'] = fwp_id
+            with self.firewall(firewall_policy_id=fwp_id,
+                               admin_state_up=
+                               test_db_firewall.ADMIN_STATE_UP) as firewall:
+                fw_id = firewall['firewall']['id']
+                attrs = self._replace_firewall_status(attrs,
+                                                      const.PENDING_CREATE,
+                                                      const.PENDING_DELETE)
+                req = self.new_delete_request('firewalls', fw_id)
+                req.get_response(self.ext_api)
+                fw_db = self.plugin._get_firewall(ctx, fw_id)
+                for k, v in attrs.iteritems():
+                    self.assertEqual(fw_db[k], v)
+
+    def test_delete_firewall_after_agent_delete(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with self.firewall(firewall_policy_id=fwp_id,
+                               no_delete=True) as fw:
+                fw_id = fw['firewall']['id']
+                with ctx.session.begin(subtransactions=True):
+                    req = self.new_delete_request('firewalls', fw_id)
+                    res = req.get_response(self.ext_api)
+                    self.assertEqual(res.status_int, 204)
+                    self.plugin.callbacks.firewall_deleted(ctx, fw_id)
+                    self.assertRaises(firewall.FirewallNotFound,
+                                      self.plugin.get_firewall,
+                                      ctx, fw_id)
+
+    def test_make_firewall_dict_with_in_place_rules(self):
+        ctx = context.get_admin_context()
+        with self.firewall_policy(no_delete=True) as fwp:
+            fwp_id = fwp['firewall_policy']['id']
+            with contextlib.nested(self.firewall_rule(name='fwr1',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr2',
+                                                      no_delete=True),
+                                   self.firewall_rule(name='fwr3',
+                                                      no_delete=True)) as fr:
+                fw_rule_ids = [r['firewall_rule']['id'] for r in fr]
+                data = {'firewall_policy':
+                        {'firewall_rules': fw_rule_ids}}
+                req = self.new_update_request('firewall_policies', data,
+                                              fwp_id)
+                req.get_response(self.ext_api)
+                attrs = self._get_test_firewall_attrs()
+                attrs['firewall_policy_id'] = fwp_id
+                with self.firewall(firewall_policy_id=fwp_id,
+                                   admin_state_up=
+                                   test_db_firewall.ADMIN_STATE_UP,
+                                   no_delete=True) as fw:
+                    fw_id = fw['firewall']['id']
+                    fw_rules = (
+                        self.plugin._make_firewall_dict_with_rules(ctx,
+                                                                   fw_id)
+                    )
+                    self.assertEqual(fw_rules['id'], fw_id)
+                    self._compare_firewall_rule_lists(
+                        fwp_id, fr, fw_rules['firewall_rule_list'])
+
+    def test_make_firewall_dict_with_in_place_rules_no_policy(self):
+        ctx = context.get_admin_context()
+        with self.firewall(no_delete=True) as fw:
+            fw_id = fw['firewall']['id']
+            fw_rules = self.plugin._make_firewall_dict_with_rules(ctx, fw_id)
+            self.assertEquals(fw_rules['firewall_rule_list'], [])

neutron/tests/unit/test_extension_firewall.py

@@ -0,0 +1,552 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright 2013 Big Switch Networks, Inc.
+# All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the spec
+#
+# @author: Sumit Naiksatam, sumitnaiksatam@gmail.com, Big Switch Networks, Inc.
+
+import copy
+
+import mock
+from oslo.config import cfg
+from webob import exc
+import webtest
+
+from neutron.api import extensions
+from neutron.api.v2 import attributes
+from neutron.common import config
+from neutron.extensions import firewall
+from neutron import manager
+from neutron.openstack.common import uuidutils
+from neutron.plugins.common import constants
+from neutron.tests import base
+from neutron.tests.unit import test_api_v2
+from neutron.tests.unit import test_extensions
+from neutron.tests.unit import testlib_api
+
+
+_uuid = uuidutils.generate_uuid
+_get_path = test_api_v2._get_path
+
+
+class FirewallTestExtensionManager(object):
+
+    def get_resources(self):
+        # Add the resources to the global attribute map
+        # This is done here as the setup process won't
+        # initialize the main API router which extends
+        # the global attribute map
+        attributes.RESOURCE_ATTRIBUTE_MAP.update(
+            firewall.RESOURCE_ATTRIBUTE_MAP)
+        return firewall.Firewall.get_resources()
+
+    def get_actions(self):
+        return []
+
+    def get_request_extensions(self):
+        return []
+
+
+class FirewallExtensionTestCase(testlib_api.WebTestCase):
+    fmt = 'json'
+
+    def setUp(self):
+        super(FirewallExtensionTestCase, self).setUp()
+        plugin = 'neutron.extensions.firewall.FirewallPluginBase'
+        # Ensure 'stale' patched copies of the plugin are never returned
+        manager.NeutronManager._instance = None
+
+        # Ensure existing ExtensionManager is not used
+        extensions.PluginAwareExtensionManager._instance = None
+
+        # Create the default configurations
+        args = ['--config-file', test_api_v2.etcdir('neutron.conf.test')]
+        config.parse(args)
+
+        # Stubbing core plugin with Firewall plugin
+        cfg.CONF.set_override('core_plugin', plugin)
+        cfg.CONF.set_override('service_plugins', [plugin])
+
+        self._plugin_patcher = mock.patch(plugin, autospec=True)
+        self.plugin = self._plugin_patcher.start()
+        instance = self.plugin.return_value
+        instance.get_plugin_type.return_value = constants.FIREWALL
+
+        ext_mgr = FirewallTestExtensionManager()
+        self.ext_mdw = test_extensions.setup_extensions_middleware(ext_mgr)
+        self.api = webtest.TestApp(self.ext_mdw)
+        super(FirewallExtensionTestCase, self).setUp()
+
+    def tearDown(self):
+        self._plugin_patcher.stop()
+        self.api = None
+        self.plugin = None
+        cfg.CONF.reset()
+        super(FirewallExtensionTestCase, self).tearDown()
+
+    def _test_entity_delete(self, entity):
+        """Does the entity deletion based on naming convention."""
+        entity_id = _uuid()
+        path_prefix = 'fw/'
+
+        if entity == 'firewall_policy':
+            entity_plural = 'firewall_policies'
+        else:
+            entity_plural = entity + 's'
+
+        res = self.api.delete(_get_path(path_prefix + entity_plural,
+                                        id=entity_id, fmt=self.fmt))
+        delete_entity = getattr(self.plugin.return_value, "delete_" + entity)
+        delete_entity.assert_called_with(mock.ANY, entity_id)
+        self.assertEqual(res.status_int, exc.HTTPNoContent.code)
+
+    def test_create_firewall(self):
+        fw_id = _uuid()
+        data = {'firewall': {'description': 'descr_firewall1',
+                             'name': 'firewall1',
+                             'admin_state_up': True,
+                             'firewall_policy_id': _uuid(),
+                             'shared': False,
+                             'tenant_id': _uuid()}}
+        return_value = copy.copy(data['firewall'])
+        return_value.update({'id': fw_id})
+        # since 'shared' is hidden
+        del return_value['shared']
+
+        instance = self.plugin.return_value
+        instance.create_firewall.return_value = return_value
+        res = self.api.post(_get_path('fw/firewalls', fmt=self.fmt),
+                            self.serialize(data),
+                            content_type='application/%s' % self.fmt)
+        instance.create_firewall.assert_called_with(mock.ANY,
+                                                    firewall=data)
+        self.assertEqual(res.status_int, exc.HTTPCreated.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall', res)
+        self.assertEqual(res['firewall'], return_value)
+
+    def test_firewall_list(self):
+        fw_id = _uuid()
+        return_value = [{'tenant_id': _uuid(),
+                         'id': fw_id}]
+
+        instance = self.plugin.return_value
+        instance.get_firewalls.return_value = return_value
+
+        res = self.api.get(_get_path('fw/firewalls', fmt=self.fmt))
+
+        instance.get_firewalls.assert_called_with(mock.ANY,
+                                                  fields=mock.ANY,
+                                                  filters=mock.ANY)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+
+    def test_firewall_get(self):
+        fw_id = _uuid()
+        return_value = {'tenant_id': _uuid(),
+                        'id': fw_id}
+
+        instance = self.plugin.return_value
+        instance.get_firewall.return_value = return_value
+
+        res = self.api.get(_get_path('fw/firewalls',
+                                     id=fw_id, fmt=self.fmt))
+
+        instance.get_firewall.assert_called_with(mock.ANY,
+                                                 fw_id,
+                                                 fields=mock.ANY)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall', res)
+        self.assertEqual(res['firewall'], return_value)
+
+    def test_firewall_update(self):
+        fw_id = _uuid()
+        update_data = {'firewall': {'name': 'new_name'}}
+        return_value = {'tenant_id': _uuid(),
+                        'id': fw_id}
+
+        instance = self.plugin.return_value
+        instance.update_firewall.return_value = return_value
+
+        res = self.api.put(_get_path('fw/firewalls', id=fw_id,
+                                     fmt=self.fmt),
+                           self.serialize(update_data))
+
+        instance.update_firewall.assert_called_with(mock.ANY, fw_id,
+                                                    firewall=update_data)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall', res)
+        self.assertEqual(res['firewall'], return_value)
+
+    def test_firewall_delete(self):
+        self._test_entity_delete('firewall')
+
+    def _test_create_firewall_rule(self, src_port, dst_port):
+        rule_id = _uuid()
+        data = {'firewall_rule': {'description': 'descr_firewall_rule1',
+                                  'name': 'rule1',
+                                  'shared': False,
+                                  'protocol': 'tcp',
+                                  'ip_version': 4,
+                                  'source_ip_address': '192.168.0.1',
+                                  'destination_ip_address': '127.0.0.1',
+                                  'source_port': src_port,
+                                  'destination_port': dst_port,
+                                  'action': 'allow',
+                                  'enabled': True,
+                                  'tenant_id': _uuid()}}
+        expected_ret_val = copy.copy(data['firewall_rule'])
+        expected_ret_val['source_port'] = str(src_port)
+        expected_ret_val['destination_port'] = str(dst_port)
+        expected_call_args = copy.copy(expected_ret_val)
+        expected_ret_val['id'] = rule_id
+        instance = self.plugin.return_value
+        instance.create_firewall_rule.return_value = expected_ret_val
+        res = self.api.post(_get_path('fw/firewall_rules', fmt=self.fmt),
+                            self.serialize(data),
+                            content_type='application/%s' % self.fmt)
+        instance.create_firewall_rule.assert_called_with(mock.ANY,
+                                                         firewall_rule=
+                                                         {'firewall_rule':
+                                                          expected_call_args})
+        self.assertEqual(res.status_int, exc.HTTPCreated.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall_rule', res)
+        self.assertEqual(res['firewall_rule'], expected_ret_val)
+
+    def test_create_firewall_rule_with_integer_ports(self):
+        self._test_create_firewall_rule(1, 10)
+
+    def test_create_firewall_rule_with_string_ports(self):
+        self._test_create_firewall_rule('1', '10')
+
+    def test_create_firewall_rule_with_port_range(self):
+        self._test_create_firewall_rule('1:20', '30:40')
+
+    def test_firewall_rule_list(self):
+        rule_id = _uuid()
+        return_value = [{'tenant_id': _uuid(),
+                         'id': rule_id}]
+
+        instance = self.plugin.return_value
+        instance.get_firewall_rules.return_value = return_value
+
+        res = self.api.get(_get_path('fw/firewall_rules', fmt=self.fmt))
+
+        instance.get_firewall_rules.assert_called_with(mock.ANY,
+                                                       fields=mock.ANY,
+                                                       filters=mock.ANY)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+
+    def test_firewall_rule_get(self):
+        rule_id = _uuid()
+        return_value = {'tenant_id': _uuid(),
+                        'id': rule_id}
+
+        instance = self.plugin.return_value
+        instance.get_firewall_rule.return_value = return_value
+
+        res = self.api.get(_get_path('fw/firewall_rules',
+                                     id=rule_id, fmt=self.fmt))
+
+        instance.get_firewall_rule.assert_called_with(mock.ANY,
+                                                      rule_id,
+                                                      fields=mock.ANY)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall_rule', res)
+        self.assertEqual(res['firewall_rule'], return_value)
+
+    def test_firewall_rule_update(self):
+        rule_id = _uuid()
+        update_data = {'firewall_rule': {'action': 'deny'}}
+        return_value = {'tenant_id': _uuid(),
+                        'id': rule_id}
+
+        instance = self.plugin.return_value
+        instance.update_firewall_rule.return_value = return_value
+
+        res = self.api.put(_get_path('fw/firewall_rules', id=rule_id,
+                                     fmt=self.fmt),
+                           self.serialize(update_data))
+
+        instance.update_firewall_rule.assert_called_with(mock.ANY,
+                                                         rule_id,
+                                                         firewall_rule=
+                                                         update_data)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall_rule', res)
+        self.assertEqual(res['firewall_rule'], return_value)
+
+    def test_firewall_rule_delete(self):
+        self._test_entity_delete('firewall_rule')
+
+    def test_create_firewall_policy(self):
+        policy_id = _uuid()
+        data = {'firewall_policy': {'description': 'descr_firewall_policy1',
+                                    'name': 'new_fw_policy1',
+                                    'shared': False,
+                                    'firewall_rules': [_uuid(), _uuid()],
+                                    'audited': False,
+                                    'tenant_id': _uuid()}}
+        return_value = copy.copy(data['firewall_policy'])
+        return_value.update({'id': policy_id})
+
+        instance = self.plugin.return_value
+        instance.create_firewall_policy.return_value = return_value
+        res = self.api.post(_get_path('fw/firewall_policies',
+                                      fmt=self.fmt),
+                            self.serialize(data),
+                            content_type='application/%s' % self.fmt)
+        instance.create_firewall_policy.assert_called_with(mock.ANY,
+                                                           firewall_policy=
+                                                           data)
+        self.assertEqual(res.status_int, exc.HTTPCreated.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall_policy', res)
+        self.assertEqual(res['firewall_policy'], return_value)
+
+    def test_firewall_policy_list(self):
+        policy_id = _uuid()
+        return_value = [{'tenant_id': _uuid(),
+                         'id': policy_id}]
+
+        instance = self.plugin.return_value
+        instance.get_firewall_policies.return_value = return_value
+
+        res = self.api.get(_get_path('fw/firewall_policies',
+                                     fmt=self.fmt))
+
+        instance.get_firewall_policies.assert_called_with(mock.ANY,
+                                                          fields=mock.ANY,
+                                                          filters=mock.ANY)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+
+    def test_firewall_policy_get(self):
+        policy_id = _uuid()
+        return_value = {'tenant_id': _uuid(),
+                        'id': policy_id}
+
+        instance = self.plugin.return_value
+        instance.get_firewall_policy.return_value = return_value
+
+        res = self.api.get(_get_path('fw/firewall_policies',
+                                     id=policy_id, fmt=self.fmt))
+
+        instance.get_firewall_policy.assert_called_with(mock.ANY,
+                                                        policy_id,
+                                                        fields=mock.ANY)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall_policy', res)
+        self.assertEqual(res['firewall_policy'], return_value)
+
+    def test_firewall_policy_update(self):
+        policy_id = _uuid()
+        update_data = {'firewall_policy': {'audited': True}}
+        return_value = {'tenant_id': _uuid(),
+                        'id': policy_id}
+
+        instance = self.plugin.return_value
+        instance.update_firewall_policy.return_value = return_value
+
+        res = self.api.put(_get_path('fw/firewall_policies',
+                                     id=policy_id,
+                                     fmt=self.fmt),
+                           self.serialize(update_data))
+
+        instance.update_firewall_policy.assert_called_with(mock.ANY,
+                                                           policy_id,
+                                                           firewall_policy=
+                                                           update_data)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertIn('firewall_policy', res)
+        self.assertEqual(res['firewall_policy'], return_value)
+
+    def test_firewall_policy_delete(self):
+        self._test_entity_delete('firewall_policy')
+
+    def test_firewall_policy_insert_rule(self):
+        firewall_policy_id = _uuid()
+        firewall_rule_id = _uuid()
+        ref_firewall_rule_id = _uuid()
+
+        insert_data = {'firewall_rule_id': firewall_rule_id,
+                       'insert_before': ref_firewall_rule_id,
+                       'insert_after': None}
+        return_value = {'firewall_policy':
+                        {'tenant_id': _uuid(),
+                         'id': firewall_policy_id,
+                         'firewall_rules': [ref_firewall_rule_id,
+                                            firewall_rule_id]}}
+
+        instance = self.plugin.return_value
+        instance.insert_rule.return_value = return_value
+
+        path = _get_path('fw/firewall_policies', id=firewall_policy_id,
+                         action="insert_rule",
+                         fmt=self.fmt)
+        res = self.api.put(path, self.serialize(insert_data))
+        instance.insert_rule.assert_called_with(mock.ANY, firewall_policy_id,
+                                                insert_data)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertEqual(res, return_value)
+
+    def test_firewall_policy_remove_rule(self):
+        firewall_policy_id = _uuid()
+        firewall_rule_id = _uuid()
+
+        remove_data = {'firewall_rule_id': firewall_rule_id}
+        return_value = {'firewall_policy':
+                        {'tenant_id': _uuid(),
+                         'id': firewall_policy_id,
+                         'firewall_rules': []}}
+
+        instance = self.plugin.return_value
+        instance.remove_rule.return_value = return_value
+
+        path = _get_path('fw/firewall_policies', id=firewall_policy_id,
+                         action="remove_rule",
+                         fmt=self.fmt)
+        res = self.api.put(path, self.serialize(remove_data))
+        instance.remove_rule.assert_called_with(mock.ANY, firewall_policy_id,
+                                                remove_data)
+        self.assertEqual(res.status_int, exc.HTTPOk.code)
+        res = self.deserialize(res)
+        self.assertEqual(res, return_value)
+
+
+class FirewallExtensionTestCaseXML(FirewallExtensionTestCase):
+    fmt = 'xml'
+
+
+class TestFirewallAttributeValidators(base.BaseTestCase):
+
+    def test_validate_port_range(self):
+        msg = firewall._validate_port_range(None)
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_port_range('10')
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_port_range(10)
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_port_range(-1)
+        self.assertEqual(msg, "Invalid port '-1'")
+
+        msg = firewall._validate_port_range('66000')
+        self.assertEqual(msg, "Invalid port '66000'")
+
+        msg = firewall._validate_port_range('10:20')
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_port_range('1:65535')
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_port_range('0:65535')
+        self.assertEqual(msg, "Invalid port '0'")
+
+        msg = firewall._validate_port_range('1:65536')
+        self.assertEqual(msg, "Invalid port '65536'")
+
+        msg = firewall._validate_port_range('abc:efg')
+        self.assertEqual(msg, "Port 'abc' is not a valid number")
+
+        msg = firewall._validate_port_range('1:efg')
+        self.assertEqual(msg, "Port 'efg' is not a valid number")
+
+        msg = firewall._validate_port_range('-1:10')
+        self.assertEqual(msg, "Invalid port '-1'")
+
+        msg = firewall._validate_port_range('66000:10')
+        self.assertEqual(msg, "Invalid port '66000'")
+
+        msg = firewall._validate_port_range('10:66000')
+        self.assertEqual(msg, "Invalid port '66000'")
+
+        msg = firewall._validate_port_range('1:-10')
+        self.assertEqual(msg, "Invalid port '-10'")
+
+    def test_validate_ip_or_subnet_or_none(self):
+        msg = firewall._validate_ip_or_subnet_or_none(None)
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_ip_or_subnet_or_none('1.1.1.1')
+        self.assertIsNone(msg)
+
+        msg = firewall._validate_ip_or_subnet_or_none('1.1.1.0/24')
+        self.assertIsNone(msg)
+
+        ip_addr = '1111.1.1.1'
+        msg = firewall._validate_ip_or_subnet_or_none(ip_addr)
+        self.assertEqual(msg, ("'%s' is not a valid IP address and "
+                               "'%s' is not a valid IP subnet") % (ip_addr,
+                                                                   ip_addr))
+
+        ip_addr = '1.1.1.1 has whitespace'
+        msg = firewall._validate_ip_or_subnet_or_none(ip_addr)
+        self.assertEqual(msg, ("'%s' is not a valid IP address and "
+                               "'%s' is not a valid IP subnet") % (ip_addr,
+                                                                   ip_addr))
+
+        ip_addr = '111.1.1.1\twhitespace'
+        msg = firewall._validate_ip_or_subnet_or_none(ip_addr)
+        self.assertEqual(msg, ("'%s' is not a valid IP address and "
+                               "'%s' is not a valid IP subnet") % (ip_addr,
+                                                                   ip_addr))
+
+        ip_addr = '111.1.1.1\nwhitespace'
+        msg = firewall._validate_ip_or_subnet_or_none(ip_addr)
+        self.assertEqual(msg, ("'%s' is not a valid IP address and "
+                               "'%s' is not a valid IP subnet") % (ip_addr,
+                                                                   ip_addr))
+
+        # Valid - IPv4
+        cidr = "10.0.2.0/24"
+        msg = firewall._validate_ip_or_subnet_or_none(cidr, None)
+        self.assertIsNone(msg)
+
+        # Valid - IPv6 without final octets
+        cidr = "fe80::/24"
+        msg = firewall._validate_ip_or_subnet_or_none(cidr, None)
+        self.assertIsNone(msg)
+
+        # Valid - IPv6 with final octets
+        cidr = "fe80::0/24"
+        msg = firewall._validate_ip_or_subnet_or_none(cidr, None)
+        self.assertEqual(msg, ("'%s' is not a valid IP address and "
+                               "'%s' isn't a recognized IP subnet cidr,"
+                               " 'fe80::/24' is recommended") % (cidr,
+                                                                 cidr))
+
+        cidr = "fe80::"
+        msg = firewall._validate_ip_or_subnet_or_none(cidr, None)
+        self.assertIsNone(msg)
+
+        # Invalid - IPv6 with final octets, missing mask
+        cidr = "fe80::0"
+        msg = firewall._validate_ip_or_subnet_or_none(cidr, None)
+        self.assertIsNone(msg)
+
+        # Invalid - Address format error
+        cidr = 'invalid'
+        msg = firewall._validate_ip_or_subnet_or_none(cidr, None)
+        self.assertEqual(msg, ("'%s' is not a valid IP address and "
+                               "'%s' is not a valid IP subnet") % (cidr,
+                                                                   cidr))