Implements support for multiple local subnets for IPSec site to site
connections, using the new Endpoint Group API.
The implementation supports backwards compatibility as follows. If
a VPN service is created with a subnet, then the older API is assumed
and the user must specify the peer CIDRs for any IPSec connections
and cannot specify multiple local subnets.
If a subnet is not provided for the VPN service, then the user must
use the newer API and provide a local and peer endpoint group IDs for
the IPSec connection (and cannot specify the peer CIDRs in the IPSec
connection API).
Implication here is that the subnet will be an optional argument for
the VPN service API.
With this feature, when an endpoint group is deleted, a check is made
to ensure that there are no IPSec connections using the group.
Migration will move the subnet from VPN service API to a new endpoint
group, and specify the group in any connections using the service.
The peer CIDR(s) will be moved from each connection to an endpoint
group, with the group ID specified in the connection.
Note: As part of testing the database methods for this feature, several
more tests were created to test database access only, instead of doing
a round trip test. In a separate commit, these tests can be expanded,
and the existing round trip tests removed.
Note: Tests for building the dict used in sync requests was enhanced,
as part of supporting this feature. The previous tests didn't check
that the peer CIDR information was correct, so were enhanced as well.
Note: The service driver passes the local CIDR(s) in a new field,
called local_cidrs. This field is used for the older API, as well,
passing the subnet's CIDR, and allowing consistent consumption by the
device driver. The IP version is also passed, rather than obtaining
it from the subnet info (so both new and old API use the same fields).
Note: to support rolling upgrades, where an agent may be using the older
release, after the server has been updated, the subnet CIDR field passed
from the service driver to device driver, will be populated from the
first local endpoint from the first connection (there has to be at least
one connection, when sending data to the agent).
Note: In the device driver, I noticed that the local CIDR's IP version
can change the config file output, so I added test cases for IPv6, as
part of enhancing the tests for multiple local CIDRs.
Change-Id: I7a011e3170d7db463a6561e550b2ead3e3311125
Partial-Bug: 1459423
7ba17a3155