'Tests port_security extension enforces mac spoofing
Neutron security groups always apply anti-spoof rules on the VMs. This
allows traffic to originate and terminate at the VM as expected, but
prevents traffic to pass through the VM. Anti-spoof rules are not
required in cases where the VM routes traffic through it.
The test steps are :
1. Create a new network.
2. Connect (hotplug) the VM to a new network.
3. Check the VM can ping a server on the new network ("peer")
4. Spoof the mac address of the new VM interface.
5. Check the Security Group enforces mac spoofing and blocks pings via
spoofed interface (VM cannot ping the peer).
6. Disable port-security of the spoofed port- set the flag to false.
7. Retest 3rd step and check that the Security Group allows pings via
the spoofed interface.'

@test.requires_ext(service='network', extension='port-security')
@testtools.skipUnless(CONF.compute_feature_enabled.interface_attach, 'NIC    hotplug    not    available')
@decorators.idempotent_id('7c0bb1a2-d053-49a4-98f9-ca1a1d849f63')
@decorators.attr(type='slow')
@test.services('compute', 'network')
def test_port_security_macspoofing_port(self):

    spoof_mac = '00:00:00:00:00:01'
    self._setup_network_and_servers()
    self.check_public_network_connectivity(should_connect=True)
    self._create_new_network()
    self._hotplug_server()
    (fip, server) = self.floating_ip_tuple
    new_ports = self.os_admin.ports_client.list_ports(device_id=server['id'], network_id=self.new_net['id'])['ports']
    spoof_port = new_ports[0]
    private_key = self._get_server_key(server)
    ssh_client = self.get_remote_client(fip['floating_ip_address'], private_key=private_key, server=server)
    spoof_nic = ssh_client.get_nic_name_by_mac(spoof_port['mac_address'])
    peer = self._create_server(self.new_net)
    peer_address = peer['addresses'][self.new_net['name']][0]['addr']
    self.check_remote_connectivity(ssh_client, dest=peer_address, nic=spoof_nic, should_succeed=True)
    cmd = 'sudo    ip    link    set    {nic}    down;sudo    ip    link    set    dev    {nic}    address    {mac};sudo    ip    link    set    {nic}    up'.format(nic=spoof_nic, mac=spoof_mac)
    ssh_client.exec_command(cmd)
    new_mac = ssh_client.get_mac_address(nic=spoof_nic)
    self.assertEqual(spoof_mac, new_mac)
    self.check_remote_connectivity(ssh_client, dest=peer_address, nic=spoof_nic, should_succeed=False)
    self.ports_client.update_port(spoof_port['id'], port_security_enabled=False, security_groups=[])
    self.check_remote_connectivity(ssh_client, dest=peer_address, nic=spoof_nic, should_succeed=True)
