add rootwrap filters to wrap ip netns exec

fixes bug 1044083

This patch adds specific filters for the ip command. The first filter
matches ip with any subcomand except netns exec.  The second filter
matches "ip netns exec" and then relies on the caller (match_filter) to
verify the sub-command against the other filters. Matching the
subcommand separately allows for a single set of filter definitions that
work with and without namespaces.

Change-Id: Ifd0378dc3461f84867efb3cb60396d9cfa9e582d
restart dnsmasq when subnet cidr set changes

fixes bug 1045828

The original bug occurred because the set of subnet cidrs changed
without a restart of dnsmasq.  As a result, dnsmasq would not respond
with offers for fixed_ips assigned in the unknown cidr ranges even when
the underlying host file had properly updated.

This patch addresses the bug by restarting dnsmasq when the set of
subnet cidrs changes.  When the set does not change, it will reload the
options and allocations.

Change-Id: I0e257208750703f4a32c51d1323786e76e676bb6
Merge "restart dnsmasq when subnet cidr set changes"
Merge "add rootwrap filters to wrap ip netns exec"
Make sure floating IPs  + gateways must be on external nets

bug #1042030

- adds admin-writable, world-readable router:external attribute to
the network object if L3 extension is loaded.
- prevents floating ips from being created unless network is external
- shortens L3 extensions alias from 'os-quantum-router' to 'router' to
make attribute extensions more readable.

WIP:
- Need to add policy logic so non-admin users can always see external
networks without requiring that these networks are shared (since VMs can
always create ports on shared networks, but provider may want to have
externals networks that VMs cannot directly plug into.

Random clean-up:
- prevent delete_network in plugins from implying it returns something
- modify extensions.py so that exceptions during calls to
get_extended_resources() will actually be logged if unexpected.
- unset executable bit on test_iptables_manager.py to make sure tox
actually runs it.

Change-Id: I5bbf063927b93458da7cb467d9ad5c92ebabbbf7
Allocation pool creation should check if gateway is in subnet

Fixes bug 1046192

If the configured gateway is not in the subnet then it should not be
used for the allocation pool creation.

Change-Id: Ifba766a13d860b58d21034db278c6b24d4c126e7
Merge "Allocation pool creation should check if gateway is in subnet"
Lower webob dep from v1.2.0 to v1.0.8

All other OpenStack projects expect webob v1.0.8 yet Quantum expects
v1.2.0. This discrepancy causes problems for certain projects that
can't actually support v1.2.0 yet. This patch aligns the required
version with that which the other OpenStack projects expect.

Change-Id: I21b4c6c79a0382f241131f22edbeba22388a688d
Merge "Lower webob dep from v1.2.0 to v1.0.8"
Improve error message when flat network already exists

Fixes bug 1045601.

When attempting to create a flat network on a physical_network on
which a flat network is already allocated, the openvswitch and
linuxbridge plugins return a FlatNetworkInUse exception rather than a
VlanIdInUse exception referencing VLAN -1.

Change-Id: Id79e917e1376ebbb199efc3f14d9f378c6a04050
Modified code pyflakes warning.

W402 'version_string' imported but unused

Change-Id: I6dad8661c2dc0358821f76b911b13b21e788d738
Modified code Pyflakes warning.

File dhcp.py:
W402 'textwrap' imported but unused
W402 'importutils' imported but unused

Change-Id: I5b3cee932ad224486ba3fbf4bbd44005b1200bfb
Merge "Improve error message when flat network already exists"
Add missing include for logging when log_config is used

Fixes bug 1047273

Change-Id: I7fb8a504acf8fa910100d9798e2a35274aa5a103
Merge "Modified code Pyflakes warning."
Merge "Add missing include for logging when log_config is used"
Fix dhcp agent rpc exception handling

fixes bug 1046904

This patch adds exception handling to log rpc exceptions.  Previously,
the agent would terminate due to uncaught errors during initialization.

Change-Id: I4835c1616e2ccfc9c42c591e8c7446db50721d01
remove incorrect mock assert_called in unit tests

fixes bug 1047569

The unit tests were calling a nonexistent assert_called() on the
mocks.  This patch fixes the problem by using the correct assert for
checking that the mocked method was invoked.

Note: This patch does not fix the error in test_call_driver() because a
separate bug fix revises the test.

Change-Id: Ie62e2e64f314f9ba34761e63cd5d0d6e44c5d094
Fix data passed to policy engine on update

fix bug 1044218

The original resource status fetched to the db was not being
properly updated with the request body before feeding it to the
policy engine

Change-Id: I9f71e40edf44136a40fad1ef272696d6b3ea352d
add local network type and use by default for tenant networks

Fixes bug 1045142.

This patch adds 'local' as a new value for provider:network_type,
supported by the openvswitch and linuxbridge plugins. Networks of this
type provide connectivity through a bridge for VMs and agents local to
the host, but no external connectivity. They do not require
provider:physical_network or provider:segmentation_id values. These
local networks are intended mainly to support single-box
zero-configuration testing (including quantum gating), but may have
other uses as well.

For openvswitch, the new OVS.tenant_network_type configuration
variable selects what type of networks are allocated as tenant
(i.e. non-provider) networks. It defaults to 'local', but must be
changed to 'vlan' or 'gre' for openvswitch tenant networks to have
external connectivity. The default value is intended to support
single-box zero-configuration testing without any need to allocate
physical network resources or configure bridges, and without requiring
the operating system to support OVS GRE tunneling. It can also be set
to 'none' to completely disable creation of tenant networks.

For linuxbridge, the new VLANS.tenant_network_type configuration
variable works similarly, with a value of 'vlan' supporting tenant
networks with external connectivity.

With either plugin, administrators can create provider local networks
by specifying "--provider:network_type local". Additionally, with
openvswitch, provider GRE networks can now be created by specifying
"--provider:network_type gre --provider:segmentation_id <tunnel-id>".

A corresponding devstack patch is available at
https://review.openstack.org/#/c/12456/. With this patch, the
openvswitch and linuxbridge plugins are by default configured to
support only local networks. A set of shell variables, documented in
stack.sh, can be set in localrc to configure remote connectivity,
including bridges/interfaces available for provider networks.

Change-Id: I2812548326141d2212d04f34d5448fb974d298e0