Disable secgroup extension when Noop Firewall driver is used

When Noop Firewall driver is used, Quantum security group actually does
nothing in OVS and Linux Bridge plugin. It would be better to disable
security group extension for such case to avoid confusion.
By this we can determine whether quantum security group is enabled
by checking the extension list.
This commit changes OVS/LB/NEC/Ryu plugins with agent firewall_driver
based security group implementation.

Fixes bug #1124117

Change-Id: I2182289c1e27987b686f1adb7d6e2ad4e154caa2
Update tox.ini to support RHEL 6.x.

In order to support running unit tests on RHEL 6.x we need to patch
eventlet with contrib/redhat-eventlet.patch. We already
have support for this in the tools/install_venv_common.py but we
need to make a couple changes to allow tox to consume this:

1) Sync in the latest intall_venv_common.py from oslo. This changes
 patch to use the -N option (ignore already applied patches) and
 makes it safe to call the patching function more than once.

2) Add a new patch_tox_venv.py script in tools.

3) Update tox.ini to call patch_tox_venv.py before it runs tests and
 coverage.

NOTE: This will hopefully go away eventually once this patch lands:

 https://bitbucket.org/eventlet/eventlet/issue/89/add-a-timeout-argument-to-subprocesspopen#comment-3342969

Change-Id: I3e2b07c3f718e4aede5c5f231ff0cdb7721ec885
Add explicit egress rules to nvp security profile

The following commit  7e26074b changed the previous behavior of quantum
security groups by explicitly adding egress rules to the security profile.
When these rules are removed the vm is no longer able to send traffic out.

This patch adds these rules for NVP. One thing to note in the patch
is that now a bunk rule of IPv4 127.0.0.1/32 is added to each security
profile. The reason for this is by default NVP security profiles allow
all egress traffic until a rule is added and then it just lets traffic
matching those rules out. Adding this bunk rule achieves this behavior
that quantum now uses.

Fixes bug 1150378

Change-Id: I005880fcf39d539ae99be428d75c43cc0b39a7b6
Update to Quantum Client 2.2.0

This patch updates tools/pip-requires to use the python-quantumclient 2.2
It also limits the version to <3.0.0 to prevent breaking something accidently
when 3.0.0 is released.

Fixes bug 1152695

Change-Id: Iec52ffe91793567c7707843a80a282bd51eb0c76
Do not delete subnets with IPs on router interfaces

Bug 1152171

This patch simply causes a 409 to be returned when attempting to
delete a subnet which has IPs on ports whose device_owner is
network:router_interface

This does not address a similar problem that arises when the ips for
a port owned by a router_interface are updated. This problem is hidden
when updating a port which has been assigned the gateway_ip by an
exception in the IP recycling process. However, it will hit when the
port was explicitly added to the router, since it will have an ip
different from the subnet's gateway ip.

Change-Id: I38dfd2639acd03db8d3f1f933495a456a4a8724f
Filter out router ports without IPs when gathering router sync data

Bug 1152050

Change-Id: Idd11d5f953129471c09f44b4f7c75dc9899d6783
Ensure metadata access network does not prevent router deletion

Bug 1152136

This patch checks if a metadata access network is still present when
removing a router in the NVP plugin. If yes, the network is detached
from the router and then destroyed, thus ensuring a safe completion of
the operation as well as removal of metadata access network resources.

Change-Id: Id8be6ec50ab4536f4ae9916dadaed56644597c7c
Imported Translations from Transifex

Change-Id: I04aea4ba6c5ac4c3324d0642f19e7279c340c7f6
NVP plugin: return 409 if wrong router interface info on remove

Bug 1152167

Raise an exception causing a 409 error to be returned if port_id or
subnet_id specified in request body do not exist before further
processing the operation (which will cause a 500 error to be
returned to the user)

Change-Id: I347dd86da87ce5b1e57e139e4c21d4533a456cbc
Merge "Update to Quantum Client 2.2.0"
Merge "Imported Translations from Transifex"
Merge "Filter out router ports without IPs when gathering router sync data"
Merge "Do not delete subnets with IPs on router interfaces"
Merge "Disable secgroup extension when Noop Firewall driver is used"
Merge "Ensure metadata access network does not prevent router deletion"
Merge "NVP plugin: return 409 if wrong router interface info on remove"
Imported Translations from Transifex

Change-Id: Id200d6035d1716b5c81aee27d3290e2240259224
Log the configuration options for metadata-proxy and agent.

Bug #1144370

Change-Id: I35ac570dd55006d0133736588f0302d6f70294de
Fix typo

Fixes bug 1153132

Change-Id: I66d8bb16cbecc5072d20d2a9b8db8ebf598bf291
Merge "Fix typo"