Limit min<=max port check to TCP/UDP in secgroup rule

icmp_type and icmp_code are mapped to port_min_range and port_max_range
respectively. For ICMP there is no constraint between type and code.
Thus port range min<=max check should be enforced only for TCP and UDP.

Also makes sure that ICMP type/code are 0 to 255 (both inclusive).
Previously a value with 0 to 65535 were accepted for ICMP type/code.

Fixes bug 1197760
Fixes bug 1197769

Change-Id: I70aaf6e02fee461fa97dc254db906d9efa173669
Preserve packet:byte counts in iptables_manager.

Ported the nova iptables manager code to neutron, so that we
use iptables-save/restore with the -c flag to save/restore
the chains and rules with their packet:byte counts.  All other
changes were ported as well to keep the code as similar as
possible between the two, although they will be different as
I had to fix other bugs found during testing.

Updated tests accordingly to account for new calls and
input/output changes in formatting.

Changed iptables_firewall code to add iptables rules in the same
order that iptables-save will print them: source/dest, protocol,
sport, dport, target; else iptables_manager won't be able
to find them to preserve their [packet:byte] counts.
Tweaked other rules accordingly as necessary.

Fixed a bug introduced in an earlier version of this patch where
_modify_rules() sometimes wouldn't match an existing rule correctly
if not top=true.

Fixes bug 1125393

Change-Id: I858c552d8a7ae24f52f8e8daa05ac37026705773
Add support for the extra route extension in the NVP plugin.

The underlying feature is available in NVP 3.2, which introduces a
new type of router. Therefore, create_lrouter needs to be made
version 'aware'.

This led to a number of fixes in the nvplib, especially around how
version is retrieved and how version-dependent methods are called.

Implements blueprint nvp-extra-route-extension

Change-Id: Ie4e2d93f70e1948a62563c8523aea61bb2194c84
Enable logging before using it

Bug #1200530

Change-Id: I086353c93fae0f6ec74d16a485c215c1b3815ee6
Use the correct tunnel_type to notify agents

Bug #1201274

Change-Id: I9de55d168ba03cb6a5273b4c2ce140cd190e38ee
Merge "Add support for the extra route extension in the NVP plugin."
Imported Translations from Transifex

Change-Id: I241d1c1217fcf32e2d02832db15a9c5ab5da4359
Fix random OverflowError exceptions in gate-neutron-python26 tests

These errors seem to be linked to the NEC plugin and http connections
not being stubbed out correctly. This patch ensures do_request is
stubbed out prior to the tests execution; this should be enough
to prevent timeouts from occurring again. Stubbing out the call has
no effect on the coverage of the agent scheduler tests for the NEC
plugin.

Fixes bug #1201478

Change-Id: Iee3cb3cb3137cedcf97c707ea7fde9114b7264b6
Nicira NVP plugin support for l3_ext_gw_mode extension

Bug 1121129

This patch adds support the 'configurable external gateway' extension
in the NVP plugin.

Change-Id: I531ebe0053b1b9e21d6f0685776acebe3173b170
Ensure PortSecurityDBTestCase loads correct plugin

Bug 1201569

If a plugin is passed to the setUp method, that plugin
should be loaded instead od DB_PLUGIN_KLASS

Change-Id: I81df9f62e7399f5a76a07e504679ee8311e5855e
Re-assign quantum.api module as last operation

Bug 1199443

This avoids reset of locals in quantum/api/__init__.py,
resulting in sys being None when assigning quantum.api.extensions
to neutron.api.extensions

Change-Id: I2da8b336679b643c92824399a05ca1b9980d1598
Merge "Fix random OverflowError exceptions in gate-neutron-python26 tests"
Merge "Preserve packet:byte counts in iptables_manager."
Merge "Re-assign quantum.api module as last operation"
Merge "Ensure PortSecurityDBTestCase loads correct plugin"
Merge "Use the correct tunnel_type to notify agents"
xenapi - rename quantum to neutron

Some changes were missing from the previous rename patch, so it broke
XenServer support. This patch contains the missing adjustments.

related to blueprint remove-use-of-quantum

Change-Id: I1ee5cc38d555bd5c26edf00a456ec71919604d79
Improve l3-agent performance and prevent races in it.

Fixes bug 1194026
Fixes bug 1200749

Introduce a looping call for performing synchronization with
neutron server.
The sync will be performed only if router changes are notified
via rpc. Only affected routers will be synchronized.

Changes will be implemented by the l3 agent spawning a
distinct greenthread for each router - iptables will
be executed only once using iptables_manager.defer_apply_on.

This patch will prevent the occurence of the following issues:
- Out-of-order rpc message processing
- Long processing time for router changes due to serial execution
- Occasional and expected RPC blocks for long periods
- Unnecessary processing of multiple requests

Change-Id: I0978d1c38ac5c38c4548e5b1877857bb5cac3b81
Add VXLAN tunneling support for the ML2 plugin

Add an ML2 Type Driver for VXLAN networks to allow the creation
of VXLAN networks with the OVS agent.

Change-Id: I7fcc384cc44d5adc752510847d8ba5f46bbb79fb
Implements: blueprint ml2-vxlan
Add gre tunneling support for the ML2 plugin

This patch add the type_driver GRE to enable the creation of GRE
tunnels with the OVS agent.
No Endpoints ID are managed. Only Endpoint IP are stored in DB,
and this IP is proposed as an endpoint ID for the OVS agent.
It also fixes the bug 1201471.

Implements: blueprint ml2-gre
Change-Id: I1a33a4bd3ebc4c97eecf17a59ce16b8c2066ec66