Fix 500 error on invalid security-group-rule creation for NVP

Validate that, when creating rules specifying a protocol different
from TCP, UDP, ICMP and ICMPv6, no port (range) is specified because
NVP does not like it.

The extra validation is specific to the NVP plugin because other
plugins may choose a different failure mode. For example, the ovs
plugin does not complain at all, but it just ignores the port range
if the protocol is not a port-oriented one.

Fixes bug #1213293

Change-Id: I46e9032b5cf7f7d88b9d05c3bf020784b04217d9
Analyze re-raised exceptions in Cisco Plugin

Checked all cases of re-raised exceptions. In several cases, the exception
was redundant (re-raising the same exception), so the try block and
exception handling was removed.

In one case, exceptions raised from two sources were re-raised with a
a different exception. Instead of doing this, the original exceptions
were changed and the try block and re-raised exception were removed.

In cases where there were database exceptions that were re-raised as
Neutron exceptions, the traceback was left as-is, since it was more
informative to know the higher level source of the issue.

The same was true for the exception mentioned in the bug, where the
original failure was in the ncclient library parsing the configuration
and it would be more descriptive to know that there was a connection
failure or a config failure, that to know the library method.

bug 1213159

Change-Id: Ie334d2548bf651c61e878bf797adaf8c5880eb86
Add extra_dhcp_opt extension to BigSwitch/Floodlight plugin

Adds support for the DHCP options extenion to the
BigSwitch/Floodlight plugin.

Fixes: bug #1206655
Change-Id: Ida30ca44ecbb9d1208303e47519427a4111f6025
Correct VPNaaS limit checks in extension

For the following VPNaaS attributes, ensure that these validation
tests are performed in the extension:

    keepalive >= 60 (seconds)
    mtu >= 0 (octets)
    DPD interval > 0 (seconds)
    DPD timeout > 0 (seconds)

Currently, the units for keepalive can only be seconds. If this
changes in the future (e.g. to allow kilobytes units), then the
test for the value will need to be changed.

To correctly test the MTU limits for an IPSec connection, the
protocol must be taken into consideration, which is defined by
the vpnservice object. Because of this dependency, we cannot
validate this in the extension, and will instead, just make
sure the value is positive.

Likewise, the attribute validators cannot ensure that the
DPD timeout is greater than the interval (again, because the
validators can only check the individual attributes one at
a time).

The range validator was modified to allow single ended ranges
for some of these attributes. The range also ensures the value
is an integer.

Companion changes are being made in the CLI code for these limit
changes.

Update: Fixed typo causing tox failure.

bug 1216117

Change-Id: I85d6175d81fbe7d27231aed48fb4691351e0db4c
Add missing match in OVS agent tunnel mac leaning

Learned flows introduced in commit a369f9e39691c01a4e4f7f8668cb37fc17ba03b3
to learn remote mac addresses on tunnels currently only match local VLAN,
but not destination mac address, as a consequence, connectivity may be
erratic as soon as more than two agents are used

Change-Id: I467e47d0dd2c1e5aca12a4e240e348116d530d4f
Closes-Bug: #1219074
Merge "Fix 500 error on invalid security-group-rule creation for NVP"
Merge "Correct VPNaaS limit checks in extension"
Merge "Add missing match in OVS agent tunnel mac leaning"
Merge "Analyze re-raised exceptions in Cisco Plugin"
Merge "Add extra_dhcp_opt extension to BigSwitch/Floodlight plugin"
Refactor BigSwitch error handling to use db rollbacks

This patch adjusts most of the logic handling the
calls to the controller in the BigSwitch/floodlight
plugin to make use of the db rollbacks from
sqlalchemy for free on exceptions. This eliminates
several complex try-except blocks and makes
maintaining db<->controller consistency easier.

Fixes: bug #1215823
Change-Id: Ia636c40e744b3b1c543e891791bf492df4f675d2