Fix IP spoofing filter blocking all packets.

Implement IP spoofing filter by adding yet another chain to iptables
with RETURN rule for each of IP addresses assigned to port and DROP
rule at the end of the chain.

Fixes: bug #1190613
Change-Id: I2e7a0f8dd4c3519c57d28e87a44735a3482624b1
Imported Translations from Transifex

Change-Id: I7566406d89c2eda65be77306033f3034e3cb9abd
Allow use of lowercase section names in conf files

Fixes bug #1189889

oslo.config-1.2.0 normalizes section names in config files to lowercase.
This means that simply by upgrading to oslo.config-1.2.0, users will now
be able to do e.g.

  [default_servicetype]
  description = ...
  service_definition = ...

Change the default config files to make it clear we recommend the use of
lowercase section names.

Note, the use of an alpha tarball of oslo.config requires pbr>=0.5.15
but we already require >=0.5.16.

DocImpact

Change-Id: Ia47fb3d168da71d3221b25979f8c9257d70dd64d
Reference default_servicetype group in lowercase

Now that we require oslo-config-1.2.0, we can start referencing group
names as lowercase. Let's start with the default_servicetype group.

We do this simply by changing the case of the group name passed to
register_opt():

  -cfg.CONF.register_opts(..., 'DEFAULT_SERVICETYPE')
  +cfg.CONF.register_opts(..., 'default_servicetype')

and this means that all options in the group now need to be referenced
using the lowercase group name i.e.

  -svc_defs = cfg.CONF.DEFAULT_SERVICETYPE.service_definition
  +svc_defs = cfg.CONF.default_servicetype.service_definition

Note however, users can still use the uppercase section name for
backwards compatibility.

When we last attempted to do this, oslo.config-1.2.0 wasn't actually
being installed correctly so add a unit test which verifies that both
uppercase and lowercase section names work.

Change-Id: I9357397f39d8f7d0d4f445b78aae5665c7ece3d4
Always include tenant_id in port delete request

Quantum does not include the tenant_id in port objects for floating IP addresses.
However, the Big Switch backend requires the tenant_id in the port removal requests.
This looks up the correct tenant_id whenever it is missing in the port removal.

Change-Id: I7580ed2f545ad2d92b831b65dfbb34541bf465aa
Fixes: bug #1190020
Fix TestNecAgentMain not to call sys.exit()

test_main() was calling sys.exit() killing test running
and not allowing tests to complete in a proper way.

Drop explicit sys.exit() call from net agent's main() and
fix outdated mocks in test_main().

Fixes bug #1192270

Change-Id: Iea8d5508f73eb9144e452de3305f2dec4c2a319c
Imported Translations from Transifex

Change-Id: Ic05603ef37a6be3f5482f5b268958eedf4a6eaa1
Merge "Allow use of lowercase section names in conf files"
Merge "Reference default_servicetype group in lowercase"
Merge "Fix TestNecAgentMain not to call sys.exit()"
Adds default route to DHCP namespace for upstream name resolution.

Any time the DHCP server is updated this code will maintain a default
route in the DHCP namespace using the gateway_ip attribute of the
first DHCP-enabled IPV4 subnet in the list of subnets where gateway_ip
is not None.  This strategy uses the same gateway ip that the DHCP
server hands to the VMs on the network.

Change-Id: I0807550a848e1b610c7775d215643ad9c83629ed
Fixes: Bug #1181378
Make sure exceptions during policy checks are logged.

If the invocation of f bombs out, the policy check fails (i.e. returns
False), however it does not log the root cause, which makes very
difficult to understand why this is happening.

Fixes bug #1191948

Change-Id: Ic40053f3965b71199baf9fe3902e8ffc9745076f
replace use of dhcp_lease_time with dhcp_lease_duration

Having 2 separate dhcp lease period flags (dhcp_lease_duration
used by the quantum db plugin, and dhcp_lease_time used by the
dnsmasq dhcp agent) means that you could potentially have different
lease periods being set, and used by different parts of the codebase.

It seems to me there is no real need to have 2 separate flags, so this
commit basically replaces references to dhcp_lease_time (which is used
by the dnsmasq dhcpagent) with dhcp_lease_duration. This way, there
is only one flag to set, and both the quantum db plugin and dnsmasq
dhcp agent will use the same lease period.

Change-Id: Ia99dfa9284b6e737144f61a80c59cd898c0949bb
Fixes: bug #1192550
Imported Translations from Transifex

Change-Id: I5981d9309ebfec257a82b579828af96c359fb85d
Merge "Fix IP spoofing filter blocking all packets."
Fix single-version-externally-mananged typo in setup.cfg

Corrects the typo in setup.cfg to use single-version-externally-managed
for pbr.

Fixes bug 1192987

Change-Id: I039b51897ec180148e5095349e4567759f2711a5
Merge "Imported Translations from Transifex"
Merge "Fix single-version-externally-mananged typo in setup.cfg"
Merge "Adds default route to DHCP namespace for upstream name resolution."
Fix haproxy plugin_driver.update_health_monitor() signature

- add old_health_monitor parameter to the method
- the method signature in abstract lbaas driver was also changed
  to accept pool_id rather than an assoc object as driver only needs pool_id

Fixes bug 1190577

Change-Id: Ie199f46e089a16214ed649a3169e985a726e5d99