Fix IP spoofing filter blocking all packets.

Implement IP spoofing filter by adding yet another chain to iptables
with RETURN rule for each of IP addresses assigned to port and DROP
rule at the end of the chain.

Fixes: bug #1190613
Change-Id: I2e7a0f8dd4c3519c57d28e87a44735a3482624b1
Always include tenant_id in port delete request

Quantum does not include the tenant_id in port objects for floating IP addresses.
However, the Big Switch backend requires the tenant_id in the port removal requests.
This looks up the correct tenant_id whenever it is missing in the port removal.

Change-Id: I7580ed2f545ad2d92b831b65dfbb34541bf465aa
Fixes: bug #1190020
Adds default route to DHCP namespace for upstream name resolution.

Any time the DHCP server is updated this code will maintain a default
route in the DHCP namespace using the gateway_ip attribute of the
first DHCP-enabled IPV4 subnet in the list of subnets where gateway_ip
is not None.  This strategy uses the same gateway ip that the DHCP
server hands to the VMs on the network.

Change-Id: I0807550a848e1b610c7775d215643ad9c83629ed
Fixes: Bug #1181378
Make sure exceptions during policy checks are logged.

If the invocation of f bombs out, the policy check fails (i.e. returns
False), however it does not log the root cause, which makes very
difficult to understand why this is happening.

Fixes bug #1191948

Change-Id: Ic40053f3965b71199baf9fe3902e8ffc9745076f
replace use of dhcp_lease_time with dhcp_lease_duration

Having 2 separate dhcp lease period flags (dhcp_lease_duration
used by the quantum db plugin, and dhcp_lease_time used by the
dnsmasq dhcp agent) means that you could potentially have different
lease periods being set, and used by different parts of the codebase.

It seems to me there is no real need to have 2 separate flags, so this
commit basically replaces references to dhcp_lease_time (which is used
by the dnsmasq dhcpagent) with dhcp_lease_duration. This way, there
is only one flag to set, and both the quantum db plugin and dnsmasq
dhcp agent will use the same lease period.

Change-Id: Ia99dfa9284b6e737144f61a80c59cd898c0949bb
Fixes: bug #1192550
Imported Translations from Transifex

Change-Id: I5981d9309ebfec257a82b579828af96c359fb85d
Merge "Fix IP spoofing filter blocking all packets."
Fix single-version-externally-mananged typo in setup.cfg

Corrects the typo in setup.cfg to use single-version-externally-managed
for pbr.

Fixes bug 1192987

Change-Id: I039b51897ec180148e5095349e4567759f2711a5
Merge "Imported Translations from Transifex"
Merge "Fix single-version-externally-mananged typo in setup.cfg"
Merge "Adds default route to DHCP namespace for upstream name resolution."
Fix haproxy plugin_driver.update_health_monitor() signature

- add old_health_monitor parameter to the method
- the method signature in abstract lbaas driver was also changed
  to accept pool_id rather than an assoc object as driver only needs pool_id

Fixes bug 1190577

Change-Id: Ie199f46e089a16214ed649a3169e985a726e5d99
Imported Translations from Transifex

Change-Id: If16f987872d2ccc00d7efe486b721d4702864220
Merge "Imported Translations from Transifex"
Merge "Always include tenant_id in port delete request"
Adds support for router rules to Big Switch plugin

Implements: blueprint bsn-router-rules

Adds bigswitch plugin extension which adds 'rules' dictionary to router objects.
Adds validation code and database components to store router rules
Adds configuration option to plugin to set default router rules and max router rules
Adds unit tests to test all router rule functionality
Adds database migration for router rules tables

The Big Switch controller's Virtual Router implementation supports "routing rules"
which are of the form:
<source, destination, next-hop, action>
This extension aims to expose this abstraction via the Big Switch Quantum plugin.

These rules are applied at the router level, allowing tenants to control
communication between networks at a high level without requiring security policies.
(e.g. prevent servers in a publicly accessible subnet from communicating with
database servers).

Change-Id: I37a2740dca93b0a8b5111764458d39f1c2b885ce
Remove single-version-externally-managed in setup.cfg

The single-version-externally-managed flag is no longer
a config option in pbr, it is now the default behaviour
in normal setuptools.

Change-Id: I5173d78680afca534b28cefa155636d9d695b1d9
Merge "Remove single-version-externally-managed in setup.cfg"
Imported Translations from Transifex

Change-Id: I49837fb8f8771c532c2fd09d67598ad839a2f7a3
Imported Translations from Transifex

Change-Id: I9b95e89cfaf76537d98ada38fb795fbaf439c996