Add support for multiple RPC workers under Metaplugin

Metaplugin needs a fix to support multiple RPC workers properly
because a plugin which supports multiple RPC workers cannot
initialize RPC connections at plugin initialization.

Closes-Bug: #1300570
Change-Id: I584f70abb8969054cd4edc8f914d00f6be930bab
(cherry picked from commit 8fb023ed53aff31f37ebebb94aca4f8e2a188342)
Fixes Hyper-V agent security group ICMP rules

Converts ICMP protocol to the equivalent protocol number.
Adds default ICMP reject rules.
Adds default ANY protocol rules if the rule does not
contain any protocol.

Closes-Bug: #1299159
Change-Id: Iff51a58fdb532eda0fe7a63abf96004ee74bb073
(cherry picked from commit f56972193be903c67cd54c57bcc2becf6222aced)
Fixes Hyper-V agent security groups disabling

Adds a check if the security groups have been disabled and removes
the switch port's ACLs accordingly.

Change-Id: I20d716a3f182b8ea62da6b436b150aa9dafdb1c5
Closes-Bug: #1299156
(cherry picked from commit 6d49834976bc08d2b8f7939bc2a217f5cc81db47)
Common decorator for caching methods

Decorator caches methods' results, the key is composed from function
name and its parameters. Implementation of cache itself should be in
object implementing decorated method. Cache backend should be taken
from oslo-incubator.

Related-Bug: #1276440

Conflicts:
	neutron/common/utils.py

Change-Id: Ibe3f1b2eb10b9601ad76ec24b7f0e3551b4013e2
(cherry picked from commit 7508170498949818aed02ba0fd9b7f861e596320)
Wrong key router.interface reported by ceilometer

Ceilometer with MongoDB doesn't accept the key with dot.

The dot in 'router.interface' should be replaced with '_',
which is also the standard implementation of other keys in neutron.

Change-Id: If7fcf7658db9ee2d7d1248bb0b016b4389c32c77
Related-Bug: #1310460
(cherry picked from commit 7811c8a8ffce78dc14815203858854c450f1c8f6)
NSX: fix bug for flat provider network

The flat provider network would cause an exception when writing to
database. This is due to the fact that the DB expected an integer
and received an object instead.

Change-Id: Ib9d38711c0c2ef16d8bf74bfae44864a1bc272b1
Closes-bug: #1324120
(cherry picked from commit 84dfaa8a87cce660aa20619bd93263e645bbb2d0)
Remove function replacement with mock patch

In the hyperv unit tests, an rpc method is
manually replaced with a MagicMock using setattr.
This prevents it from being cleaned up by mock.patch.stopall.
This patch replaces it with a short-lived patch call
in a with statement.

Change-Id: I7b10a8115c474977e3acd16dc49d6f3ae67b0c3b
Partial-Bug: #1316401
(cherry picked from commit 2df56ffe93fc5d0ce343df683d8846865b73b716)
BSN: Set hash header to empty instead of False

Sets the consistency hash header to empty instead
of False since 'False' is handled like a string on
the backend and requires special-casing to detect.

Conflicts:

	neutron/tests/unit/bigswitch/test_servermanager.py

Change-Id: Iee1651574c01a32e78167a9bbed4e0433abbdec2
Closes-Bug: #1325771
(cherry-picked from 7b9ed4edeef7d599c164c8682fbbb36066d98abb)
Do not defer IPTables apply in firewall path

By default, iptables apply is deferred in L3 agent. For
external gateways, iptables is applied immediately (to
enable NAT for floating IP). Similarly, when firewall
is created/updated/deleted, iptable rules are applies
immediately.

Change-Id: I4f652a030ae23a71a2e20af2e8ef0ad5b882b80e
Closes-Bug: #1320775
(cherry picked from commit 6167cb55e2f62a645487d66e52b809c9599b3bb8)
LBaaS add missing rootwrap filter for route

If one runs the lbaas agent from packages and does not have the l3-agent
installed on the same box as the lbaas agent it will fail to add the
default gw route. This is because it's missing the rootwrap filter for
route which is only present in l3.filters.

Conflicts:
	etc/neutron/rootwrap.d/lbaas-haproxy.filters

Change-Id: I59cd0a549a1f1d1564d139d42daf55d02898bf76
Closes-bug: 1325406
(cherry picked from commit c9a0eaacaad3d6d00867a75b5c2302b3836ee46d)
OVS Agent: limit veth names to 15 chars

The maximum length of a veth interface name is 15 characters.
This patch limits the length of the veth names created for
integration bridges by switching to a fixed-length hashing
mechanism if the normal name would exceed the allowed length.

Closes-Bug: #1328288
Change-Id: I432cee62a6dc91f268becbc91f8024c23dd0bfac
(cherry-picked from 1222366f6dadf7ce2a810c919344054196134db8)
Big Switch: fix capabilities retrieval code

References the raw REST response in the capabilities
parsing code so json.loads doesn't get an object
that may already be decoded and fail.

Conflicts:
	neutron/tests/unit/bigswitch/test_capabilities.py
	neutron/tests/unit/bigswitch/test_servermanager.py

Closes-Bug: #1326173
Change-Id: Ia3179b7499f35a6ab2e9ce1631ab15ed27d64647
Merge "NSX: fix bug for flat provider network" into stable/icehouse
Improve iptables_manager _modify_rules() method

As the number of ports per default security group increases, the
number of iptables entries on the Compute Node grows.  Because of
this, there is a gradual increase in the time taken to apply chains
and rules.

Currently we are using list comprehensions to find if a new chain or
rule matches an existing one.  Instead, walk through the list in
reverse to find a matching entry.

Added a new method, _find_last_entry(), to return the entry we are
searching for.

Change-Id: I3585479ffa00be556b8b21dc9dbd6b36ad37f4de
Closes-Bug: #1302272
Related-Bug: #1253993
(cherry picked from commit 0c202ab3e453e38c09f04978e4fce30d6ee6350c)
Remove RPC to plugin when dhcp sets default route

_set_default_route() was using an RPC to the plugin to get the DHCP
port for the network on the current host, and then used it to form
the tap device name. This happened on every allocation reload too.
This fix removes the RPC and gets the tap device name using local
methods instead. It also removes an unnecessary call to set the
default route in the restart method.

Closes-Bug: 1290068
Related-Bug: 1294254
Change-Id: I639bcf93725c4969d1011d2d20491d461ccfdbed
(cherry picked from commit 9dbd1e5e5a41eff88a044b8de992d2f1f14898b3)
Merge "Add support for multiple RPC workers under Metaplugin" into stable/icehouse
OFAgent: Process port_update notifications in the main agent loop

Port the following patch to OFAgent.
commit: 5e6e592132aa9a98936ce3bfdb66efc7832caafb
https://review.openstack.org/#/c/61964/

Partial-Bug: 1293265

Conflicts:
	neutron/plugins/ofagent/agent/ofa_neutron_agent.py

Change-Id: I53813d12c66dc746cd373fd91ff9bd9bdbf222db
(cherry picked from commit 34e3be16a196c3da32cd6fa6147f6e00636a9aaf)
OVS and OF Agents: Create updated_ports attribute before setup_rpc

setup_rpc spawns rpc-consuming thread that can access
self.updated_ports before it is created in the constructor

Change-Id: Icc447c3bb7099125aae30e2430a6ad98ba00f6f9
Closes-Bug: #1314472
(cherry picked from commit 717a0a0ab4436e2904360fe4e34226af7d0e412d)
Default to setting secure mode on the integration bridge

Set the fail-mode on the integration bridge to be secure. This means if the agent
is stopped or crashes, and OVS is also restarted, OVS will not program a default
NORMAL action. As soon as the agent is restarted, it will correctly program the
integration bridge.

Change-Id: Icf7e3e14ee747c8ce92c14c95a0a1bbf35986252
Closes-Bug: #1324703
(cherry picked from commit 0412c8a3c43e77c1bb04b0c3ba4b2781fc52e7f8)
Ensure routing key is specified in the address for a direct producer

This change is already merged in oslo-incubator.  Original commit
message body includes:

    Porting this fix from oslo.messaging.  This fixes the impl_qpid.py
    driver to allow it to work with the latest stable upstream QPID broker
    (version 0.28).  See the Apache Qpid Jira bug
    https://issues.apache.org/jira/browse/QPID-5557

Change-Id: If71f78e50f8a9b3acfd1e9d02c8271f17c4ebee7
Related-Bug: #1300318
(cherry picked from commit 9b8e7362f564f622e765a6a9a14b23d87a50dac8)