Fixes Hyper-V agent security group ICMP rules

Converts ICMP protocol to the equivalent protocol number.
Adds default ICMP reject rules.
Adds default ANY protocol rules if the rule does not
contain any protocol.

Closes-Bug: #1299159
Change-Id: Iff51a58fdb532eda0fe7a63abf96004ee74bb073
(cherry picked from commit f56972193be903c67cd54c57bcc2becf6222aced)
Fixes Hyper-V agent security groups disabling

Adds a check if the security groups have been disabled and removes
the switch port's ACLs accordingly.

Change-Id: I20d716a3f182b8ea62da6b436b150aa9dafdb1c5
Closes-Bug: #1299156
(cherry picked from commit 6d49834976bc08d2b8f7939bc2a217f5cc81db47)
OVS agent: Correct bridge setup ordering

This patch fixes three issues that combined to break tunnel networks.

The first issue was the the failure mode was being set on the
integration bridge after the canary flow was installed. This
immediately wiped out the canary flow.

The second problem was that the main loop would sync tunnel networks
right before resetting the tunnel bridge when the canary flow was
missing. This meant that it would sync all of the tunnels via RPC and
then wipe them out.

The final issue was that after resetting the tunnel bridge in the
main loop, the tunnel_sync variable was not set to True, so the
tunnels would never be resynchronized.

This patch addresses the three issues in the following ways:
1. Set the failure mode on the bridge before the canary flow is
installed.
2. Run the OVS restart logic before the tunnel synchronization.
3. If the restart logic is triggered, set tunnel_sync to True to
trigger synchronization.

Conflicts:
	neutron/tests/unit/openvswitch/test_ovs_tunnel.py

Closes-Bug: #1292105
Change-Id: I6381e3fee49910127c420dd2e3205c64cdb9e185
(cherry-picked from commit 0e5c50ecb2e2317ca6908a9bcec3bcb8ca6d3af8)
Register LBaaS resources to quotas engine

Adding register_quotas=True argument to
resource_helper.build_resource_info() function
in order to register LBaaS resources to quotas engine

This change is actually a continuation of https://review.openstack.org/#/c/69803
change which was already approved

Change-Id: Ib75027ce4a1bea3d453f57b107d29546ec6743e5
Closes-Bug: #1305957
(cherry picked from commit f5d33051b6d9b0dd0fe08692758748ed34d50136)
Big Switch: Lock consistency table for REST calls

Adds a new class to hold an SQL table lock throughout
a REST call to prevent servers in an HA deployment from
using a stale consistency hash value.

Also passes the current context down to the server manager
for every request since the consistency hash will need to
be read from the database instead of from a variable on the
server pool object.

Conflicts:

	neutron/plugins/bigswitch/plugin.py
	neutron/tests/unit/bigswitch/test_servermanager.py

Closes-Bug: #1328331
Change-Id: I5f8402c076d7732742c0ae4d9b9d6833d42a0b7b
(cherry picked from commit 09e706b210513968cac2bad78fe81ee9cbb5b5be)
Do not mark device as processed if it wasn't

Currently treat_devices_added_or_updated in the OVS agent skips
processing devices which disappeared from the integration bridge
during the agent loop.
This is fine, however the agent should not mark these devices as
processed. Otherwise they won't be processed, should they appear
again on the bridge.

This patch ensures these devices are not added to the current
device set.

The patch also changes treat_devices_added_or_updated. The
function now will return the list of skipped devices and not
anymore a flag signalling whether a resync is required.
With the current logic a resync would be required if retrieval
of device details fails. With this change, the function
treat_devices_added_or_updated will raise in this case and the
exception will be handled in process_network_ports.

For the sake of consistency, this patch also updates the
similar function treat_ancillary_devices_added in order to
use the same logic.

Finally, this patch amends an innaccurate related comment.

Closes-Bug: #1329546

Conflicts:
	neutron/plugins/openvswitch/agent/ovs_neutron_agent.py

Required changes:
- fetch all device details first before proceeding with handling ports
  to reflect Juno behaviour.
- unit test was modified to run with get_device_details since
  get_devices_details_list is not available in Icehouse.
- fixed E128 violation in the backported code.

Change-Id: Icc744f32494c7a76004ff161536316924594fbdb
(cherry picked from commit 90fedbe44ca6bfccce5d71465532fbdc85ee3814)
Add -s option for neutron metering rules

While adding iptables rule, cidr is added as destination for both ingress
and egress directions. Modified code to add -s for egress and -d for ingress.

Closes-bug: 1310589

Conflicts:
        neutron/tests/unit/services/metering/drivers/test_iptables_driver.py

Change-Id: Id9ca10855e6527d4bec689f8f9bcd6f681221954
(cherry-picked from commit 72e8b5dc5a5e36722327efca4c399f0321e9bbbb)
Merge "Add -s option for neutron metering rules" into stable/icehouse
Merge "Big Switch: Lock consistency table for REST calls" into stable/icehouse
Big Switch: Remove consistency hash on full sync

Clears the consistency hash before performing a full
backend synchronization. Since all of the data is being
replaced, there is no reason to include this and it
currently requires special-casing to handle.

Closes-Bug: #1328233
Change-Id: Iace766d869dc78b041d3a5464e728b872c8347c2
(cherry picked from commit e60670e5a202870693f7485a1da4411f4faaf36d)
Merge "Do not mark device as processed if it wasn't" into stable/icehouse
Set python hash seed to 0 in tox.ini

New tox (>=1.7.0) sets a random python hash seed by default. This is
generally good for testing because it will help keep projects working
regardless of the hash seed, but neutron unittests don't currently pass
with a random hash seed so set it to the python default seed.

This change will allow us to use new tox again and remove the
restriction on tox<=1.6.1 to run unittests.

Note this change will need to be backported to the stable branches to
keep unittests there working with new tox as well.

Change-Id: If151efeb8caae3111515191e238d6e6ae491cd44
Merge "Register LBaaS resources to quotas engine" into stable/icehouse
Merge "Big Switch: Remove consistency hash on full sync" into stable/icehouse
BSN: Remove db lock and add missing contexts

Adds context tracking decorators that were missing
from router interface methods. Without them, new
sessions were being created instead of using the
existing context which was causing transaction
issues.

Modifies the servermanager to store context references
as weakrefs so if multiple functions are called before
the rest functions are called, the first one doesn't steal
the only context reference with a pop() call.

Removes a DB lock for update in the server manager that occured
during rest calls that was triggering deadlocks due to the
file lock synchronization for the rest calls.

Closes-Bug: #1336251
Change-Id: Iad3d61e2c23832b3ad760a999fbab7feaa13f805
(cherry picked from commit ee9fe2458f813b5d367bc7263c7a30a3af46aa2b)
Merge "Fixes Hyper-V agent security group ICMP rules" into stable/icehouse
Merge "Fixes Hyper-V agent security groups disabling" into stable/icehouse
Merge "OVS agent: Correct bridge setup ordering" into stable/icehouse
Merge "BSN: Remove db lock and add missing contexts" into stable/icehouse
Merge "Set python hash seed to 0 in tox.ini" into stable/icehouse