Fix a race condition adding a security group rule

setup_port_filters() needs to grab self.devices_to_refilter
before it calls prepare_devices_filter(), else it could skip
processing a device if an RPC arrives while it's processing
new devices.  That device will now be handled the next time
it's called.

Bug introduced in commit 3046c4ae22b1

(Cherry-picked from ee0e41d09d6ffc3cb7bf8406c8e8b009dfb92e17)
Change-Id: Ib2f460cc095bbea8f9c767dcb9b4d4b66f1a7811
Closes-Bug: 1393925
Fix race condition on processing DVR floating IPs

Fip namespace and agent gateway port can be shared by multiple dvr routers.
This change uses a set as the control variable for these shared resources
and ensures that Test and Set operation on the control variable are
performed atomically so that race conditions do not occur among
multiple threads processing floating IPs.
Limitation: The scope of this change is limited to addressing the race
condition described in the bug report. It may not address other issues
such as pre-existing issue with handling of DVR floatingips on agent
restart.

closes-bug: #1381238

cherry-picked from 9902400039018d77aa3034147cfb24ca4b2353f6
Change-Id: I6dc2b7bad6e8ddbaa86c1f7a1e2028aeacc3afef
Delete FIP namespace when last VM is deleted

On a compute node when the last VM with a floating IP association
is deleted, the L3 agent did not delete the fip namespace. However
the api server has already deleted the fip agent external gateway
port from the database.

This problem is happening on DVRs because the deletion of a VM port,
in addition to a floating IP disassociation, may also result in the
removal of the external gateway port binding AND the removal of the
fip agent external gateway port.

When the L3 agent is handling a routers_updated notification, it is
not processing floating ip address updates when the router has both
a floating ip disassociated and a external gateway port deleted.
This patch corrects this problem.

cherry-picked from e3b949c3bc08808e3df15215bc30d6610f3a4bd3
Closes-bug: #1377156
Change-Id: I86bdef7c9d988cb9d87c88adde55548d459f29a5
Moves the HA resource creations outside of transaction

Currently the HA resources are created in the
_create_router_db which includes calls to
the plugin and generates RPC calls. Even if the
resource creations are outside of any transaction
from the _create_router_db point of view, this
method is  called in a transaction from the
create_router method.
This patch moves the resource creations to the
create_router method outside the transaction.
The failures are handled as previously with
a try/expect.

Conflicts:
	neutron/tests/unit/db/test_l3_ha_db.py

Change-Id: If8fcfd012f8e992175e49bbefb2ae667881a620a
Closes-bug: #1374461
(cherry picked from commit ccd650732729451aa8e5ce3401f9570c70c4f066)
return the dict of port when no sec-group involved

Commit abc16ebf made the get_sg_ids_grouped_by_port function not return
entries for ports without security groups. This causes the agent to not remove
previously created security groups for that port since the port is not
returned in the security_group_info_for_devices data.

This change fixes that by always including a list of security groups for each
port, even if that list is empty.

Change-Id: I9616708462a8b6f3d46ebd76db5cf8cb2826f4ad
Closes-Bug: #1398312
(cherry picked from commit 997e70751c74004983b1e4079b084431ed0c7d27)
Merge "Moves the HA resource creations outside of transaction" into stable/juno
Merge "Fix race condition on processing DVR floating IPs" into stable/juno
Merge "Delete FIP namespace when last VM is deleted" into stable/juno
Merge "return the dict of port when no sec-group involved" into stable/juno