Supply missing cisco_cfg_agent.ini file

cisco_cfg_agent.ini file was missed in the initial commit and
caused neutron startup issues. This patch supplies the proper
ini file and adds it back to neutron setup.cfg.
Also the introduced config options are put in a specific group
instead of default as was in the initial commit.

Change-Id: I74b3b77fe6e196524809580f522f91f3b62f5ba7
Closes-bug: #1351466
Fix 500 error on retrieving metadata by invalid URI

An invalid URI should return a BadRequest error rather
than making the metadata proxy bomb out.

Closes-bug: #1371160

Change-Id: Ifb495f9e8929062a0c24d090c3e702109a38803a
Add logging for enforced policy rules

There are a lot of policy rules which should not necessarily
be explicitly specified in policy.json to be checked while enforcement.
There should be a way for an operator to know which policy rules are
actually being enforced for each action.

Added a unit test.

Change-Id: I261d3e230eced9ea514b35cc3f5f8be04f84c751
Closes-Bug: #1356679
Security groups: prevent race for default security group creation

When a VM is booted via the Nova the client connection is created
with an admin user. This causes problems when creating the neutron
port. That is, there may be a race for the creation of the default
security group for the tenant.
The problem was introduced by commit acf44dba26ca8dca47bfb5fb2916807f9f4e2060

Change-Id: Ie0199c71231a322704f1f49995facde09c92da25
Closes-bug: #1372570
Forbid regular users to reset admin-only attrs to default values

A regular user can reset an admin-only attribute to its default
value due to the fact that a corresponding policy rule is
enforced only in the case when an attribute is present in the
target AND has a non-default value.

Added a new attribute "attributes_to_update" which contains a list
of all to-be updated attributes to the body of the target that is
passed to policy.enforce.

Changed a check for whether an attribute is explicitly set.
Now, in the case of update, the function should not pay attention
to a default value of an attribute, but check whether it was
explicitly marked as being updated.

Added unit-tests.

Closes-Bug: #1357379
Related-Bug: #1338880
Change-Id: I6537bb1da5ef0d6899bc71e4e949f2c760c103c2
Do not lookup l3-agent for floating IP if host=None, dvr issue

If a floating IP has been associated with a port, but the port
has not been associated with an instance, attempting to lookup
the l3-agent hosting it will cause an AgentNotFoundByTypeHost
exception.  Just skip it and go onto the next one.

Change-Id: If3df9770fa9e2d2eada932ee5f243d3458bf7261
Closes-Bug: #1370795
Deletes floating ip related connection states

When a floating ip is dissociated with a port, the current
connection with the floating ip is still working. This patch
will clear the connection state and cut off the connection
immediately.

Since conntrack -D will return 1, which is not an error code,
so add extra_ok_codes argument to execute methods.

Change-Id: Ia9bd7ae243a0859dcb97e2fa939f7d16f9c2456c
Closes-Bug: 1334926
Fix KeyError when getting secgroup info for ports

The patch fixes a regression introduced with secgroup rpc refactor by
handling the case when security group contains rules for only IPv4 or
IPv6.

Change-Id: I02b174757bfc796a81cdb482c55ba7f9e954131d
Closes-bug: #1372337
Merge "Supply missing cisco_cfg_agent.ini file"
Merge "Do not lookup l3-agent for floating IP if host=None, dvr issue"
Merge "Add logging for enforced policy rules"
Merge "Forbid regular users to reset admin-only attrs to default values"
Merge "Fix KeyError when getting secgroup info for ports"
Merge "Fix 500 error on retrieving metadata by invalid URI"
Merge "Deletes floating ip related connection states"
Merge "Security groups: prevent race for default security group creation"