Opening stable/juno

Bump version to next stable release on juno branch, and set
defaultbranch in .gitreview for convenience.

Change-Id: Ib6bd6b400ae15d5ae1bcb99b11221d58b9acae70
Use EUI64 for IPv6 SLAAC when subnet is specified

This commit uses EUI64 for SLAAC and stateless IPv6 address
when subnet id in fixed_ip is specified.

After this patch, all the ports created on a subnet which has
ipv6_address_mod=slaac or ipv6_address_mod=dhcpv6-stateless
will use EUI64 as the address.
This patch also checks if fixed IP address is specified
for a IPv6 subnet with address mode slaac or dhcpv6-stateless
during creating or updating a port. If yes, raise InvalidInput
error to stop the port creation or update.

Remove unit test test_generated_duplicate_ip_ipv6 because
fixed_ip should not be specified for a slaac subnet.

Change-Id: Ie481cfb2f4313baf44bf1a838ebda374a5c74c6a
Closes-Bug: 1330826
(cherry picked from commit 3ba06618f79fed899188aac87a8694b3344ee995)
Race for l2pop when ports go up/down on same host

With l2pop enabled, race exists in delete_port_postcommit
when both create/update_port and delete_port deal with
different ports on the same host, where such ports are
either the first (or) last on same network for that host.
This race happens outside the DB locking zones in
the respective methods of ML2 plugin.

To fix this, we have moved determination of
fdb_entries back to delete_port_postcommit and removed
delete_port_precommit altogether from l2pop mechanism
driver.  In order to accomodate dvr interfaces, we
are storing and re-using the mechanism-driver context
which hold dvr-port-binding information while
invoking delete_port_postcommit.  We loop through
dvr interface bindings invoking delete_port_postcommit
similar to delete_port_precommit.

Closes-Bug: #1372438
Change-Id: If0502f57382441fdb4510c81a89794f57a38e696
(cherry picked from commit 3cd2163d5105faad389bee5175ef446f0bb90289)
Big Switch: Don't clear hash before sync

This patch removes the step of clearing the consistency
hash from the DB before a topology sync. This will ensure
that inconsistency will be detected if the topology sync
fails.

This logic was originally there to make sure the hash header
was not present on the topology sync call to the backend.
However, the hash header is ignored by the backend in a sync
call so it wasn't necessary.

Closes-Bug: #1379510
Change-Id: I2d58fa2aea3b692834d64192d06ace727c7df8a0
(cherry picked from commit 24e4110eb284078775496501ff81630eb1619c11)
Cisco N1kv: Remove vmnetwork delete REST call on last port delete

Remove the vm network delete call to the VSM on final port call and
ensure that vm network is deleted from the database when the port count
becomes 0.

Change-Id: I6c08a099adfce2fdba8eefec6aadeb68a780ac37
Closes-Bug: 1373547
(cherry picked from commit 4e1c4cbcd71833095534bea9ff7617c582c300d2)
Merge "Use EUI64 for IPv6 SLAAC when subnet is specified" into stable/juno
Merge "Big Switch: Don't clear hash before sync" into stable/juno
Reduce security group db calls to neutron server

Within ovs agent daemon loop, prepare_devices_filter will impose heavy workloads
to neutron server in order to retrieve the security groups message to apply
firewall rules. If agent is configured to use Noopfirewall driver or security
groups are disabled, there is no need for loading the rules from server and
refreshing the firewalls. This will reduce the number of db calls and improve
performance for neutron server in this case.

Change-Id: Id244aab3cac37fc6ed3dc05cbee91cdf9e34d9cc
Closes-Bug: #1365806
(cherry picked from commit 524981cce05a9b365036c0a1e9810036936d3d5b)
Improve performance of security group DB query

The _select_ips_for_remote_group method was joining the
IP allocation, port, allowed address pair, and security group tables
together in a single query. Additionally, it was loading all of
the port columns and using none of them. This resulted in a
very expensive query with no benefit.

This patch eliminates the unnecessary use of the port table by joining
the IP allocation table directly to the security groups and allowed
address pairs tables. In local testing of the method, this sped it up
by an order of magnitude.

Closes-Bug: #1373851
Change-Id: I12899413004838d2d22b691f1e2f3b18f7ec2c27
(cherry picked from commit 04df85b6e5a098f8f55bb82f04d9769763beb487)
Optimize query in _select_dhcp_ips_for_network_ids

Only query the DB for relevant columns instead of
all of the port columns.

Partial-Bug: #1373851
Change-Id: I32cd4a0bc6799ce77cea13188676308e3e641d19
(cherry picked from commit 8d430a7f2e903dda06d8d75d6abcd63423c4c0a1)
Only fetch port_id from SG binding table

Change a query to only retrieve the port_id instead of
every column from the row of security group binding info.

Partial-Bug: #1373851
Change-Id: I0fba9c9623898ee52590207ebbb728503bb59a5b
(cherry picked from commit 6acadab5eb8b7b627e097a638d8486bef59a7f30)
Cisco N1kv: Fix update network profile for add tenants

This patch makes sure that while updating network profile to add new
tenants, it does not delete the older profile bindings and maintains
them, while adds only the new tenant ids to the bindings.

Change-Id: I862eb1c400e022334a2f6a4078425448bb144843
Closes-bug: #1379609
(cherry picked from commit c97069dc9a73344ebdc7b686133269850a81b3b2)
Big Switch: Switch to TLSv1 in server manager

Switch to TLSv1 for the connections to the backend
controllers. The default SSLv3 is no longer considered
secure.

TLSv1 was chosen over .1 or .2 because the .1 and .2 weren't
added until python 2.7.9 so TLSv1 is the only compatible option
for py26.

Closes-Bug: #1384487
Change-Id: I68bd72fc4d90a102003d9ce48c47a4a6a3dd6e03
(cherry picked from commit 62588957fbeccfb4f80eaa72bef2b86b6f08dcf8)
_update_router_db: don't hold open transactions

This patch prevents the L3 _update_router_db method from
starting a transaction before calling the gateway interface
removal functions. With these port changes now occuring
outside of the L3 DB transaction, a failure to update the
router DB information will not rollback the port deletion
operation.

The 'VPN in use' check had to be moved inside of the DB deletion
transaction now that there isn't an enclosing transaction to undo
the delete when an 'in use' error is raised.

===Details===

The router update db method starts a transaction and calls
the gateway update method with the transaction held open.
This becomes a problem when the update results in an
interface removal which uses a port table lock.

Because the delete_port caller is still holding open a
transaction, other sessions are blocked from getting an
SQL lock on the same tables when delete_port starts
performing RPC notifications, external controller calls,
etc. During those external calls, eventlet will
yield and another thread may try to get a lock on the
port table, causing the infamous mysql/eventlet deadlock.

This separation of L2/L3 transactions is similiar to change
I3ae7bb269df9b9dcef94f48f13f1bde1e4106a80 in nature. Even
though there is a loss in the atomic behavior of the interface
removal operation, it was arguably incorrect to begin with.
The restoration of port DB records during a rollback after some
other failure doesn't undo the backend operations (e.g. REST calls)
that happened during the original deletion. So, having a delete
rollback without corresponding 'create_port' calls to the backend
causes a loss in consistency.

Conflicts:

	neutron/db/l3_db.py

Closes-Bug: #1377241
Change-Id: I5fdb6b24bf2fb80ac5e36a742aa7056db72c8c7d
(cherry picked from commit f23f2ecee68ba4abd12139bbb91b77ba9410f581)
NSX: allow multiple networks with same vlan on different phy_net

Previously, the NSX plugin prevented one from creating multiple networks on
the same vlan even if they were being created on different physical_networks.
This patch corrects this issue and allows this to now occur.

Closes-bug: 1367034

Change-Id: I343449648304328dffdd5ba070491e05686ee22d
(cherry picked from commit 6d1f864531d169a54bc239561840176012629316)
Merge "NSX: allow multiple networks with same vlan on different phy_net" into stable/juno
Create DHCP port for IPv6 subnet

There is a bug in dhcp agent code that when first port is created
in an IPv6 subnet, DHCP port is not automatically created.

This fix resolves this problem by removing the IP version check
in configure_dhcp_for_network method.

Change-Id: If3f405d367a7099d9f33d72d11ffcb7a393abe23
Closes-Bug: #1367500
(cherry picked from commit 1b66e11b5d8c0b3de0610ca02c3e10b6f64ae375)
Merge "Race for l2pop when ports go up/down on same host" into stable/juno
Merge "Cisco N1kv: Remove vmnetwork delete REST call on last port delete" into stable/juno
Big Switch: Fix SSL version on get_server_cert

The ssl.get_server_certificate method uses SSLv3 by default.
Support for SSLv3 was dropped on the backend controller in
response to the POODLE vulnerability. This patch fixes it
to use TLSv1 like the wrap_socket method.

Closes-Bug: #1384487
Change-Id: I9cb5f219d327d62168bef2d7dbee22534b2e454e
(cherry picked from commit 77e283c94f51e21dcf126a316098c54a7cdfca0f)