Subnets with prefix length 0 are invalid

This patch changes the API behaviour to return a 400 error
when a subnet with /0 prefix length is specified.

This kind of subnet hardly make any sense, and also cannot
possibly work when DHCP is enabled.

Change-Id: I8f822f14b91475dcf86ea44ee607013e61cbb6f7
Closes-Bug: #1362651
Clarify message when no probes are cleared

Log number of probes which were deleted by
using neutron-debug probe-clear
Closes-Bug: #1333103

Change-Id: I5b53f0c4651c6df491d414d7d65f98c4a84a5987
Remove hints from schedule_router

Partial-bug: #1353266
Partial-bug: #1356639
Co-Authored-By: Swaminathan Vasudevan <swaminathan.vasudevan@hp.com>

Change-Id: Ie6b55e5d0d70be74b19c91994e52eb1719e32fef
Don't allow user to set firewall rule with port and no protocol

Creating firewall rules specifying a destination port and/or a source
port without a protocol, generates rules without src or dest port
restriction. This was a real security issue for cloud users.

This patch generates a 400 Bad request "Source/destination port
requires a protocol" in case of creation/update of firewall rules
specifying a destination port and/or a source port and without protocol.

DocImpact
Closes-Bug: #1365961

Change-Id: I4a3a1d9ae7ec4b2a864b3edc83d65ef7f80cbba5
BSN: Allow concurrent reads to consistency DB

Allow concurrent reads to the consistency DB since the
database lock the block was originally protecting against
is gone.

Closes-Bug: #1357102
Change-Id: I1618b4046e995c796757e723f99288e486683339
Refactor l3_agent.process_router_floating_ip_addresses

Split it out to several functions.

Change-Id: I2b5ec4f0fba04576886f08a346c504212849121a
Adds ipset support for Security Groups

Iptables chain is linear storage and filtering, when iptables rules are
large, the load of l2 agent is heavy, this patch introduces ipset to
security group for improving the security group performance.

Change-Id: I6ff0ac519d0b9034d3bb5270885ed3cc1805674d
Implements: blueprint add-ipset-to-security
DocImpact
Add functional testing to ipset_manager

Add functional testing to the ipset_manager module to verify
it works as expected in combination with iptables matching.

Implements:  blueprint add-ipset-to-security

Change-Id: Iec791ec30f87f6c00805f1d52c23b84aa7bc19de
Add a new scheduler for the l3 HA

This patch updates all schedulers in order to support the
scheduling of HA routers. It also refactors and adds tests for
the auto scheduling part.

The schedulers aren't expected to work when creating a router
that's both distributed and highly available. Specific issues
will be reported as bugs and fixed in a future patch.

Partially-implements: blueprint l3-high-availability
Change-Id: I2f80f45adeffa1a4eebcb375a4c8326177e84e83
Co-Authored-By: Assaf Muller <amuller@redhat.com>
L3 Metering label as shared

With this patch metering labels can be set
as shared so that the rules associated with
this label will be applied to all routers for
all tenants.

Also changed all attributes on metering labels
to not allow updates ('allow_put': False),
since there are no update methods.

Partially implements
blueprint l3-metering-mgnt-ext

DocImpact

Change-Id: Ice405585fc50786d52eecc35c01605ac0e9550ac
Remove the Cisco Nexus monolithic plugin

The Cisco Nexus monolithic plugin does not work without the Open
vSwitch plugin. The Open vSwitch plugin is scheduled to be removed
as per #1323729. This patch removes the Nexus Hardware switch
related plugin code. The N1KV virtual switch related code will
still remain in the tree as it doesn't depend on Open vSwitch
plugin.

Closes-Bug: #1350387
Change-Id: I2542e92c25e9280e975c3903afb9114e850a966a
Merge "Subnets with prefix length 0 are invalid"
Updated from global requirements

Change-Id: I7a53aedccdd62fafd0da2679e84345e71da5493d
Merge "Refactor l3_agent.process_router_floating_ip_addresses"
Merge "Don't allow user to set firewall rule with port and no protocol"
Merge "Adds ipset support for Security Groups"
Merge "BSN: Allow concurrent reads to consistency DB"
Merge "Remove hints from schedule_router"
Merge "Add a new scheduler for the l3 HA"
Merge "Clarify message when no probes are cleared"