call security_groups_member_updated in port_update

When a running VM is added to a security group, all existing VMs (ports)
in the security group should be notified/updated - otherwise they would
have incorrect rules, not knowing the new VM/port added.

The current behavior would only update the port of the added VM. This
patch forces an security_groups_member_updated() call for all the
security groups that have ports removed or added.

Change-Id: Ibdcd74f47043762386b62f3ec0fa1723060446ac
Closes-Bug: 1316618
(cherry picked from commit e97eea83ae162b9ce0f45f1ff334dbf70608fe3f)
use TRUE in SQL for boolean var

The "allocated" variable was defined to be a boolean type
and in postgresql this type is enforced,
while in mysql this just maps to tinyint and accepts both numbers and bools

Closes-Bug: #1368251
Change-Id: If324c8b83e490e150085d044ac61360b647522ac
(cherry picked from commit b030300b1687b853a95b6bd2e706045f549d1e50)
Big Switch: Check for 'id' in port before lookup

Check for the presence of the 'id' key before trying
to do a lookup based on the value. This is necessary
because a 'fields' param to get_port(s) may exclude
the 'id' field before the host_id lookup.

Conflicts:
	neutron/tests/unit/bigswitch/test_restproxy_plugin.py

Closes-Bug: #1358668
Change-Id: If30567d5deaeabd2de6c6287fac7a81695a41cc5
(cherry picked from commit 295efa00081c770a57a5541652d9d3ffd5c1074d)
NSX: Optionally not enforce nat rule match length check

This patch adds the 'raise_on_len_mismatch' parameter to the
'delete_nat_rules_by_match' function. The plugin then leverages
this parameter for ensuring NAT rules deletion operations
are completed successfully even when duplicate rules are found
or no corresponding rules are found at all.

With this change, the 'remove_router_interface' operation will
correctly complete even in cases when NAT rules in Neutron and
the NSX backend are out of sync.

This patch also changes a check in delete_nat_rules_by_match in
order to make it less expensive.

Closes-Bug: 1328181

Change-Id: I856d67ef5ff6264374cb8f2569668da4c205ad9f
(cherry picked from commit 138d9774000335d66c335e036ea96dac7b4a4799)
Don't convert numeric protocol values to int

They are treated as strings everywhere. Converting them to int causes problems
when using postgresql as the database backend because it doesn't automatically
cast them back to integer.

Change-Id: I9f0a5149d24a4c003409728e50376569c97e7325
Closes-bug: 1330490
(cherry picked from commit 3be62f878e8165cf3bce357a00b8a583773f7d3b)
Add missing ml2 plugin to migration 1fcfc149aca4

Migration 1fcfc149aca4_agents_unique_by_type_and_host
shouldbe applied to ml2 plugin as well.

Change-Id: I3f5a2fcfec49316fbe06d6221d003aeb2599bca7
Closes-Bug: #1350326
(cherry picked from commit 30f1a75e790a512ea8b2b4997a634a50070fef9f)
Add delete operations for the ODL MechanismDriver

This commit adds delete operations (networks, subnets and ports) for the ODL MechanismDriver.
It also modifies sync_single_resource to reduce db operations.

Change-Id: I03ca04c83ac2ef9c879fbd87e74bae495daea16d
Closes-Bug: #1324450
Partial-Bug: #1325184
(cherry picked from commit c1ed203ccb816ac0a3a0e015d2790ed3aee04564)
Forbid regular users to reset admin-only attrs to default values

A regular user can reset an admin-only attribute to its default
value due to the fact that a corresponding policy rule is
enforced only in the case when an attribute is present in the
target AND has a non-default value.

Added a new attribute "attributes_to_update" which contains a list
of all to-be updated attributes to the body of the target that is
passed to policy.enforce.

Changed a check for whether an attribute is explicitly set.
Now, in the case of update, the function should not pay attention
to a default value of an attribute, but check whether it was
explicitly marked as being updated.

Added unit-tests.

Conflicts:
	neutron/common/constants.py

Closes-Bug: #1357379
Related-Bug: #1338880
Change-Id: I6537bb1da5ef0d6899bc71e4e949f2c760c103c2
(cherry picked from commit 74d10939903984d5f06c1749a8707fa3257e44ff)
Merge "NSX: Optionally not enforce nat rule match length check" into stable/icehouse
Merge "Big Switch: Check for 'id' in port before lookup" into stable/icehouse
Merge "Forbid regular users to reset admin-only attrs to default values" into stable/icehouse
Merge "Add delete operations for the ODL MechanismDriver" into stable/icehouse
Merge "Don't convert numeric protocol values to int" into stable/icehouse
Merge "call security_groups_member_updated in port_update" into stable/icehouse
Merge "Add missing ml2 plugin to migration 1fcfc149aca4" into stable/icehouse
Merge "use TRUE in SQL for boolean var" into stable/icehouse
Deletes floating ip related connection states

When a floating ip is dissociated with a port, the current
connection with the floating ip is still working. This patch
will clear the connection state and cut off the connection
immediately.

Since conntrack -D will return 1, which is not an error code,
so add extra_ok_codes argument to execute methods.

Change-Id: Ia9bd7ae243a0859dcb97e2fa939f7d16f9c2456c
Closes-Bug: #1334926
(cherry picked from commit 966645538395079b5337b5ed30d597112279283c)
Merge "Deletes floating ip related connection states" into stable/icehouse