Option for root_helper when checking namespace

Adds a configuration option to use the root helper in the ip netns list
command executed by the IP library when checking for the existence of a
namespace.  This prevents an unprivileged l3 agent from erroneously trying
to create another namespace when one already exists. This is necessary in
environments with constrained permissions on /var/run/netns via umask or
other access controls.

However, due to the overhead incurred by calling sudo every time on systems
where this restriction isn't in place, this configuration won't be desired
all of the time. So this patch also adds a sanity check that reports back
whether or not the root_helper is required for a deployment.

DocImpact

Closes-Bug: #1348812
Closes-Bug: #1311804
Change-Id: If7560161de3be6066af0d9866e6b5cd7c7247c33
Allow setting a tenant router's external IP

Adds an external_ip option to the router creation
and update operations to set the IP address the router
will try to use as its fixed IP on the external network
it's attached to. By default this is restricted to an
admin-only operation by policy.json.

DocImpact
ApiImpact

Implements: blueprint specify-router-ext-ip
Closes-Bug: #1188427
Change-Id: Iba7c606eea48181fc10e9d0d5dc667e6f48f37de
linuxbridge: Use lazy logging interpolation

There are a small number of examples of "eager" interpolation in
neutron:
  logging.debug("foo %s" % arg)

These should be converted to perform the interpolation lazily within
the logging function, since if the severity is below the logging level
then the interpolation can be skipped entirely.

This change addresses all such examples found in linuxbridge agent via a
pylint test.  Other occurrences are addressed elsewhere.

Change-Id: I5cb3bbb401f5049760dfe5263a52bd43f23dcfd4
Partial-Bug: #1404788
brocade: Use lazy logging interpolation

There are a small number of examples of "eager" interpolation in
neutron:
  logging.debug("foo %s" % arg)

These should be converted to perform the interpolation lazily within
the logging function, since if the severity is below the logging level
then the interpolation can be skipped entirely.

This change addresses all such examples found in brocade
l3_router_plugin via a pylint test.  Other occurrences are addressed
elsewhere.

Change-Id: Ia2d51e8ecbc7af81390577ec69c5ce18523b65f3
Partial-Bug: #1404788
Enable pylint checks for "anomalous" string escapes

Escapes in python string literals are well defined, but can be
confusing.  These pylint checks look for backslash escapes in strings
that might be mistakes.  Two code refactors were required to satisfy
these tests:

1. midonet_lib.py used \**kwargs in docstrings.

There doesn't seem to be a sphinx standard for kwargs, so this change
simply replaces them with "kwargs".

2. Regex literals containing escapes replaced with r''.

The assumption with this change (and the underlying pylint
check) is that r'' literals are more straightforward for regular
expressions, where every backslash is important.

While looking at these regexes, this change also removes a few
unnecessary "\-" escapes.

Change-Id: I01528b2482f78b9e851685ebbf6fded4e58355f1
Allow to specify IP address of floating ip

IP address of floating ip will be automatically allocated.
There are cases where users need to specify a floating IP address.
This patch addresses the problem.

The feature is limited by "create_floatingip:floating_ip_address" in
"policy.json".
By default, it needs an admin role.

DocImpact
APIImpact

Implements: blueprint allow-specific-floating-ip-address

Change-Id: Iba64a0f0a38ca5eb39c605e121a12c956637b96c
Set type=internal as part of port creation

When creating an internal device with ovs-vsctl, the 'set'
operation must occur as part of the transaction that creates the
port, otherwise the device creation will fail and an ofport will
not be assigned.

Change-Id: I30ecb920ee1c64d25b5e7eed69e92bd71caac435
Eventlet green threads not released back to pool

Presently, the wsgi server allows persist connections. Hence even after
the response is sent to the client, it doesn't close the client socket
connection. Because of this problem, the green thread is not released
back to the pool.

In order to close the client socket connection explicitly after the
response is sent and read successfully by the client, you simply have to
set keepalive to False when you create a wsgi server.

Added a parameter to take advantage of the new(ish) eventlet socket timeout
behaviour. Allows closing idle client connections after a period of time, eg:

$ time nc localhost 8776
real    1m0.063s

Setting 'client_socket_timeout = 0' means do not timeout.

DocImpact:
Added wsgi_keep_alive option (default=True).
Added client_socket_timeout option (default=900).

SecurityImpact

Closes-Bug: #1361360
Change-Id: I3a361d6590d1800b85791f23ac1cdfd79815341b
VMware: fix security group check on port create

The code did not consider an empty list among the cases
in which security groups are not supplied on port create.

Change-Id: I325cce2165d2ec683ecac3cabdbfb80a03b288c9
Closes-Bug: #1405311
Merge "Enable pylint checks for "anomalous" string escapes"
Merge "Allow to specify IP address of floating ip"
Merge "VMware: fix security group check on port create"
Merge "linuxbridge: Use lazy logging interpolation"
Merge "brocade: Use lazy logging interpolation"
Merge "Allow setting a tenant router's external IP"
Merge "Set type=internal as part of port creation"
Merge "Option for root_helper when checking namespace"
Merge "Eventlet green threads not released back to pool"