contrail-collector does UVE Updates based on messages from generators.
It also deletes UVE values from redis when generators disconnect.
We saw an instance where updates seems to happen just after a disconnect.
This causes contrail-analytics-api to return stale values for some UVE attributes.

Before the UVEUpdate script writes updates to redis, it should check that the generator
for which the update is being done is still connected (via the NGENERATORS set in redis)

Change-Id: If376bca64f5a8ba5be9eaa72a71d47a275b6eb20
Closes-Bug: #1383896
In an external network, even though a floatingIP is reserved, it can be created as an InstanceIP.
This patch corrects that bug

Backported from master

Closes-bug: #1368691

Change-Id: Ifc2203a05901f03a787fb3652c07de0e09542017
To fix sanity issue for test_vm_with_sec_group, issue was creating security group through vncapi does not set display name, get through neutron was only based on dispay name, added sg_obj.name as well

Closes-Bug: #1385541

Change-Id: I44649f22a1582eecb9d58882f53fb13b205d6aa4
(cherry picked from commit 7ed4bb0c230e3577192a5c3a92fe3fd8b01bbcf2)
[Schema] Clean VMI and instance IP correctly

The VirtualMachineInterfaceST object list is not clean properly and
growing with time.

- Add function to catch the VMI delete event.
- If schema fails to read VMI or IIP on the API, delete IIP or
VirtualMachineInterfaceST into the list.
- And that patch also exit the 'process_pool_result' method if none of the
poll requests call a schema method.

Closes-bug: #1382397
(cherry picked from commit 75458b4509f50f49c99c54ba3f61c5c86bb89ef2)
Change-Id: Ib386ea5b53fbaea4ae15b34c1c74837b06b258ef
Fix the device_id and device_owner of gw

This patch fix the values returned for the
gateway port of a router.
In order to be able to get the device_id
when doing a neutron port-show this patch
also add a new link in schema between
the service instance and the logical
router.

(cherry picked from commit 8b955dcb6043655c60a03e12e9b58816d74307d8)

Conflicts:

	src/config/vnc_openstack/vnc_openstack/neutron_plugin_db.py

Change-Id: I98f8a268a3bae94e73e11ac40784009652faf848
Add a user_visible property to resources

This patch add a user_visible to resources
in order to hide some technical resources
from the user point of view. For example
for the SNAT we can to hide technical
resources like a network and a port.

Resources with the property user_visible
set to false will be not count in quotas.

(cherry picked from commit 7fb6280064e6c8d8dbc7542162431203888d952e)
(cherry picked from commit 5eae0756022514097072f1f6654da91de09b9434)

Conflicts:

	src/config/api-server/vnc_cfg_types.py
	src/config/svc-monitor/svc_monitor/instance_manager.py
	src/schema/vnc_cfg.xsd
Change-Id: I77326dca9ec9de1f8b2824c2daa31b03a181812b
Ensures that permissions are set when _http_put_common

Without this patch permissions can be lost during
update operations.

Closes-bug: #1378376
(cherry picked from commit ed0ba01b50c79a395b18072d6e529a92e09b2a46)
Change-Id: I9c7488b4be00d4a4a960cdf8330dd3abd8454215
Limits fields that can be updated

This patch limits the fields that can
be updated during update operations.
currenlty limits to enable and description
field.

Partial-Bugs: #1378376
(cherry picked from commit 3c8b404089b4305b3224f0d8676ee4f194e128e3)
Change-Id: I39883d9010397f0a82d99bbe3e09b4d8a1dc1d31
Fixes a Ip address already in use exception

Without this patch svc_monitor tries to
allocate the same public ip twice.

Since the following patch introduced
a check a exception is raised is that
case.

https://review.opencontrail.org/#/c/2884/

This patch removes the double
allocation.

Closes-bug: bug/1376741
(cherry picked from commit 46931415bdca93061eaf04ac6060b59c541950b4)
Change-Id: Ia8a50e027847eecfb04dfd399151d36f05d300a1
Add admin role to see hidden resources

Add admin role to:

- local keystone auth API
- default auth service

to be able to see hidden resources.

Partial-Bug: #1377139
(cherry picked from commit 024279e03d9591b06948df51b4256a79a22a1a57)
Change-Id: I7e7e8cb29ae105702c7680fa7ab9fb1303ca671c
(cherry picked from commit bed9a8fc8d9d0373bb510aa3bd1a35ea5195de4b)
Set the user_visibility to False of GW ports

Closes-bug: #1376757
(cherry picked from commit ceba32269dea6b21b7ecf41f348baf804b8f2556)

Conflicts:

	src/config/svc-monitor/svc_monitor/instance_manager.py
Change-Id: I108971213670dfd00bdf20386c7c6225b07bc000
Add security to management of processes through supervisord
As part of this commit we do following:
a) Allow supervisorctl to connect to supervisord only through unix
domain sockets. We also make the permissions of supervisord unix
domain sockets restrictive so that only root can invoke supervisorctl
command.

b) Make changes in nodemgr so that we do not depend on Juniper
proprietary extensions to supervisord.

Change-Id: Ic81abbf9d6f37f55f96ddad37623d77524969a39
Closes-PR: 1383939
Closes-PR: 1383503
UUID reset to None in id_perms
Root cause: If the PUT request doesn't contain the uuid in obj dict, new id_perms is created with default value. This would reset the UUID field
The request from UI would not contain the 'uuid' field in obj_dict in PUT request.

Change-Id: I80bbfcd4d1d99d28de566a423ceb1bf0d967ca46
Fix: Pass obj_uuid from PUT request to "_ensure_id_perms_present" instead of accessing the 'uuid' from obj_dict.
Allow multiple in-network services in chain to be on 1 vRouter

Problem:

If 2 in-network service instances that are part of the same chain get
instantiated on the same compute node, service chaining does not work
correctly.  ServiceChain routes for only one of the service instances
get adverrtised as L3VPN routes.  This is the case for both the left
and right routing instances of each service instance.

Cause:

The root cause is a design issue in the service chaining code in the
case of multiple in-network services. The RD for ServiceChain routes
gets generated based on IP Fabric address of the agent advertising
the connected route and the VRF id of the agent in default RI for the
left and right VNs of the servcie chain. Since the VRF id used is from
the default RI and not the service RI, the RD for ServiceChain routes
from both instances is the same.  Hence we end up with 2 paths for the
same L3VPN routes instead of 2 different L3VPN routes.  Consequently,
only one of the patsh gets advertised to other peers via BGP.

Fix:

Fix is to generate the RD for ServiceChain routes based on VRF id of
the agent for the service routing instance into which the ServiceChain
route gets added.  Also take care of race conditions where the CN may
have received the connected route from agent, but the agent has not
yet subscribed to the service chain routing instance. This is done by
updating all ServiceChain routes for a service routing instance when
an agent subscribes or ubsubscribes to it.

Pending:

If a connected route is originated from XMPP, CN needs to only use the
XMPP route to generate a path for the ServiceChain route.  Information
from BGP routes advertised by other CNs as a result of exporting the
XMPP route should not be used to generate path for ServiceChain route.
This will be addressed via a separate commit.

Change-Id: I214ace1966f9bb4ca16c1fe80799a4c0d15926de
Partial-Bug: 1374114
Merge "Allow multiple in-network services in chain to be on 1 vRouter" into R1.10
[SVC monitor] Correct mispelling into instance monitor

Change-Id: Ib35f239e173bd105bcd7b94ae059472cafe7fd3c
Closes-bug: #1389183
Check for deleted AgentXmppChannel while updating new set of XmppServers learnt by Discovery.
Note, we delete the AgentXmppChannel in the same loop while configuring new connections.

1389817

Change-Id: Ie41dbd1c462e63686d182800c68fe1e42da223e0
    Make the RND secret configurable in the DNS config file.
    Also take the named config directory, file name and log file as config parameters.
    Create the rndc file.

    Test cases to check the new config options.

Change-Id: Ia7a54134e03a20b033785a7e4a4762599b84949d
Add the copyright file of Bind

Change-Id: If6b273a6b4cf6e4b9e4c3184c773db10cbb03c2a
Merge "Add the copyright file of Bind" into R1.10