NSX: remove_router_interface might fail because of NAT rule mismatch

[Salvatore Orlando]

The remove_router_interface for the VMware NSX plugin expects a precise number of SNAT rules for a subnet.
If the actual number of NAT rules differs from the expected one, an exception is raised.

The reasons for this might be:
- earlier failure in remove_router_interface
- NSX API client tampering with NSX objects
- etc.

In any case, the remove_router_interface operation should succeed removing every match for the NAT rule to delete from the NSX logical router.

sample traceback: http://paste.openstack.org/show/83427/

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/98838

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/icehouse
Review: https://review.openstack.org/108532

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/98838
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=138d9774000335d66c335e036ea96dac7b4a4799
Submitter: Jenkins
Branch: master

commit 138d9774000335d66c335e036ea96dac7b4a4799
Author: Salvatore Orlando <email address hidden>
Date: Mon Jun 9 09:53:47 2014 -0700

    NSX: Optionally not enforce nat rule match length check

    This patch adds the 'raise_on_len_mismatch' parameter to the
    'delete_nat_rules_by_match' function. The plugin then leverages
    this parameter for ensuring NAT rules deletion operations
    are completed successfully even when duplicate rules are found
    or no corresponding rules are found at all.

    With this change, the 'remove_router_interface' operation will
    correctly complete even in cases when NAT rules in Neutron and
    the NSX backend are out of sync.

    This patch also changes a check in delete_nat_rules_by_match in
    order to make it less expensive.

    Closes-Bug: 1328181

    Change-Id: I856d67ef5ff6264374cb8f2569668da4c205ad9f

[OpenStack Infra (hudson-openstack)]

Change abandoned by Aaron Rosen (<email address hidden>) on branch: stable/icehouse
Review: https://review.openstack.org/108532

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/108532
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=3a8594624aa3bd1b6375f8450d0df3cbff782c82
Submitter: Jenkins
Branch: stable/icehouse

commit 3a8594624aa3bd1b6375f8450d0df3cbff782c82
Author: Salvatore Orlando <email address hidden>
Date: Mon Jun 9 09:53:47 2014 -0700

    NSX: Optionally not enforce nat rule match length check

    This patch adds the 'raise_on_len_mismatch' parameter to the
    'delete_nat_rules_by_match' function. The plugin then leverages
    this parameter for ensuring NAT rules deletion operations
    are completed successfully even when duplicate rules are found
    or no corresponding rules are found at all.

    With this change, the 'remove_router_interface' operation will
    correctly complete even in cases when NAT rules in Neutron and
    the NSX backend are out of sync.

    This patch also changes a check in delete_nat_rules_by_match in
    order to make it less expensive.

    Closes-Bug: 1328181

    Change-Id: I856d67ef5ff6264374cb8f2569668da4c205ad9f
    (cherry picked from commit 138d9774000335d66c335e036ea96dac7b4a4799)