[caclmgrd] Translation of ACL Control Plane rules into iptables commands fixed

[denis-maslov]

Signed-off-by: Denis Maslov [email protected]

- What I did
The problem
ACL control plane rules were not being translated into iptables rules
The config_db.json fragment with ACL configuration:

    "ACL_TABLE": {
        "TEST_ACL_TABLE": {
            "policy_desc": "Forward/Drop/Redirect Traffic",
            "type": "CTRLPLANE",
            "services": [
                "SNMP"
            ],
            "ports": [
                "Ethernet101",
                "Ethernet102",
                "Ethernet103",
                "Ethernet104"
            ]
        }
    }, 
    "ACL_RULE": {
        "TEST_ACL_TABLE|DROP_ON_ETH101": {
            "PRIORITY": "1011",
            "SRC_IP": "10.1.1.2/32",
            "DST_IP": "10.2.2.2/32",
            "ETHER_TYPE": "0x0800",
            "TCP_FLAGS": "0x30/0xFF",
            "IP_TYPE": "IP",
            "PACKET_ACTION": "DROP"
        }
    }, 

- How I did it
The causes

1. There were no check if the ip protocol is "tcp" before adding --tcp-flags argument into iptables command
2. It is necessary to set both mask and flags fields with --tcp-flags argument. But there were no parsing of the mask field from configuration db.

- How to verify it

1. Add the fragment above into config_db.json and apply new configuration
2. Check if ACL rules are created:

   admin@sonic:~$ acl-loader show rule
   Rule ID         Rule Name       Priority    Action    Match
   --------------  --------------  ----------  --------  --------------------
   TEST_ACL_TABLE  DROP_ON_ETH101  1011        DROP      DST_IP: 10.2.2.2/32
                                                         ETHER_TYPE: 0x0800
                                                         IP_TYPE: IP
                                                         SRC_IP: 10.1.1.2/32
                                                         TCP_FLAGS: 0x30/0xFF
   admin@sonic:~$ acl-loader show table
   Name            Type       Binding    Description
   --------------  ---------  ---------  -----------------------------
   TEST_ACL_TABLE  CTRLPLANE  SNMP       Forward/Drop/Redirect Traffic
   

3. Check if ACL rules are translated into iptables

   admin@sonic:~$ sudo iptables -L
   Chain INPUT (policy ACCEPT)
   target     prot opt source               destination         
   DROP       tcp  --  10.1.1.2             anywhere             tcp dpt:snmp flags:FIN,SYN,RST,PSH,ACK,URG/ACK,URG
   DROP       udp  --  10.1.1.2             anywhere             udp dpt:snmp
   
   Chain FORWARD (policy ACCEPT)
   target     prot opt source               destination         
   
   Chain OUTPUT (policy ACCEPT)
   target     prot opt source               destination    
   

- Description for the changelog

Translation of ACL Control Plane rules into iptables commands fixed

- A picture of a cute animal (not mandatory but encouraged)

  __________
 / ___  ___ \
/ / @ \/ @ \ \
\ \___/\___/ /\
 \____\/____/||
 /     /\\\\\//
|     |\\\\\\
 \      \\\\\\
   \______/\\\\
    _||_||_