Merge pull request #328 from mssonicbld/sonicbld/202603-merge

```<br>* a295d6b - (HEAD -> 202603) Merge branch '202511' of https://github.com/sonic-net/sonic-utilities into 202603 (2026-05-14) [Sonic Automation]
* 3136803 - (origin/202511) [acl-loader] Include `IP_TYPE=IP` in `IP_PROTOCOL` rules (#4540) (2026-05-14) [mssonicbld]<br>```

Author: mssonicbld

acl_loader/main.py

@@ -774,6 +774,12 @@ def convert_rule_to_db_schema(self, table_name, rule, skip_action_validation=Fal
         deep_update(rule_props, self.convert_transport(table_name, rule_idx, rule))
         deep_update(rule_props, self.convert_input_interface(table_name, rule_idx, rule))
 
+        if "IP_PROTOCOL" in rule_props and "IP_TYPE" not in rule_props:
+            # If we don't include IP_TYPE as a qualifier in the IP_PROTOCOL rule
+            # we could match on non-IP packets if the bits at the same offset match
+            # https://github.com/sonic-net/sonic-mgmt/issues/23960
+            rule_props["IP_TYPE"] = "IP"
+
         self.validate_rule_fields(rule_props)
 
         return rule_data

tests/acl_loader_test.py

@@ -76,6 +76,7 @@ def test_load_rules_when_capability_table_is_empty(self, acl_loader):
                 "VLAN_ID": 369,
                 "ETHER_TYPE": "2048",
                 "IP_PROTOCOL": 6,
+                'IP_TYPE': 'IP',
                 "SRC_IP": "20.0.0.2/32",
                 "DST_IP": "30.0.0.3/32",
                 "PACKET_ACTION": "FORWARD",
@@ -94,6 +95,7 @@ def test_vlan_id_translation(self, acl_loader):
             "VLAN_ID": 369,
             "ETHER_TYPE": "2048",
             "IP_PROTOCOL": 6,
+            'IP_TYPE': 'IP',
             "SRC_IP": "20.0.0.2/32",
             "DST_IP": "30.0.0.3/32",
             "PACKET_ACTION": "FORWARD",
@@ -134,6 +136,7 @@ def test_v4_rule_inv4v6_table(self, acl_loader):
             "VLAN_ID": 369,
             "ETHER_TYPE": 2048,
             "IP_PROTOCOL": 6,
+            'IP_TYPE': 'IP',
             "SRC_IP": "20.0.0.2/32",
             "DST_IP": "30.0.0.3/32",
             "PACKET_ACTION": "FORWARD",
@@ -147,6 +150,7 @@ def test_v6_rule_inv4v6_table(self, acl_loader):
         assert acl_loader.rules_info[("DATAACLV4V6", "RULE_2")] == {
             "ETHER_TYPE": 34525,
             "IP_PROTOCOL": 58,
+            'IP_TYPE': 'IP',
             "SRC_IPV6": "::1/128",
             "DST_IPV6": "::1/128",
             "PACKET_ACTION": "FORWARD",
@@ -170,6 +174,7 @@ def test_icmp_translation(self, acl_loader):
             "ICMP_TYPE": 3,
             "ICMP_CODE": 0,
             "IP_PROTOCOL": 1,
+            'IP_TYPE': 'IP',
             "SRC_IP": "20.0.0.2/32",
             "DST_IP": "30.0.0.3/32",
             "ETHER_TYPE": "2048",
@@ -208,6 +213,7 @@ def test_icmp_translation_in_custom_acl_table_type(self, acl_loader):
             "ICMP_TYPE": 136,
             "ICMP_CODE": 0,
             "IP_PROTOCOL": 1,
+            'IP_TYPE': 'IP',
             "PACKET_ACTION": "FORWARD",
             "PRIORITY": "9998"
         }
@@ -220,6 +226,7 @@ def test_icmpv6_translation_in_custom_acl_table_type(self, acl_loader):
             "ICMPV6_TYPE": 136,
             "ICMPV6_CODE": 0,
             "IP_PROTOCOL": 58,
+            'IP_TYPE': 'IP',
             "PACKET_ACTION": "FORWARD",
             "PRIORITY": "9998"
         }