Improve nACL Optimization

[YairSlobodin1]

• Using the power of deny rules: Sometimes there is a hole that can be blocked with a deny rule and then a larger allow rule, instead of several allow rules (see example 1). Dividing the cubes into groups of adjacent cubes and checking whether it is better to use complement rules instead may improve the optimization.
• Currently the activeRules algorithm runs according to the src dimension, but it might be improved if we run it from other dimensions as well. See Example 2.
• src, dst of nACL rules should be a single CIDR. This could be improved, see example 3.

---

example one

can be converted into 2 rules

---

example two

can be converted into 2 cubes

---

example three

allow src -> 1.1.1.1
allow src -> 1.1.1.2/31
allow src -> 1.1.1.4/30
allow src -> 1.1.1.8/29

can be converted to:

deny src -> 1.1.1.0
allow src -> 1.1.1.0/28

---

Note: In the examples above, assume that x axis is srcIP and y axis is dstIP

[zivnevo]

For example one, see test optimize_acl6_issue248_example1_tf (not active - currently commented out)