T7419: VPP ACL implementation (#31)

CLI:
```
set vpp acl ip tag-name <tag-name> rule <nn> action <permit|deny|permit-reflect>
set vpp acl ip tag-name <tag-name> rule <nn> source prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> source port <port|range>
set vpp acl ip tag-name <tag-name> rule <nn> destination prefix <prefix>
set vpp acl ip tag-name <tag-name> rule <nn> destination port <port>
set vpp acl ip tag-name <tag-name> rule <nn> protocol <protocol>

set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags <fin|syn|rst|psh|ack|urg|ecn|cwr>
set vpp acl ip tag-name <tag-name> rule <nn> tcp-flags not <fin|syn|rst|psh|ack|urg|ecn|cwr>

set vpp acl ip interface <interface_name> input acl-tag <n> tag-name <tag-name>
set vpp acl ip interface <interface_name> output acl-tag <n> tag-name <tag-name>

set vpp acl macip tag-name <tag-name> rule <nn> prefix <prefix>
set vpp acl macip tag-name <tag-name> rule <nn> mac-address <mac>
set vpp acl macip tag-name <tag-name> rule <nn> mac-mask <mac-mask>
set vpp acl macip tag-name <tag-name> rule <nn> action <permit|deny>

set vpp acl macip interface <interface_name> tag-name <tag-name>
```
OP mode
```
show vpp acl ip tag-name <tag_name>
show vpp acl ip interface

show vpp acl macip tag-name <tag_name>
show vpp acl macip interface
```

2 files changed, 109 insertions, 0 deletions

diff --git a/python/vyos/vpp/acl/__init__.py b/python/vyos/vpp/acl/__init__.py
new file mode 100644
index 000000000..6bd6cdb23
--- /dev/null
+++ b/python/vyos/vpp/acl/__init__.py
@@ -0,0 +1,3 @@
+from .acl import Acl
+
+__all__ = ['Acl']
diff --git a/python/vyos/vpp/acl/acl.py b/python/vyos/vpp/acl/acl.py
new file mode 100644
index 000000000..9da241f1c
--- /dev/null
+++ b/python/vyos/vpp/acl/acl.py
@@ -0,0 +1,106 @@
+#
+# Copyright (C) 2025 VyOS Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+from vyos.vpp import VPPControl
+
+
+NO_ACL_INDEX = 0xFFFFFFFF
+
+
+class Acl:
+    def __init__(self):
+        self.vpp = VPPControl()
+
+    def get_acl_index_by_tag(self, tag):
+        """Get ACL index by tag name
+        https://github.com/FDio/vpp/blob/21c641f9356da5137760cdc799127064c8c1fd31/src/plugins/acl/acl.api
+        """
+        for acl in self.vpp.api.acl_dump(acl_index=NO_ACL_INDEX):
+            if acl.tag == tag:
+                return acl.acl_index
+        return NO_ACL_INDEX
+
+    def add_replace_acl(self, tag, rules):
+        """Add new ACL or replace existing one"""
+        self.vpp.api.acl_add_replace(
+            tag=tag,
+            acl_index=self.get_acl_index_by_tag(tag),
+            count=len(rules),
+            r=rules,
+        )
+
+    def delete_acl(self, tag):
+        """Delete existing ACL"""
+        self.vpp.api.acl_del(acl_index=self.get_acl_index_by_tag(tag))
+
+    def add_acl_interface(self, interface, input_tags, output_tags):
+        """Add or replace ACLs on interface"""
+        acls = []
+        for tag in input_tags:
+            acl_index = self.get_acl_index_by_tag(tag)
+            acls.append(acl_index)
+        for tag in output_tags:
+            acl_index = self.get_acl_index_by_tag(tag)
+            acls.append(acl_index)
+        self.vpp.api.acl_interface_set_acl_list(
+            sw_if_index=self.vpp.get_sw_if_index(interface),
+            count=len(acls),
+            n_input=len(input_tags),
+            acls=acls,
+        )
+
+    def delete_acl_interface(self, interface):
+        """Delete ACLs from interface"""
+        self.vpp.api.acl_interface_set_acl_list(
+            sw_if_index=self.vpp.get_sw_if_index(interface),
+            count=0,
+        )
+
+    def get_macip_acl_index_by_tag(self, tag):
+        """Get macip ACL by tag name"""
+        for acl in self.vpp.api.macip_acl_dump():
+            if acl.tag == tag:
+                return acl.acl_index
+        return NO_ACL_INDEX
+
+    def add_replace_acl_macip(self, tag, rules):
+        """Add or replace existing macip ACL"""
+        self.vpp.api.macip_acl_add_replace(
+            tag=tag,
+            acl_index=self.get_macip_acl_index_by_tag(tag),
+            count=len(rules),
+            r=rules,
+        )
+
+    def delete_acl_macip(self, tag):
+        """Delete existing macip ACL"""
+        self.vpp.api.macip_acl_del(acl_index=self.get_macip_acl_index_by_tag(tag))
+
+    def add_acl_macip_interface(self, interface, tag):
+        """Add or replace macip ACLs on interface"""
+        self.vpp.api.macip_acl_interface_add_del(
+            sw_if_index=self.vpp.get_sw_if_index(interface),
+            acl_index=self.get_macip_acl_index_by_tag(tag),
+            is_add=True,
+        )
+
+    def delete_acl_macip_interface(self, interface):
+        """Delete macip ACLs from interface"""
+        self.vpp.api.macip_acl_interface_add_del(
+            sw_if_index=self.vpp.get_sw_if_index(interface),
+            is_add=False,
+        )