Rafactoring ACL attributes

[mzbroch]

• class refactor - distinguish between "actions" and ACL attributes , move "actions"/"settings" under ACL.Meta class
• unittests
• Cartesian product supports None values: src_ip': None, 'dst_ip': None, 'action': None}
• drop order_* methods
• option to raise exceptions in validate_
• aggregate results in validate_ and enforce_
• remove dst_port processor,
• -- provide additional examples through docs or contrib
• docs updates

[itdependsnetworks]

I had this as string as most vendors have more than just permit or deny, this is Palo's

allow
deny
drop
reset client
reset server
reset client and server

[mzbroch]

IMO match method should return only True/False if the rule is/not matched by the check. This should only check if A contains B.

[itdependsnetworks]

I think it is reasonable to have different levels.

[mzbroch]

I think, I see this in a little different way :

def match_action(action, match_action):
    deny_actions = ['deny', 'drop', 'reset client', 'reset server', ...]
    if action in deny_actions and match_action in deny_actions:
        return True
    else:
        return False

I would really like to avoid putting opinionated logic into generic match resolution while we provide easily extensible framework