[dhcp_server] Wait for caclmgrd-owned docker0 syslog rule on start/stop

files/build_templates/docker_image_ctl.j2

@@ -131,6 +131,21 @@ function preStartAction()
         echo "Cannot fetch system eeprom information. Setting chassis serial number to N/A."
         $SONIC_DB_CLI STATE_DB HSET 'DEVICE_METADATA|localhost' chassis_serial_number "N/A"
     fi
+{%- elif docker_container_name == "dhcp_server" %}
+    # dhcp_server runs in bridge mode; its rsyslog is sent over docker0 to
+    # host rsyslog via RELP (tcp/2514). caclmgrd owns the matching INPUT ACCEPT rule
+    # (gated on FEATURE|dhcp_server) and re-installs it on every control-plane ACL rebuild.
+    # When the feature is enabled, wait (bounded) for caclmgrd to install the rule before
+    # the container starts, so the RELP client's first connection is not dropped by the
+    # control-plane catch-all DROP.
+    if [ "$($SONIC_DB_CLI CONFIG_DB HGET 'FEATURE|dhcp_server' state 2>/dev/null)" = "enabled" ]; then
+        for i in $(seq 1 10); do
+            iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null && break
+            sleep 1
+        done
+        iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null || \
+            echo "Warning: caclmgrd-owned dhcp_server docker0 syslog ACCEPT rule still absent after the bounded wait; syslog to host may be dropped until caclmgrd installs it."
+    fi
 {%- else %}
     : # nothing
 {%- endif %}
@@ -900,6 +915,20 @@ stop() {
         /usr/local/bin/container stop $DOCKERNAME
     {%- endif %}
     fi
+{%- if docker_container_name == "dhcp_server" %}
+    # caclmgrd removes the docker0 syslog ACCEPT rule when FEATURE|dhcp_server is disabled.
+    # On an explicit feature disable, wait (bounded) for the rule to be removed so the
+    # control-plane ACL state is consistent before we return. Plain container restarts and
+    # shutdown (state not "disabled", or CONFIG_DB unreachable) skip the wait.
+    if [ "$($SONIC_DB_CLI CONFIG_DB HGET 'FEATURE|dhcp_server' state 2>/dev/null)" = "disabled" ]; then
+        for i in $(seq 1 10); do
+            iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null || break
+            sleep 1
+        done
+        iptables -w 1 -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment "dhcp_server_syslog" -j ACCEPT 2>/dev/null && \
+            echo "Warning: caclmgrd-owned dhcp_server docker0 syslog ACCEPT rule still present after the bounded wait despite dhcp_server feature disabled."
+    fi
+{%- endif %}
     {%- endif %}
 }