[dhcp_server] Wait for caclmgrd-owned docker0 syslog rule on start/stop

files/build_templates/docker_image_ctl.j2

@@ -41,6 +41,10 @@ get_pmon_device_mounts() {
 }
 {%- endif %}
 
+{%- if docker_container_name == "dhcp_server" %}
+DHCP_SERVER_SYSLOG_CHECK=(iptables -C INPUT -i docker0 -p tcp -m tcp --dport 2514 -m comment --comment dhcp_server_syslog -j ACCEPT)
+{%- endif %}
+
 function updateSyslogConf()
 {
     # On multiNPU platforms, change the syslog target ip to docker0 ip to allow logs from containers
@@ -131,6 +135,33 @@ function preStartAction()
         echo "Cannot fetch system eeprom information. Setting chassis serial number to N/A."
         $SONIC_DB_CLI STATE_DB HSET 'DEVICE_METADATA|localhost' chassis_serial_number "N/A"
     fi
+{%- elif docker_container_name == "dhcp_server" %}
+    # Wait for caclmgrd to allow dhcp_server syslog before startup.
+    if [ "$($SONIC_DB_CLI CONFIG_DB HGET 'FEATURE|dhcp_server' state 2>/dev/null)" = "enabled" ]; then
+        local attempt status
+        for attempt in {0..10}; do
+            if "${DHCP_SERVER_SYSLOG_CHECK[@]}" 2>/dev/null; then
+                status=0
+            else
+                status=$?
+            fi
+
+            case "$status" in
+                0) break ;;
+                1|4)
+                    if [ "$attempt" -eq 10 ]; then
+                        echo "Warning: dhcp_server syslog rule not present after 10 seconds (iptables status $status)."
+                    else
+                        sleep 1
+                    fi
+                    ;;
+                *)
+                    echo "Warning: failed to check dhcp_server syslog rule (iptables status $status)."
+                    break
+                    ;;
+            esac
+        done
+    fi
 {%- else %}
     : # nothing
 {%- endif %}
@@ -900,6 +931,34 @@ stop() {
         /usr/local/bin/container stop $DOCKERNAME
     {%- endif %}
     fi
+{%- if docker_container_name == "dhcp_server" %}
+    # Wait for caclmgrd to remove the rule after feature disable.
+    if [ "$($SONIC_DB_CLI CONFIG_DB HGET 'FEATURE|dhcp_server' state 2>/dev/null)" = "disabled" ]; then
+        local attempt status
+        for attempt in {0..10}; do
+            if "${DHCP_SERVER_SYSLOG_CHECK[@]}" 2>/dev/null; then
+                status=0
+            else
+                status=$?
+            fi
+
+            case "$status" in
+                1) break ;;
+                0|4)
+                    if [ "$attempt" -eq 10 ]; then
+                        echo "Warning: dhcp_server syslog rule not absent after 10 seconds (iptables status $status)."
+                    else
+                        sleep 1
+                    fi
+                    ;;
+                *)
+                    echo "Warning: failed to check dhcp_server syslog rule (iptables status $status)."
+                    break
+                    ;;
+            esac
+        done
+    fi
+{%- endif %}
     {%- endif %}
 }