Unable to add an ingress security group rule when the remote-ip-prefix is un-masked

Setup:
1. Stateful Security Groups enabled.
2. Create a tenant network with an IPv4 subnet and associate it to a Neutron router.
3. Create an external FLAT network with IPv4 subnet and associate the external network to the router.
4. Spawn a VM on the tenant network and associate a floating-ip to the VM.
5. Add an ingress security group rule with an unmasked remote-ip-prefix (f.e., 172.16.1.20/24)

You can see that ACL service does not program this flow in Table 252.
However, if we add the same ingress ACL rule with a masked prefix (i.e., 172.16.1.0/24), it works fine.

There is no error in karaf when step-5 is executed. So user will not be aware of this issue.
Though we can expect that user always enter a masked prefix, IMHO its good to support this use-case by handling this in ACL Service.