acl-plugin: fix the stateful ICMP handling and add testcases