Ron He

Add PbrAclManager and PbrUtils unit tests Summary: Stage B of PBR. Covers PbrUtils naming/priority/synthesis, PbrPolicy getters+serialization, and PbrAclManager: synthesizes entries into PbrAclTable, no-op on empty policy map, throws when the table is missing, deterministic reconstruct (warmboot), and preservation of non-PBR (IP-only counting) entries. ___ Differential Revision: D110434245 fbshipit-source-id: 0ba16b44d73c5637cae353e9df529c5b68389232

Add the access policy ACL agent hw test Summary: Sends every probe in on a restricted and an unconstrained port and checks the rule counter that fired and whether the packet left the egress port. Covers cold boot and warm boot on the access policy config. ___ Differential Revision: D118222136 fbshipit-source-id: 3b7d76d6476eacfde9353825181ba05be9d34e7d

Move the access policy ACL fixture into a header Summary: The stress tests in the next diffs need `verifyBatch`, `verifyClass`, `makeProbePacket` and the shape fixtures, and they live in a different buck target. Duplicating them would fork the verification logic, so move the fixture into `AgentAccessPolicyAclTestBase.h` instead. Pure move. The anon namespace helpers become `inline` because an anonymous namespace in a header trips `-Werror,-Wunused-function` in translation units that use only some of them, and the fixture's `private:` becomes `protected:` so a derived fixture can reach the verify helpers. ___ Differential Revision: D118613608 fbshipit-source-id: d0276bb61ec776fd6c8ab01a6d875dc66adab135

Add and enable the ACL entry LabelExtended attribute Summary: An ACL entry's AdapterHostKey is `TableId` + `Priority`, so two entries in a table cannot share a priority -- PBR needs exactly that. Adds `LabelExtended` as a third key element, populated from the entry name and enabled on leaba 26.5.5210 only (26.5.5211 dropped the `SAI_ACL_ENTRY_ATTR_EXT_*` block). Also adds `std::vector<sai_int8_t>` to the tracer's `listFuncMap_`, without which the replayer silently drops every s8list extension attribute. Reviewed By: shri-khare Differential Revision: D115700700 fbshipit-source-id: 62d92aa41d991200f4665a7323b0a94d585823a0

Don't recreate an ACL table when the qualifiers match the ASIC default Summary: An empty `qualifiers` list means "whatever the ASIC supports", but `needsAclTableRecreate` compared the raw config vector, so a config that starts publishing exactly the set `getSupportedQualifierSet()` derives tore the table down and rebuilt every entry in it for no attribute change. Compare the effective sets instead, since we are adding configeator changes that publishes `AclTable1`'s qualifiers on wedge400/wedge400c/darwin RSWs. Without it will, rebuild the whole CoPP table on an ordinary config reload. Reviewed By: jasmeetbagga Differential Revision: D118198508 fbshipit-source-id: ec35e96b7abf3519e84b89e05e7a49152c44e52d

Add LabelExtended counter SAI attribute Summary: Onboard the leaba extension attribute `SAI_COUNTER_ATTR_EXT_LABEL_EXTENDED` (`sai_s8_list_t` -> `std::vector<int8_t>`) as `SaiCounterTraits::LabelExtended` so route-counter labels can exceed the 32-byte `SAI_COUNTER_ATTR_LABEL`. A `SaiS8ListDefault` default getter keeps warmboot reload tolerant of counters created without it. No behavior change yet (all call sites pass `std::nullopt`); usage is gated on `FLAGS_srv6` in a later diff. Kept as one atomic diff because the SAI replayer attribute audit requires the attribute and its tracer registration to land together. Reviewed By: shri-khare Differential Revision: D113505026 fbshipit-source-id: fdb01327d00e6acb2a276e1929f9d1797dd41ed7

Reconstruct class-based policy store on warm boot / rollback Summary: Adds a `classBasedPolicyMaps` param to `NextHopIDManager::reconstructFromSwitchStateMaps` and a `reconstructClassBasedPolicyPass` that rebuilds `pbrPolicyToNamedNhg_` from the persisted policies, reading each referenced NHG name straight off the stored `NamedNextHopGroupAndID`. Without it the publisher would diff against an empty store after warm boot and wipe the persisted policies. Rollback paths pass the applied state's policies; the `fromThrift` boot path is threaded through in the next diff. Reviewed By: jasmeetbagga Differential Revision: D113504059 fbshipit-source-id: 9e855b6eb803a0cd5657defbd60fee5a2e1d6957

Inherit child SRv6 SID list in recursive next-hop resolution Summary: During recursive resolution, routes do not inherent the SRv6 SidList from recursive-resolved next hops. This is incorrect. Instead, the behavior should be 1. If parent route has SidList while recursive-resolve nexthops do not -> use parent route SidList 2. If parent route does not have SidList while recursive-resolve nexthops do -> use recursive-resolved nexthop sidlist 3. If both have SidList -> use parent route SidList Reviewed By: jasmeetbagga Differential Revision: D111350721 fbshipit-source-id: f8e6e821bf6ae43c6b9374196895744bff4ea437

Add WarmbootRemoteRouteReconcileTest Summary: Unit tests for SwSwitch warmboot reconciliation (D102848360): no-drift, missing route re-add, extra route delete, IP-swap, cold-boot guard, multi-prefix drift counter aggregation. Split out of D102848360 to keep that diff core-only. Part of T266175850 (S648783). Reviewed By: tanmayaudupa Differential Revision: D105277267 fbshipit-source-id: afb6fde040a6a6d8dd915c75a1d0c41c4054c97e

Reconcile remote interface routes on warmboot Summary: Wires `auditRemoteInterfaceRoutes` into `SwSwitch::init` warmboot (after `setStateInternal(initialState)`, before `notifyStateObservers`). On drift: logs every missing/extra/duplicate prefix, bumps `warmboot_remote_intf_routes_inconsistency`, and calls `rib_->updateRemoteInterfaceRoutes` to reconcile. No-op on cold boot or when there is no drift. Mitigates the RIB/FIB drift class behind SEV S648783. Mitigates T266175850. Reviewed By: jasmeetbagga Differential Revision: D102848360 fbshipit-source-id: a00d6bad12c89b0746f600f5d15a1bdbefa36e54