Add DSCP class-name keyword support

[yaakov-stein]

As mentioned in #383, add support for DSCP class name keywords in ip4.dscp and ip6.dscp matchers. Instead of requiring users to memorize numeric DSCP codepoints, rules can now use standard class names:

ip4.dscp eq ef
ip6.dscp not cs1
ip4.dscp eq af21

Supported keywords follow the IANA DSCP registry and match iptables conventions (see dscp_helper.c):

• CS0–CS7 (Class Selector)
• AF11–AF43 (Assured Forwarding)
• EF (Expedited Forwarding)
• BE (Best Effort, alias for CS0)

Keywords are case-insensitive. Numeric values (0–63, decimal or hex) continue to work as before.

Testing

• Unit + e2e tests
• Manual Testing

[github-actions]

Claude review of PR #492 (f6aec14)

Must fix

• Lexer rejects voice-admit (hyphenated DSCP class) — src/bfcli/lexer.l:212,242 — The DSCP lexer states only accept {int} tokens, which cannot match hyphens. voice-admit fails at lexing; also breaks round-trip since bf_dscp_class_to_str(44) outputs voice-admit which bfcli cannot re-parse. The ICMP type state already handles this with {int}|[0-9a-zA-Z-]+.

Suggestions

• Document all supported keywords — doc/usage/bfcli.rst:638 — Docs only mention ef, cs1, af21, be; voice-admit, le, nqb are omitted. Other matchers list all keywords in a tip block.
• Add e2e tests for le, nqb, voice-admit — tests/e2e/parsing/ip4_dscp.sh:22, tests/e2e/parsing/ip6_dscp.sh:23 — Newly added Pool 3 keywords lack e2e coverage. voice-admit requires the lexer fix first.
• Add unit tests for le, nqb, voice-admit — tests/unit/libbpfilter/matcher.c:394 — Only cs0, ef, af21, BE, Af11, VOICE-ADMIT are tested for from_str; le and nqb are untested. to_str only checks cs0 and ef.
• Restore generic invalid string test in ip6_dscp_invalid — tests/unit/libbpfilter/matcher.c:1185 — Replacing "not_a_number" with "cs8" lost coverage for arbitrary garbage strings; ip4_dscp still tests "invalid" alongside "cs8".

Nits

• Comment URL missing full path — src/libbpfilter/matcher.c:1677 — URL uses dscp-registry without .xhtml suffix, unlike the RST reference and other links in the codebase.

Workflow run