Add DSCP class-name keyword support

[yaakov-stein]

As mentioned in #383, add support for DSCP class name keywords in ip4.dscp and ip6.dscp matchers. Instead of requiring users to memorize numeric DSCP codepoints, rules can now use standard class names:

ip4.dscp eq ef
ip6.dscp not cs1
ip4.dscp eq af21

Supported keywords follow the IANA DSCP registry and match iptables conventions (see dscp_helper.c):

• CS0–CS7 (Class Selector)
• AF11–AF43 (Assured Forwarding)
• EF (Expedited Forwarding)
• BE (Best Effort, alias for CS0)

Keywords are case-insensitive. Numeric values (0–63, decimal or hex) continue to work as before.

Testing

• Unit + e2e tests
• Manual Testing

[github-actions]

Claude review of PR #492 (e0408af)

Suggestions

• Add not operator e2e test for class names (ip4) — tests/e2e/parsing/ip4_dscp.sh:30 — Class name keywords are only tested with eq; adding a not ef test would cover both operators at the integration level.
• Add not operator e2e test for class names (ip6) — tests/e2e/parsing/ip6_dscp.sh:31 — Same gap as ip4: no not operator test with a class name keyword.
• Move public conversion functions to match file organization — src/libbpfilter/matcher.c:732 — bf_dscp_class_to_str and bf_dscp_class_from_str are placed between static helpers, while all other public conversion functions are grouped near the bottom of the file.
• Fold "be" alias into lookup table — src/libbpfilter/matcher.c:1706 — Adding {"be", 0} to _bf_dscp_classes would let the generic loop handle it, removing the special-case branch. bf_dscp_class_to_str(0) would still return "cs0" since it appears first in the array.

Nits

• Misleading "out-of-range" comment — tests/unit/libbpfilter/matcher.c:394 — Value 64 is within uint8_t range; "values without a named class" would be more precise.
• Add generic invalid string test — tests/unit/libbpfilter/matcher.c:414 — dscp_class_conversions only tests class-name-like invalid inputs; adding a generic "invalid" string would match the ipproto_conversions pattern.
• Unnecessary (uint8_t *) cast — src/libbpfilter/matcher.c:740 — Other parse functions pass payload directly to *_from_str without a cast; the explicit cast is safe but inconsistent with the pattern.
• HTTP URL in comment — src/libbpfilter/matcher.c:1677 — The IANA link uses plain HTTP; consider updating to the HTTPS URL.

CLAUDE.md improvements

• Several public conversion function pairs in matcher.h (e.g. bf_ethertype_to_str, bf_ipproto_to_str, bf_icmp_type_to_str) lack Doxygen documentation. The new bf_dscp_class_* functions follow this existing pattern, but the style guide recommends documenting non-trivial public API functions. Consider adding a note to CLAUDE.md or the style guide clarifying documentation expectations for *_to_str/*_from_str conversion functions.

Workflow run

[github-actions]

Claude: nit: Other _bf_parse_* functions pass payload directly to their corresponding *_from_str call without a cast (e.g. bf_icmp_type_from_str(raw_payload, payload), bf_ipproto_from_str(raw_payload, payload)). The explicit (uint8_t *) cast is safe but unnecessary in C (void * converts implicitly) and inconsistent with the existing pattern.

[github-actions]

Claude: suggestion: The "be" alias is handled as a special case before the main loop. Adding {"be", 0} at the end of _bf_dscp_classes would fold it into the generic loop, removing this branch. bf_dscp_class_to_str(0) would still return "cs0" because it appears first in the array, preserving the canonicalization behavior.

[github-actions]

Claude: nit: The IANA link uses plain HTTP. Consider updating to https://www.iana.org/assignments/dscp-registry/dscp-registry.xhtml.