fix(traffic): populate u32 selector for DSCP/protocol filters

translateFilter built netlink.U32 with ClassId but no TcU32Sel match
selector. DSCP/protocol filters configured via traffic-control reached
the
kernel matching nothing, silently failing to classify.

Fix: populate TcU32Sel with per-family keys (IPv4 TOS byte + IPv6
traffic
class for DSCP; IPv4 protocol byte + IPv6 next-header for protocol).
Each DSCP/protocol filter now produces two u32 filters (ETH_P_IP +
ETH_P_IPV6).

Also: extract shared DSCP name map to internal/core/dscp (used by both
firewall and traffic config parsers), add named DSCP support (cs6, ef,
etc.)
to traffic match config, add protocol value validation (0-255).

Author: thomas-mangin

internal/component/firewall/config.go

@@ -14,6 +14,7 @@ import (
 	"strconv"
 	"strings"
 
+	"codeberg.org/thomas-mangin/ze/internal/core/dscp"
 	"codeberg.org/thomas-mangin/ze/internal/core/textbuf"
 )
 
@@ -787,29 +788,8 @@ func parseUint32(s string) (uint32, error) {
 	return uint32(n), nil
 }
 
-// dscpNames maps symbolic DSCP names to numeric values.
-var dscpNames = map[string]uint8{
-	"ef":   46,
-	"af11": 10, "af12": 12, "af13": 14,
-	"af21": 18, "af22": 20, "af23": 22,
-	"af31": 26, "af32": 28, "af33": 30,
-	"af41": 34, "af42": 36, "af43": 38,
-	"cs0": 0, "cs1": 8, "cs2": 16, "cs3": 24,
-	"cs4": 32, "cs5": 40, "cs6": 48, "cs7": 56,
-}
-
 func parseDSCP(v string) (uint8, error) {
-	if n, ok := dscpNames[strings.ToLower(v)]; ok {
-		return n, nil
-	}
-	n, err := strconv.ParseUint(v, 10, 8)
-	if err != nil {
-		return 0, fmt.Errorf("invalid dscp %q", v)
-	}
-	if n > 63 {
-		return 0, fmt.Errorf("dscp value %d out of range (0-63)", n)
-	}
-	return uint8(n), nil
+	return dscp.Parse(v)
 }
 
 // byteRateMultiplier encodes the {value-less} prefix multiplier for the

internal/component/traffic/config.go

@@ -10,6 +10,8 @@ import (
 	"fmt"
 	"strconv"
 	"strings"
+
+	"codeberg.org/thomas-mangin/ze/internal/core/dscp"
 )
 
 var errEmptyFilterValue = errors.New("empty filter value")
@@ -171,10 +173,19 @@ func parseFilterValue(ft FilterType, v string) (uint32, error) {
 	switch ft { //nolint:exhaustive // filterUnknown rejected by ParseFilterType before reaching here
 	case FilterMark:
 		return parseHexOrDec(v)
-	case FilterDSCP, FilterProtocol:
-		n, err := strconv.ParseUint(v, 10, 32)
+	case FilterDSCP:
+		n, err := dscp.Parse(v)
 		if err != nil {
-			return 0, fmt.Errorf("invalid value %q: %w", v, err)
+			return 0, fmt.Errorf("filter dscp: %w", err)
+		}
+		return uint32(n), nil
+	case FilterProtocol:
+		n, err := strconv.ParseUint(v, 10, 16)
+		if err != nil {
+			return 0, fmt.Errorf("invalid protocol %q: %w", v, err)
+		}
+		if n > 255 {
+			return 0, fmt.Errorf("protocol value %d out of range (0-255)", n)
 		}
 		return uint32(n), nil
 	case filterUnknown:

internal/component/traffic/config_test.go

@@ -84,3 +84,45 @@ func TestParseTrafficInvalidRate(t *testing.T) {
 		t.Fatal("expected error for invalid rate")
 	}
 }
+
+func TestParseTrafficNamedDSCP(t *testing.T) {
+	data := `{"traffic-control":{"interface":{"eth0":{"qdisc":{"type":"htb","default-class":"default","class":{"control":{"rate":"10mbit","ceil":"100mbit","priority":"0","match":{"dscp":{"value":"cs6"}}},"default":{"rate":"90mbit","ceil":"100mbit","priority":"1"}}}}}}}`
+	qosMap, err := ParseTrafficConfig(data)
+	if err != nil {
+		t.Fatalf("ParseTrafficConfig: %v", err)
+	}
+	qos := qosMap["eth0"]
+	for _, cls := range qos.Qdisc.Classes {
+		if cls.Name != "control" {
+			continue
+		}
+		if len(cls.Filters) != 1 {
+			t.Fatalf("control class: got %d filters, want 1", len(cls.Filters))
+		}
+		f := cls.Filters[0]
+		if f.Type != FilterDSCP {
+			t.Fatalf("filter type = %v, want FilterDSCP", f.Type)
+		}
+		if f.Value != 48 {
+			t.Errorf("filter value = %d, want 48 (cs6)", f.Value)
+		}
+		return
+	}
+	t.Fatal("control class not found")
+}
+
+func TestParseTrafficDSCPRejectsOutOfRange(t *testing.T) {
+	data := `{"traffic-control":{"interface":{"eth0":{"qdisc":{"type":"htb","class":{"c":{"rate":"10mbit","match":{"dscp":{"value":"64"}}}}}}}}}`
+	_, err := ParseTrafficConfig(data)
+	if err == nil {
+		t.Fatal("expected error for dscp value 64")
+	}
+}
+
+func TestParseTrafficProtocolRejectsOutOfRange(t *testing.T) {
+	data := `{"traffic-control":{"interface":{"eth0":{"qdisc":{"type":"htb","class":{"c":{"rate":"10mbit","match":{"protocol":{"value":"256"}}}}}}}}}`
+	_, err := ParseTrafficConfig(data)
+	if err == nil {
+		t.Fatal("expected error for protocol value 256")
+	}
+}

internal/core/dscp/dscp.go

@@ -0,0 +1,37 @@
+// Design: docs/architecture/core-design.md -- DSCP name-to-value map
+
+package dscp
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+const MaxValue = 63
+
+var byName = map[string]uint8{
+	"ef":   46,
+	"af11": 10, "af12": 12, "af13": 14,
+	"af21": 18, "af22": 20, "af23": 22,
+	"af31": 26, "af32": 28, "af33": 30,
+	"af41": 34, "af42": 36, "af43": 38,
+	"cs0": 0, "cs1": 8, "cs2": 16, "cs3": 24,
+	"cs4": 32, "cs5": 40, "cs6": 48, "cs7": 56,
+}
+
+// Parse accepts a named DSCP value (e.g. "cs6", "ef") or a decimal
+// integer and returns the numeric DSCP value (0-63).
+func Parse(v string) (uint8, error) {
+	if n, ok := byName[strings.ToLower(v)]; ok {
+		return n, nil
+	}
+	n, err := strconv.ParseUint(v, 10, 8)
+	if err != nil {
+		return 0, fmt.Errorf("invalid dscp %q", v)
+	}
+	if n > MaxValue {
+		return 0, fmt.Errorf("dscp value %d out of range (0-%d)", n, MaxValue)
+	}
+	return uint8(n), nil
+}

internal/core/dscp/dscp_test.go

@@ -0,0 +1,47 @@
+package dscp
+
+import (
+	"testing"
+)
+
+func TestParseNamedDSCP(t *testing.T) {
+	tests := []struct {
+		input string
+		want  uint8
+	}{
+		{"cs6", 48},
+		{"CS6", 48},
+		{"ef", 46},
+		{"EF", 46},
+		{"cs0", 0},
+		{"af11", 10},
+		{"af43", 38},
+		{"cs7", 56},
+		{"48", 48},
+		{"0", 0},
+		{"63", 63},
+	}
+	for _, tt := range tests {
+		t.Run(tt.input, func(t *testing.T) {
+			got, err := Parse(tt.input)
+			if err != nil {
+				t.Fatalf("Parse(%q): %v", tt.input, err)
+			}
+			if got != tt.want {
+				t.Errorf("Parse(%q) = %d, want %d", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestParseRejectsInvalid(t *testing.T) {
+	tests := []string{"64", "255", "bogus", ""}
+	for _, input := range tests {
+		t.Run(input, func(t *testing.T) {
+			_, err := Parse(input)
+			if err == nil {
+				t.Fatalf("Parse(%q): want error, got nil", input)
+			}
+		})
+	}
+}

internal/plugins/traffic/netlink/backend_linux.go

@@ -126,12 +126,14 @@ func (b *backend) applyInterface(link netlink.Link, qos *traffic.InterfaceQoS) e
 		// Add filters for this class.
 		classHandle := class.Attrs().Handle
 		for _, f := range tc.Filters {
-			filter, err := translateFilter(f, linkIdx, rootHandle, classHandle)
+			filters, err := translateFilter(f, linkIdx, rootHandle, classHandle)
 			if err != nil {
 				return fmt.Errorf("class %q filter: %w", tc.Name, err)
 			}
-			if err := b.ops.filterAdd(filter); err != nil {
-				return fmt.Errorf("class %q filter add: %w", tc.Name, err)
+			for _, filter := range filters {
+				if err := b.ops.filterAdd(filter); err != nil {
+					return fmt.Errorf("class %q filter add: %w", tc.Name, err)
+				}
 			}
 		}
 	}

internal/plugins/traffic/netlink/cs6_integration_linux_test.go

@@ -0,0 +1,151 @@
+// Design: plan/spec-cp-survival-3-egress-cs6-sched.md -- CS6 classification integration test
+
+//go:build integration && linux
+
+package trafficnetlink
+
+import (
+	"context"
+	"net"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	"github.com/vishvananda/netlink"
+
+	"codeberg.org/thomas-mangin/ze/internal/component/traffic"
+)
+
+func setTOS(fd uintptr, tos int) error {
+	return syscall.SetsockoptInt(int(fd), syscall.IPPROTO_IP, syscall.IP_TOS, tos)
+}
+
+// VALIDATES: spec-cp-survival-3 AC-2 -- CS6-marked packets hit the control
+// class counter (classification works after the translateFilter fix).
+// PREVENTS: regression to the broken state where U32 had no Sel and matched nothing.
+func TestCS6ClassifyNetns(t *testing.T) {
+	withTrafficNetNS(t, func() {
+		const ifaceName = "ze_cs0"
+		link := addTrafficVeth(t, ifaceName, "ze_cs1")
+
+		path := filepath.Join(t.TempDir(), "state", "traffic-tc-snapshots.json")
+		b := newBackendWithOps(netlinkOps{}, path, nil, "boot-1", nil)
+
+		desired := map[string]traffic.InterfaceQoS{
+			ifaceName: {
+				Interface: ifaceName,
+				Qdisc: traffic.Qdisc{
+					Type:         traffic.QdiscHTB,
+					DefaultClass: "default",
+					Classes: []traffic.TrafficClass{
+						{
+							Name:     "control",
+							Rate:     1_000_000,
+							Ceil:     10_000_000,
+							Priority: 0,
+							Filters: []traffic.TrafficFilter{
+								{Type: traffic.FilterDSCP, Value: 48}, // CS6
+							},
+						},
+						{
+							Name:     "default",
+							Rate:     1_000_000,
+							Ceil:     10_000_000,
+							Priority: 1,
+						},
+					},
+				},
+			},
+		}
+		if err := b.Apply(context.Background(), desired); err != nil {
+			t.Fatalf("Apply: %v", err)
+		}
+
+		if got := rootQdiscTypeInKernel(t, ifaceName); got != "htb" {
+			t.Fatalf("root qdisc = %q, want htb", got)
+		}
+
+		filters, err := netlink.FilterList(link, netlink.HANDLE_ROOT)
+		if err != nil {
+			t.Fatalf("FilterList: %v", err)
+		}
+
+		var u32Count int
+		for _, f := range filters {
+			if _, ok := f.(*netlink.U32); ok {
+				u32Count++
+			}
+		}
+		if u32Count == 0 {
+			t.Fatal("no u32 filters installed (the bug: translateFilter produced U32 with no Sel)")
+		}
+		if u32Count < 2 {
+			t.Errorf("u32 filter count = %d, want >= 2 (IPv4 + IPv6)", u32Count)
+		}
+
+		peerLink, err := netlink.LinkByName("ze_cs1")
+		if err != nil {
+			t.Fatalf("link ze_cs1: %v", err)
+		}
+
+		addr := &netlink.Addr{IPNet: &net.IPNet{
+			IP:   net.IPv4(10, 99, 0, 1),
+			Mask: net.CIDRMask(24, 32),
+		}}
+		if err := netlink.AddrAdd(link, addr); err != nil {
+			t.Fatalf("addr add ze_cs0: %v", err)
+		}
+		peerAddr := &netlink.Addr{IPNet: &net.IPNet{
+			IP:   net.IPv4(10, 99, 0, 2),
+			Mask: net.CIDRMask(24, 32),
+		}}
+		if err := netlink.AddrAdd(peerLink, peerAddr); err != nil {
+			t.Fatalf("addr add ze_cs1: %v", err)
+		}
+
+		conn, err := net.DialUDP("udp4", &net.UDPAddr{IP: net.IPv4(10, 99, 0, 1)}, &net.UDPAddr{IP: net.IPv4(10, 99, 0, 2), Port: 9999})
+		if err != nil {
+			t.Fatalf("dial: %v", err)
+		}
+		defer conn.Close()
+
+		rawConn, err := conn.SyscallConn()
+		if err != nil {
+			t.Fatalf("SyscallConn: %v", err)
+		}
+		var setErr error
+		rawConn.Control(func(fd uintptr) {
+			setErr = setTOS(fd, 0xC0) // CS6 = DSCP 48, TOS = 0xC0
+		})
+		if setErr != nil {
+			t.Fatalf("setsockopt IP_TOS: %v", setErr)
+		}
+
+		payload := []byte("cs6test")
+		for i := 0; i < 50; i++ {
+			conn.Write(payload) //nolint:errcheck // best-effort: some may fail (no listener)
+		}
+
+		classes, err := netlink.ClassList(link, netlink.HANDLE_ROOT)
+		if err != nil {
+			t.Fatalf("ClassList: %v", err)
+		}
+
+		var controlStats *netlink.ClassStatistics
+		for _, cls := range classes {
+			htb, ok := cls.(*netlink.HtbClass)
+			if !ok {
+				continue
+			}
+			if htb.Handle == makeHandle(1, 1) {
+				controlStats = htb.Statistics
+			}
+		}
+		if controlStats == nil {
+			t.Fatal("control class (1:1) not found in kernel")
+		}
+		if controlStats.Basic.Packets == 0 {
+			t.Error("control class packet count = 0; CS6-marked packets were not classified (AC-2 fail)")
+		}
+	})
+}