[1/2][CGROUP_SOCK_ADDR Logging] Add flavor-specific log codegen callback

[yaakov-stein]

Relies on #485 - gave stack-pr a try, but it doesn't allow for multi-commit PR's :(

Summary

Move log codegen into a per-flavor callback so each flavor controls its own register setup and ELF stub selection:

• Move cgen/matcher/packet.{c,h} to cgen/packet.{c,h}. It was a mistake to put this here in the first place as packet-based flavors can share more than matcher codegen. We correct the placement now.
• Add gen_inline_log to bf_flavor_ops, with bf_packet_gen_inline_log() as the shared implementation for all packet flavors.

[github-actions]

Claude review of PR #486 (e014ec7)

Claude is re-reviewing this PR… (workflow run)

Must fix

• assert(str) in bf_log_opt_from_str will crash unit tests — src/libbpfilter/rule.c:39 — The old bf_pkthdr_from_str did not assert on str, but the new code adds assert(str). The test harness assert_enum_to_from_str at tests/harness/test.h:54 explicitly calls from_str(NULL, &back) to test graceful NULL handling. This assert will abort in debug builds during unit tests

Suggestions

• Missing guard for gen_inline_log dispatch — src/libbpfilter/cgen/program.c:295 — Fixed: assert(program->runtime.ops->gen_inline_log) added at function entry
• Missing bf_log_type string mapping — src/libbpfilter/include/bpfilter/runtime.h:91 — Fixed: _bf_log_type_strs[], static_assert_enum_mapping, and bf_log_type_{to,from}_str now present in rule.c
• <linux/in6.h> include widens BPF stub dependencies — src/libbpfilter/include/bpfilter/runtime.h:15 — runtime.h is included by all BPF stubs. Adding <linux/in6.h> for sizeof(struct in6_addr) in the sock_addr variant pulls a kernel header into every stub's compilation. Consider using __u8 saddr[16] / __u8 daddr[16] instead
• req_headers 4-bit bitfield inconsistent with 8-option limit — src/libbpfilter/include/bpfilter/runtime.h:131 — Fixed: req_headers and headers are now full __u8 fields
• cgroup_sock_addr log stub errors at codegen time — src/libbpfilter/cgen/cgroup_sock_addr.c:284 — The stub returns -ENOTSUP during program generation. Chain validation already rejects this combination, so this is defense-in-depth
• Missing unit tests for bf_log_type_* functions — tests/unit/libbpfilter/rule.c:20 — Fixed: tests now present
• Add static_assert for struct bf_log size — src/libbpfilter/include/bpfilter/runtime.h:167 — Both BPF stubs and userspace readers must agree on the struct layout. A size assertion would catch unintentional layout drift

Nits

• Doxygen refers to sock variant — src/libbpfilter/include/bpfilter/runtime.h:96 — Fixed: now says sock_addr
• gen_inline_log required/optional not documented — src/libbpfilter/include/bpfilter/flavor.h:143 — Fixed: now says "Required for all flavors."
• static_assert relaxed from < 8 to <= 8 — src/libbpfilter/include/bpfilter/rule.h:75 — The original _BF_PKTHDR_MAX < 8 rejects exactly 8 values; _BF_LOG_OPT_MAX <= 8 permits them. Both are correct for a uint8_t bitmask, but the semantic change should be intentional
• bfc_print_log silently drops non-packet logs — src/bfcli/print.c:577 — When log->log_type is not BF_LOG_TYPE_PACKET, the function returns silently. Since this is part 1/2, consider a bf_dbg() trace or comment noting sock_addr printing is deferred

Workflow run