Add REDIRECT verdict for TC and XDP

[qdeslandes]

Add a new REDIRECT verdict in addition to ACCEPT/DROP/CONTINUE to redirect a matched packet to a different interface.

The new verdict expects $iface $dir with:

• $iface: interface to redirect to, name or index
• $dir: direction to redirect the packet: in or out of the interface

This new verdict doesn't support Cgroup and Netfilter hooks (redirection is not supported by BPF on those hooks).

[Copilot]

Pull request overview

Adds a new REDIRECT rule verdict (in addition to ACCEPT/DROP/CONTINUE) to redirect matched packets to another interface for TC and XDP, including CLI parsing/printing and test/documentation updates.

Changes:

• Introduces BF_VERDICT_REDIRECT plus bf_redirect_dir (in/out) string conversions and rule fields (redirect_ifindex, redirect_dir).
• Extends code generation for TC/XDP to emit bpf_redirect() and wires the new verdict through program generation and bfcli.
• Adds unit, fuzz, and e2e coverage plus documentation updates for the new verdict and its hook limitations.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/unit/libbpfilter/verdict.c	Adds unit test coverage for redirect direction enum to/from string.
tests/harness/test.c	Updates rule equality helper to include redirect fields.
tests/fuzz/keywords.dict	Adds REDIRECT, in, out to fuzzing dictionary.
tests/e2e/rulesets/xdp.bf	Adds a sample XDP ruleset rule using REDIRECT.
tests/e2e/rulesets/tc_ingress.bf	Adds a sample TC ingress ruleset rule using REDIRECT.
tests/e2e/rulesets/tc_egress.bf	Adds a sample TC egress ruleset rule using REDIRECT.
tests/e2e/rules/redirect.sh	New e2e test validating redirect behavior and unsupported-hook errors.
tests/e2e/CMakeLists.txt	Registers the new redirect e2e test.
src/libbpfilter/verdict.c	Implements bf_redirect_dir_{to,from}_str() and adds verdict string mapping for REDIRECT.
src/libbpfilter/rule.c	Serializes/deserializes redirect fields and dumps them conditionally.
src/libbpfilter/include/bpfilter/verdict.h	Defines redirect direction enum and adds BF_VERDICT_REDIRECT.
src/libbpfilter/include/bpfilter/rule.h	Adds redirect parameters to bf_rule and helper accessors.
src/libbpfilter/include/bpfilter/flavor.h	Extends flavor ops with gen_inline_redirect.
src/bpfilter/cgen/xdp.c	Implements XDP redirect codegen using bpf_redirect().
src/bpfilter/cgen/tc.c	Implements TC redirect codegen using bpf_redirect() with BPF_F_INGRESS.
src/bpfilter/cgen/program.c	Emits redirect handling for rules with BF_VERDICT_REDIRECT.
src/bfcli/print.c	Prints redirect verdict with ifindex and direction.
src/bfcli/parser.y	Parses REDIRECT $IFACE $DIR into rule redirect fields.
src/bfcli/lexer.l	Lexes REDIRECT, interface, and direction tokens.
doc/usage/bfcli.rst	Documents the new verdict, syntax, and hook support constraints.

Comments suppressed due to low confidence (1)

src/libbpfilter/include/bpfilter/verdict.h:55

• With BF_VERDICT_REDIRECT now placed before BF_VERDICT_CONTINUE, the existing _BF_TERMINAL_VERDICT_MAX = BF_VERDICT_CONTINUE makes REDIRECT fall into the “terminal verdict” range used to validate chain policies. However, chain policies can’t provide the required redirect parameters (ifindex/dir), so allowing BF_VERDICT_REDIRECT as a chain policy via the C API/pack format seems inconsistent. Consider tightening the chain-policy validation logic (e.g., restrict to ACCEPT/DROP only, or add a separate chain-policy enum/range check) so REDIRECT remains rule-only.

    BF_VERDICT_CONTINUE,
    _BF_VERDICT_MAX,
    _BF_TERMINAL_VERDICT_MAX = BF_VERDICT_CONTINUE,
};

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.