Allow fetching rules and counters via bfcli

[ryantimwilson]

bpfilter daemon keeps a list of active rules and it also writes counters to BPF maps. Sure, we can access the rules/counters via bpftool - counter maps are named bf_cmap_XXX - but it is more convenient to use an API.

$ sudo bpftool map dump name bf_cmap_000201
[{
        "key": 0,
        "value": {
            "packets": 71220,
            "bytes": 112981553
        }
    },{
        "key": 1,
        "value": {
            "packets": 71288,
            "bytes": 112993982
        }
    }

To do this, we need to implement the BF_REQ_GET_RULES and BF_REQ_GET_RULES APIs in bpfilter backend and fetch the results via bfcli.

bfcli API could look like (where chain/rule are optional):

$ bfcli get-rules <chain> <rule>
$ bfcli get-counters <chain> <rule>

Note bfcli would need to introduce subcommands as bfcli is only used for setting rules now.

[qdeslandes]

Some thoughts on this:

• BF_REQ_GET_RULES API is as old as this repository, the daemon changed a lot since then, you might have to modify that logic a bit.
• bfcli get-rules would be a problem on its own: there is no logic to convert the ruleset back to the format used by bfcli. Maybe it would be worth to piggy-back on bf_xxx_dump() logic? You can print almost anything with bf_xxx_dump(), except for a matcher's payload (but that's easily solvable).
• bfcli get-counters: nft prints the counters with the rule's definition, that could be a way to do it.

[ryantimwilson]

Tommy Unger is working on adding get-counters functionality as part of his ramp-up!