feature: rate limit

[SkohTV]

Fix #215

Hi, sorry for the long hiatus,
A bunch of stuff came up, and I didn't have the time to do the big rebase+refactor.

Changes:

• Did the big rebase.
• Changed ratelimit from an action to a matcher, supports for eq with an uint32
• Kept the map, because some persistence is required for rate limiting.
• Also kept and slightly changed the elfstub.

	10 first	All after
chain my_chain BF_HOOK_XDP{ifindex=2} DROP rule meta.ratelimit eq 10 ACCEPT	ACCEPT	DROP
chain my_chain BF_HOOK_XDP{ifindex=2} ACCEPT rule meta.ratelimit eq 10 DROP	DROP	ACCEPT
chain my_chain BF_HOOK_XDP{ifindex=2} DROP rule meta.ratelimit not eq 10 ACCEPT	DROP	ACCEPT
chain my_chain BF_HOOK_XDP{ifindex=2} ACCEPT rule meta.ratelimit not eq 10 DROP	ACCEPT	DROP

If that implementation seems good, I'll go ahead and add QoL / the documentation

I'd really like to get this PR over the finish line at some point :)

[qdeslandes]

I went for an early review, mostly for the parsing part. On the BPF side, the map will contain the runtime values for a given rule's rate limit (current burst/allowance, limit, last update time...).

[github-actions]

This PR has had no activity for 14 days. It will be closed in 14 more days unless it is updated. Comment or push to keep it open.

[qdeslandes]

This PR has had no activity for 14 days. It will be closed in 14 more days unless it is updated. Comment or push to keep it open.

That's on me, looking at this today :)

[qdeslandes]

Changing the rate limit to a matcher is the good call, it will provide more flexibility.

The implementation has been simplified a lot, so much that so of the functionalities we would deem necessary have been removed.

You will need to think about two things now:

• How do you handle the unit? For now, supporting only s (e.g. meta.limit 10/s) would be enough, but allowing a unit to be passed will allow us to expand support for rate limiting later on.
• How to handle access to the bf_ratelimit (or whatever the name is) structure from a rule? Rules have IDs, but nothing prevents a rule from having multiple rate-limiting matchers. An BPF array map is a good pick, but you need to ensure a meta.limit matcher is mapped to the correct bf_ratelimit structure in the map.

Also, you'll have to rebase on main :)

[qdeslandes]

Define in runtime.h and import it instead.

[SkohTV]

I took this pattern from update_counters.bpf.c, perhaps the same thing can be done for it