feat(firewall): add packet statistics tracking for firewall clients

Enhanced the firewall client functionality by introducing packet statistics tracking, including the cumulative count of packets dropped and accepted. Updated the API to support these new fields and modified the database schema accordingly. Improved the firewall scripts to collect and report packet statistics, ensuring better visibility into client performance. Adjusted the UI components to display packet counts in the clients table, enhancing user experience and monitoring capabilities.

internal/httpapi/routes_firewall.go

@@ -450,13 +450,15 @@ func (s *Server) handleFirewallApplyReport(w http.ResponseWriter, r *http.Reques
 		return
 	}
 	var body struct {
-		Status       string `json:"status"`
-		Error        string `json:"error"`
-		PrefixCount  int    `json:"prefix_count"`
-		IPCount      int    `json:"ip_count"`
-		Version      string `json:"version"`
-		KernelMethod string `json:"kernel_method"`
-		Source       string `json:"source"`
+		Status          string `json:"status"`
+		Error           string `json:"error"`
+		PrefixCount     int    `json:"prefix_count"`
+		IPCount         int    `json:"ip_count"`
+		PacketsDropped  int64  `json:"packets_dropped"`
+		PacketsAccepted int64  `json:"packets_accepted"`
+		Version         string `json:"version"`
+		KernelMethod    string `json:"kernel_method"`
+		Source          string `json:"source"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
 		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid JSON body")
@@ -466,7 +468,10 @@ func (s *Server) handleFirewallApplyReport(w http.ResponseWriter, r *http.Reques
 	if src == "" {
 		src = "cp"
 	}
-	_ = s.store.TouchFirewallClientLastApply(a.APIKeyID, src, body.Status, body.Error, body.PrefixCount, body.IPCount)
+	_ = s.store.TouchFirewallClientLastApply(
+		a.APIKeyID, src, body.Status, body.Error,
+		body.PrefixCount, body.IPCount, body.PacketsDropped, body.PacketsAccepted,
+	)
 	writeJSON(w, http.StatusOK, map[string]bool{"ok": true})
 }
 

internal/httpapi/routes_firewall_test.go

@@ -95,6 +95,27 @@ func TestFirewallEnrollAndBlocklist(t *testing.T) {
 	if total, _ := bl["total"].(float64); total != 0 {
 		t.Fatalf("accept-only want empty blocklist, total=%v", total)
 	}
+
+	reportBody := `{"status":"ok","prefix_count":0,"ip_count":0,"packets_dropped":42,"packets_accepted":1000,"source":"cp","kernel_method":"nft"}`
+	reqReport, _ := http.NewRequest(http.MethodPost, ts.URL+"/v1/firewall/apply-report", strings.NewReader(reportBody))
+	reqReport.Header.Set("Authorization", "Bearer "+tok)
+	reqReport.Header.Set("Content-Type", "application/json")
+	respReport, err := client.Do(reqReport)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = respReport.Body.Close() }()
+	if respReport.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(respReport.Body)
+		t.Fatalf("apply-report status=%d body=%s", respReport.StatusCode, b)
+	}
+	gotClient, err := srv.Store().GetFirewallClient(tenant, clientID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if gotClient.LastApplyPacketsDropped != 42 || gotClient.LastApplyPacketsAccepted != 1000 {
+		t.Fatalf("packet stats dropped=%d accepted=%d", gotClient.LastApplyPacketsDropped, gotClient.LastApplyPacketsAccepted)
+	}
 }
 
 func TestFirewallEnrollBadSeed(t *testing.T) {