libpfctl: Implement pfctl_get_states_stats()

[kp]

Summary

This allows userspace to estimate the amount of memory required to read
out the full states table.

Use this estimate to improve pfctl_get_states(). We now call the stats
function first and use this estimate to allocate the buffer for the
subsequent DIOCGETSTATESNV call. This reduces the total work required by
removing the need to do the call, adjust the allocation size and try
again.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

[mjg]

lib/libpfctl/libpfctl.c

759–766

This needs to add some amount, say 20%. Otherwise one extra state after obtaining the number forces a reallocation.

[kp]

lib/libpfctl/libpfctl.c

759–766

In practice that's not really a problem. Partly because an nvlist state is generally smaller than the 2048 bytes we allocate for it (so there's built-in buffer space already), and partly because even if we underestimate the amount of space required we don't have to start again from scratch (or won't, with the upcoming paging/token support). So even if we don't have quite enough memory in one go we'll only have to make one more call to retrieve the states (or rather, rows of states) that didn't fit. We won't have to start again from scratch.

[mjg]

lib/libpfctl/libpfctl.c

759–766

The idiom is to add some amount and it's trivial to do it. If you insist on not doing it, this needs a comment.

[kp]

• adjust to the new ioctl name
• add 20% headroom, in case new states are created between the stats call and the get call

[kp]

While this improves the present situation it's still unacceptably slow, so I'm going to try a version without nvlist.