Connections, "every packet" rules, and a packet tracer

- Connections: the kernel's tracked connections, read and closed over
  ctnetlink (internal/conntrack, raw netlink like the drop log), with
  their NAT and TCP state; closing one makes the rules check its next
  packet again (GET /connections, POST /connections/close; hc
  connections; Traffic → Connections).
- Rules can check every packet (every_packet, --every-packet): before
  established connections are accepted, so a drop or reject also stops
  connections already open. They can't accept.
- A packet tracer (internal/trace): a table of its own, inet
  housecarl-trace, marks the packets a filter picks, `nft monitor trace`
  reports every rule and policy they meet in every table, and the tracer
  names what accepted or dropped them, Housecarl's rules by name (POST,
  GET, DELETE /trace; hc trace; Traffic → Trace). One trace at a time,
  at most 200 packets and 20 a second; the table goes when it ends.

e2e: 157 checks, among them an upload a normal block doesn't stop and an
every-packet one does, and a trace naming the blocking rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/rules.js

@@ -27,7 +27,7 @@ export async function render(el, params, query) {
   const chain = query.get("chain") || "input";
   const [all, settings, cs, qs] = await Promise.all([get("/rules", { chain }), get("/settings"), counters(), quotas()]);
   // As nftables checks them: the rules that count traffic first.
-  const rules = [...all.filter(countsTraffic), ...all.filter((r) => !countsTraffic(r))];
+  const rules = [...all.filter(everyPacket), ...all.filter((r) => !everyPacket(r))];
   const write = can("config", true);
   const info = chains.find((c) => c[0] === chain) || chains[0];
   const policy = settings[chain + "_policy"];
@@ -42,7 +42,7 @@ export async function render(el, params, query) {
       table([
         { label: "#", render: (r) => r.pending === "deleted" ? "" : String(live(rules).indexOf(r) + 1) },
         { label: "Match", render: (r) => r.raw ? [badge("raw", ""), " ", h("span", { class: "mono small" }, r.raw)]
-          : [countsTraffic(r) ? [badge("every packet", "accent"), " "] : null, describe(r), extras(r, qs[r.id])] },
+          : [everyPacket(r) ? [badge("every packet", "accent"), " "] : null, describe(r), extras(r, qs[r.id])] },
         { label: "Action", render: actionBadge },
         { label: "Hits", render: (r) => hits(cs, "r" + r.id) },
         { label: "Comment", render: (r) => r.comment },
@@ -50,7 +50,7 @@ export async function render(el, params, query) {
           if (r.pending === "deleted") return badge("deleted", "err");
           // Moves stay among the rules of the same kind (counting traffic,
           // or not): nftables checks those first.
-          const rs = live(rules).filter((x) => countsTraffic(x) === countsTraffic(r)), i = rs.indexOf(r);
+          const rs = live(rules).filter((x) => everyPacket(x) === everyPacket(r)), i = rs.indexOf(r);
           return [
           h("button", { class: "small reveal", title: "Move up", disabled: i === 0, onclick: () => move(r, { before: rs[i - 1].id }) }, "↑"), " ",
           h("button", { class: "small reveal", title: "Move down", disabled: i === rs.length - 1, onclick: () => move(r, { after: rs[i + 1].id }) }, "↓"), " ",
@@ -60,14 +60,15 @@ export async function render(el, params, query) {
         ];
         } } : null,
       ].filter(Boolean), rules, { empty: "No rules in this chain yet.", rowClass }),
-      rules.some(countsTraffic) ? h("div", { class: "muted small" }, "Rules marked “every packet” have a quota or a byte rate: they are checked before established connections are accepted, so they count all of a connection's traffic, not only its first packet. They can drop, reject or log, not accept.") : null,
+      rules.some(everyPacket) ? h("div", { class: "muted small" }, "Rules marked “every packet” are checked before established connections are accepted: they see all of a connection's traffic, not only its first packet, so a quota counts all of it and a block stops connections already open. They can drop, reject or log, not accept.") : null,
       h("div", { class: "policy small" }, "Then the policy: ", badge(policy, policy === "drop" ? "err" : "ok"),
         policy === "drop" ? [" — ", hits(cs, "p-" + chain), " packets reached it"] : null)));
 }
 
-// countsTraffic: a quota or a byte rate (as model.Rule.CountsTraffic).
-function countsTraffic(r) {
-  return !r.raw && (!!r.quota || !!(r.limit && ["bytes", "kbytes", "mbytes"].includes(r.limit.unit)));
+// everyPacket: checked before established connections are accepted (as
+// model.Rule.ChecksEveryPacket): asked to, or a quota or a byte rate.
+function everyPacket(r) {
+  return !r.raw && (!!r.every_packet || !!r.quota || !!(r.limit && ["bytes", "kbytes", "mbytes"].includes(r.limit.unit)));
 }
 
 // What each built-in does (a switch covers all its rules).
@@ -207,7 +208,11 @@ export async function ruleDialog(r, chain) {
   const match = matchEditor(r, n);
   const action = select([["accept", "accept"], ["drop", "drop"], ["reject", "reject"], ["log", "log only (and go on)"]], r.action);
   const rejectWith = select([["", "with an ICMP error"], ["tcp-reset", "with a TCP reset (TCP rules only)"]], r.reject_with || "");
-  const showReject = () => rejectWith.classList.toggle("hidden", action.value !== "reject");
+  const every = checkbox("every packet: also stop connections already open, not just new ones", r.every_packet);
+  const showReject = () => {
+    rejectWith.classList.toggle("hidden", action.value !== "reject");
+    every.classList.toggle("hidden", action.value === "accept");
+  };
   action.addEventListener("change", showReject);
   showReject();
   const states = listEditor(r.ct_state, { suggestions: ["new", "established", "related", "invalid", "untracked"], placeholder: "new", mono: false, addLabel: "Add state" });
@@ -306,7 +311,8 @@ export async function ruleDialog(r, chain) {
   // Written in nftables, a rule is its text: the fields it replaces go
   // (and the other parts close).
   const matchNodes = match.flat().filter(Boolean);
-  const actionField = field("Action", h("div", null, action, " ", rejectWith)).filter(Boolean);
+  const actionField = field("Action", h("div", null, action, " ", rejectWith, every),
+    "Every packet: checked before established connections are accepted, so blocking takes effect on what is already connected.").filter(Boolean);
   const logField = field("Log", h("div", null, log, logPrefix)).filter(Boolean);
   const addersLabel = h("label");
   sections.raw.onShow = (on) => {
@@ -352,7 +358,8 @@ export async function ruleDialog(r, chain) {
         per_source: quotaKey.value === "source", per_destination: quotaKey.value === "destination",
         reset: quotaReset.value, day: quotaReset.value === "monthly" ? parseInt(quotaDay.value || "1", 10) : 0 } : null,
       group_v4: isRaw ? 0 : parseInt(group4.value || "0", 10), group_v6: isRaw ? 0 : parseInt(group6.value || "0", 10),
-      conn_limit: on("conn") ? parseInt(conn.value || "0", 10) : 0, log: !isRaw && log.input.checked, log_prefix: isRaw ? "" : logPrefix.value.trim(),
+      conn_limit: on("conn") ? parseInt(conn.value || "0", 10) : 0,
+      every_packet: !isRaw && action.value !== "accept" && every.input.checked, log: !isRaw && log.input.checked, log_prefix: isRaw ? "" : logPrefix.value.trim(),
       raw: on("raw") ? raw.value.trim() : "", comment: comment.value.trim() };
     if (r.id) v.disabled = disabled.input.checked;
     try {