Connections, "every packet" rules, and a packet tracer

- Connections: the kernel's tracked connections, read and closed over
  ctnetlink (internal/conntrack, raw netlink like the drop log), with
  their NAT and TCP state; closing one makes the rules check its next
  packet again (GET /connections, POST /connections/close; hc
  connections; Traffic → Connections).
- Rules can check every packet (every_packet, --every-packet): before
  established connections are accepted, so a drop or reject also stops
  connections already open. They can't accept.
- A packet tracer (internal/trace): a table of its own, inet
  housecarl-trace, marks the packets a filter picks, `nft monitor trace`
  reports every rule and policy they meet in every table, and the tracer
  names what accepted or dropped them, Housecarl's rules by name (POST,
  GET, DELETE /trace; hc trace; Traffic → Trace). One trace at a time,
  at most 200 packets and 20 a second; the table goes when it ends.

e2e: 157 checks, among them an upload a normal block doesn't stop and an
every-packet one does, and a trace naming the blocking rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/e2e.sh

@@ -272,6 +272,41 @@ run "the reset is audited" 0 H audit --action quota.
 contains "quota.reset"
 run "the quota rule goes" 0 H rule delete -y "$QR"
 
+# ---- connections and tracing
+
+# A connection that stays open, masqueraded on its way out.
+docker exec -d ${P}-client sh -c "sleep 30 | nc $NET4 9000"
+sleep 1
+run "the connection is tracked" 0 H connections --search "$CLIENT4 :9000"
+contains "$CLIENT4:[0-9]*  *$NET4:9000  *as $WAN4"
+run "closed" 0 H connections close --search "$CLIENT4 :9000" -y
+contains "closed [1-9][0-9]* connection"
+run "gone" 0 H connections --search "$CLIENT4 :9000"
+not_contains ":9000"
+# A block added while traffic flows: it stops new connections, not this
+# one, unless it checks every packet.
+docker exec -d ${P}-client sh -c "rm -f /tmp/ncdone; yes | nc $NET4 9000; touch /tmp/ncdone"
+sleep 1
+BR=$(H -o id rule add forward --from $CLIENT4 --service tcp/9000 -a reject --reject-with tcp-reset --comment "e2e block" --first)
+run "a block for new connections" 0 test -n "$BR"
+sleep 2
+run "the open upload carries on" 1 docker exec ${P}-client test -f /tmp/ncdone
+run "the block checks every packet now" 0 H rule update "$BR" --every-packet
+sleep 2
+run "the upload is cut" 0 docker exec ${P}-client test -f /tmp/ncdone
+# Tracing a new connection: dropped, by that rule.
+docker exec -d ${P}-router sh -c "/w/hc trace --address $CLIENT4 --port 9000 --seconds 6 > /w/trace.out 2>&1"
+sleep 2
+connect client $NET4 9000 >/dev/null 2>&1
+sleep 6
+run "the trace" 0 cat "$WORK/trace.out"
+contains "$CLIENT4:[0-9]* -> $NET4:9000  tcp syn"
+contains "inet housecarl forward: rule forward #$BR (e2e block) -> drop"
+contains "=> DROPPED by rule forward #$BR (e2e block)"
+run "no trace table is left" 0 R nft list tables
+not_contains "housecarl-trace"
+run "the block goes" 0 H rule delete -y "$BR"
+
 # ---- the drop log
 
 run "log drops from the internet to the API" 0 H rule add input --in wan --service tcp/8070 -a drop --log --first