Netifyd connection marking

[gsanchietti]

We cannot reliably block applications, seems that different systems behave differently, we are investigating on the why.
Following actions so far have been taken to address this issue:

• removed nft set blocks, moving to conntrack labeling approach

Evaluate also the following changes:

• remove netify-init labeling
• use reject instead of drop so the client can stop the requests

Replaces #1519

[gsanchietti]

Overall the PR is good and works well.

The proposed changes should:

• reduce client traffic due to the reject
• speedup the traffic handling because the chain adds only one label

[gsanchietti]

Evaluate this changes:

1. if the support does not need to know if a connection has been seen by netifyd, create a dummy chain to initialize the labels
2. use the reject instead of drop so clients will not keep retrying to send TCP packets

Suggested change

	chain dpi_blocks {
	type filter hook prerouting priority filter + 10; policy accept;
	# init is to allow kernel to set labels
	ct label set netify-init
	{% if log_enabled -%}
	ct label netify-block counter log prefix "DPI block: " limit rate {{ log_limit }}
	{% endif -%}
	ct label netify-block counter drop
	}
	chain dpi_dummy {
	# this init is to allow kernel to set labels
	ct label set netify-init
	}
	chain dpi_blocks {
	type filter hook prerouting priority filter + 10; policy accept;
	{% if log_enabled -%}
	ct label netify-block counter log prefix "DPI block: " limit rate {{ log_limit }}
	{% endif -%}
	ct label netify-block counter reject
	}

[gsanchietti]

After few other tests, I'd choose:

• use reject instead of drop
• keep netify-init label so we can easily check which connections have been through netifyd once the nfq is enabled
• re-add removed features to tag a connection with different qos:
  • add back actions inside dpi-config
  • add rules inside dpi-nft:

    ct label bulk counter ip dscp set cs1 return
    ct label best_effort counter ip dscp set cs0 return
    ct label video counter ip dscp set af41 return
    ct label voice counter ip dscp set cs6 return
    

Given this info, we could improve the conntrack page to show these extra info.
Suggested command:

conntrack -L -o labels,id,xml

To be used here