Early execution of stateless firewall rules on ingress

[rcgoodfellow]

We need a way to execute stateless firewall rules early in the ingress processing stack. This way stateless firewall rules can block high-volume traffic events without incurring large amounts of stateful flow tracking resources.

[FelixMcFelix]

I think at a high level there are two obvious approaches here:

• Allow for a sort-of-Layer to sit at the head of the slow path. This has no LFT capacity, and exposes a set of in/out rules and default action to apply to packets. Actions can only be Allow/Deny.
• Add an additional deny-fw layer after overlay, which has any explicit deny actions as its in-rules, and no out-rules.