feat(docker): eBPF stateful packet filters on kernel links

Consume the eBPF impairment classifier delivered in uBridge
feature/tc-precision: frequency_drop becomes the exact every-Nth mode
(tc nth_drop; -1 = drop everything maps to every 1st) and the new
kernel-only quota type is the byte-cap mode (tc quota_drop, 100 = hard
cutoff). KERNEL_UNSUPPORTED_FILTERS is gone entirely — kernel/relay
eligibility is now purely topological. Both modes gate on ebpf=1 from
the per-process tc capabilities probe (error names the setcap fix); the
cleanup path (modes off) only talks to the eBPF commands when the probe
reported them. Reconcile is a plain re-set: the netem reset-before-set
already detaches the program and clears uBridge's per-interface
registry, so a mode set after it is a fresh load+attach.

Documented semantic difference: the relay counts both directions
through one bridge counter, the kernel counts per direction — N=3
round-trip loss is 1-(2/3)^2 = 55.6% on kernel vs ~1/N on relay
(measured 57%). window_drop is NOT exposed: the delivered
implementation advances the window with no gap, making 'outside the
window packets pass' unreachable (needs outage/period fields —
recorded in the spec); flow_drop awaits a parameter-shape decision.

Also fixes a pre-existing restart bug the e2e exposed: _bridges (relay
bridge names) was never cleared on stop, so restarting a node with a
relay link skipped 'bridge create' and failed on add_nio_udp.

e2e (isolated instance): 13/13 — pref-1 tc_impair classifier on both
veths, 57% round-trip for N=3, -1 = exact 100%, quota hard cutoff,
delay coexistence, clean teardown, suspend/resume, node restart,
relay-leg frequency_drop regression through an Ethernet switch. Full
suite: 1925 passed.

gns3server/utils/packet_filter_validation.py

@@ -16,18 +16,18 @@ class FilterValidationError(Exception):
     pass
 
 
-# Packet filters with no kernel-datapath equivalent yet: frequency_drop needs
-# the eBPF stateful classifier (frozen in
-# docs/design/ubridge-kernel-impairment-spec.md, part B — not delivered),
-# so it still only runs in the uBridge userspace relay. bpf is served by the
-# cBPF match-drop classifier (tc bpf_drop) when uBridge reports cbpf=1.
-KERNEL_UNSUPPORTED_FILTERS = frozenset({"frequency_drop"})
-
-# Packet filters with no uBridge *relay* equivalent: the tc netem extensions
-# (uBridge feature/tc-netem-ext) serve them on the kernel datapath only. The
-# relay's packet-filter registry only knows frequency_drop / packet_loss /
-# delay / corrupt / bpf / mark.
-KERNEL_ONLY_FILTERS = frozenset({"rate", "reorder", "gemodel", "duplicate", "seed", "limit"})
+# Every GNS3 filter type now has a kernel-datapath equivalent: delay /
+# packet_loss / corrupt / the netem extensions run as one tc netem qdisc,
+# bpf as cBPF match-drop classifiers, and frequency_drop as the eBPF
+# stateful classifier's exact every-Nth mode (tc nth_drop — needs a uBridge
+# reporting ebpf=1). No type is relay-only anymore; the controller-side
+# kernel/relay choice is purely topological (same compute, docker/docker).
+#
+# Packet filters with no uBridge *relay* equivalent: the netem extensions
+# plus the eBPF quota mode run on the kernel datapath only. The relay's
+# packet-filter registry only knows frequency_drop / packet_loss / delay /
+# corrupt / bpf / mark.
+KERNEL_ONLY_FILTERS = frozenset({"rate", "reorder", "gemodel", "duplicate", "seed", "limit", "quota"})
 
 # Jitter distributions embedded in the netem-extension uBridge (tc_netem_dist).
 NETEM_DISTRIBUTIONS = ("uniform", "normal", "pareto", "paretonormal")
@@ -220,6 +220,15 @@ def validate_filter_parameters(filter_type: str, values: List[Any]) -> None:
         },
         "seed": {"params_count": (1, 1), "ranges": [(0, 4294967295)], "names": ["Seed"], "units": [""]},
         "limit": {"params_count": (1, 1), "ranges": [(1, 1000000)], "names": ["Limit"], "units": ["packets"]},
+        "quota": {
+            # eBPF stateful classifier (uBridge tc quota_drop): after the byte
+            # quota is consumed, each further packet drops with the given
+            # chance (100 = hard cutoff). Kernel-datapath only.
+            "params_count": (2, 2),
+            "ranges": [(1, 10**15), (0, 100)],
+            "names": ["Quota", "Chance"],
+            "units": ["bytes", "%"],
+        },
         "bpf": {"params_count": (1, 1), "is_text": True, "names": ["Filters"]},
     }