Fix stuck nftables load

Previously, the ssh connection got stuck when first loading the nftables
ruleset. I now found the reason for this: conntrack was not active
before loading the ruleset, so there was no conntrack entry for the ssh
connection. This means the traffic was not matched by 'ct state
established', and the other output rules did not allow the traffic. To
fix this, we can load a ruleset at boot which uses conntrack; this
ensures that conntrack is already enabled when loading the actual
ruleset over ssh.

os/layers/contestant/hooks/live/2010-contestant.hook.chroot

@@ -28,3 +28,6 @@ systemctl disable kexec.service
 
 # Restrict access to the config which contains the WiFi password.
 chmod og= /etc/NetworkManager/system-connections/contest.nmconnection
+
+# Enable firewall.
+systemctl enable nftables.service

os/layers/contestant/includes.chroot/etc/nftables.conf

@@ -0,0 +1,19 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+	chain input {
+		type filter hook input priority filter;
+    # Add a rule which references conntrack, to make sure that conntrack is
+    # already enabled when we activate a restrictive ruleset.
+    ct state { established, related } accept
+	}
+	chain forward {
+		type filter hook forward priority filter;
+	}
+	chain output {
+		type filter hook output priority filter;
+    ct state { established, related } accept
+	}
+}