From 088b539967aae6d05582451d77df30e20c4a9d33 Mon Sep 17 00:00:00 2001
From: Red Bear OS <build@redbearos.org>
Date: Thu, 9 Jul 2026 10:08:40 +0300
Subject: [PATCH] netcfg: standalone conntrack node (stats + list)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New paths under /scheme/netcfg/conntrack/:
  stats → per-protocol breakdown (tcp/udp/icmp + per-state)
  list  → full connection listing with TCP state

Previously conntrack data was only accessible via netfilter scheme
(/scheme/netfilter/conntrack/*). Now available directly through
the main netcfg monitoring interface.

Output matches the netfilter nodes exactly (same format/stats methods).

All 31 tests pass.
---
 netstack/src/scheme/netcfg/mod.rs | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/netstack/src/scheme/netcfg/mod.rs b/netstack/src/scheme/netcfg/mod.rs
index 4892c2672c..bfaf4c96b1 100644
--- a/netstack/src/scheme/netcfg/mod.rs
+++ b/netstack/src/scheme/netcfg/mod.rs
@@ -147,6 +147,28 @@ fn mk_root_node(
                 out
             }
         },
+        "conntrack" => {
+            "stats" => {
+                ro [filter_table] || {
+                    let table = filter_table.borrow();
+                    if let Some(ref ct) = table.conntrack {
+                        ct.stats()
+                    } else {
+                        "conntrack: not enabled\n".to_string()
+                    }
+                }
+            },
+            "list" => {
+                ro [filter_table] || {
+                    let table = filter_table.borrow();
+                    if let Some(ref ct) = table.conntrack {
+                        ct.format()
+                    } else {
+                        "conntrack: not enabled\n".to_string()
+                    }
+                }
+            },
+        },
         "capture" => {
             "enable" => {
                 wo [observer] (Option<()>, None)