vlan: parent device + docs: Phase 4 completion + VLAN status

2026-07-09 11:26:03 +03:00
parent 19312a3e29
commit 0dafc80b48
4 changed files with 57808 additions and 1 deletions
@@ -519,6 +519,39 @@ SACK protocol correctness.

 ### Phase 4: Firewall and Packet Filtering

+**Status: ✅ SUBSTANTIALLY COMPLETE (verified 2026-07-09)**
+
+The firewall subsystem has been implemented beyond the original plan:
+
+- **Filter hooks** (`netstack/src/filter/mod.rs`): 5 netfilter hook points
+  (PreRouting, InputLocal, Forward, OutputLocal, PostRouting) wired into
+  the Router's packet processing pipeline. Rule evaluation with `final_verdict`
+  semantics (R33 bug fix).
+
+- **Rule format** (`netstack/src/filter/table.rs`): iptables-style textual rules
+  via `/scheme/netfilter/rule/add`. Supports `-s`, `-d`, `-p`, `--sport`, `--dport`,
+  `-i`, `-o`, `--ctstate ESTABLISHED,RELATED` (R52). Verdicts: ACCEPT, DROP, LOG,
+  REJECT.
+
+- **Connection tracking** (`netstack/src/filter/conntrack.rs`): Full TCP state machine
+  (SynSent → SynRecv → Established → FinWait → TimeWait → Close), RST handling,
+  fin_from_orig propagation (R49). ICMP echo tracking with rate limiting.
+  ICMP error → Related tracking (R51). Max entries limit (R56, default 65536).
+  Per-protocol/per-state statistics (R47).
+
+- **NAT** (`netstack/src/filter/nat.rs`): SNAT/DNAT rules with IPv4 rewrite
+  and checksum recomputation. Active binding display (R58). Ephemeral port
+  allocation.
+
+- **Management** (`netstack/src/scheme/netfilter.rs`): Full scheme for rule add/del/
+  list, NAT add/del/list, policy set, reset, counters. Per-chain statistics
+  via `/scheme/netfilter/stats` (R17).
+
+- **Conntrack display** (`/scheme/netcfg/conntrack/stats|list`): Standalone netcfg
+  node (R54) plus integrated summary node. NAT bindings via `/scheme/netcfg/nat/`.
+
+**Original plan below (historical reference):**
+
 **Goal:** Provide a firewall and NAT capability, respecting the microkernel
 everything-is-a-scheme design.

@@ -656,6 +689,15 @@ validate the stack on real NICs.

 ### Phase 6: Forwarding, Virtual Devices, and Advanced Features

+**Virtual devices status (2026-07-09):**
+- VLAN: ✅ Parent device integration (R63), tagged frames forwarded to parent.
+- Bridge: ✅ MAC learning, aging, STP BPDU handling.
+- TUN: ✅ Scheme interface, event loop wired (R2).
+- VXLAN/GRE/IPIP: Implemented as device types, not yet functional (require
+  parent device integration — same pattern as VLAN R63 fix).
+
+**Original plan below:**
+
 **Goal:** Bring the stack to feature parity with a general-purpose Linux networking
 appliance for the features that matter.

@@ -0,0 +1,89 @@
+c[?7l[2J[0mSeaBIOS (version Arch Linux 1.17.0-2-2)
+
+
+iPXE (http://ipxe.org) 00:01.0 C000 PCI2.10 PnP PMM+7EFD3E20+7EF33E20 C000
+Press Ctrl-B to configure iPXE (PCI 00:01.0)...
+                                                                               
+
+
+Booting from Hard Disk...
+Boot failed: could not read the boot disk
+
+Booting from DVD/CD...
+Stage 1
+00000022#007F 0000:C000
+000000A1#007F 0FE0:C000
+00000120#007F 1FC0:C000
+0000019F#007F 2FA0:C000
+0000021E#007F 3F80:C000
+0000029D#001F 4F60:C000
+Stage c[?7l[2J[0m2
+Starting graphical debug
+Framebuffer not found
+kernel::arch::x86_shared::start:INFO -- Redox OS starting...
+kernel::startup::memory:INFO -- Memory 100000:7FFDF000 contains reservation 146000:1FE46000
+kernel::startup::memory:INFO -- Memory 100000:146000 contains reservation 125000:126000
+kernel::startup::memory:INFO -- Memory 100000:125000 overlaps with reservation 100000:101000
+kernel::startup::memory:INFO -- Memory 1FE46000:7FFDF000 contains reservation 247E8000:247F4000
+kernel::startup::memory:INFO -- Memory 1FE46000:247E8000 overlaps with reservation 1FE46000:1FF8E000
+kernel::startup::memory:INFO -- Memory 1FF8E000:247E8000 overlaps with reservation 223BB000:247E8000
+kernel::startup::memory:INFO -- Memory 247F4000:7FFDF000 overlaps with reservation 247F4000:247F5000
+kernel::startup::memory:INFO -- Memory: 3549 MB
+kernel::startup::memory:INFO -- Permanently used: 8228 KB
+Page fault: 0000000000000604 (empty)
+RFLAG: 0000000000010002
+CS:    0000000000000008
+RIP:   ffffffff80077895
+RSP:   ffffffff800fb060
+SS:    0000000000000010
+FSBASE  0000000000000000
+GSBASE  0000000000000000
+KGSBASE ffffffff800d2000
+RAX:   0000000000000604
+RCX:   0000000000000020
+RDX:   0000000000000020
+RDI:   ffffff7f80100000
+RSI:   ffffff7f80100080
+R8:    ffffff7f80103328
+R9:    0000000000000010
+R10:   00000000000fccd8
+R11:   ffffff7f80100010
+RBX:   ffff80007ffe2393
+RBP:   ffffffff800fb1a0
+R12:   ffff80007ffe2407
+R13:   ffffff7f80100020
+R14:   ffff800000000000
+R15:   0000000000000001
+  FP ffffffff800faf10: PC ffffffff8004e072
+    FFFFFFFF8004DE40+0232
+    kernel::arch::x86_shared::interrupt::exception::page::inner
+  FP ffffffff800fafb0: PC ffffffff80046caf
+    FFFFFFFF80046C78+0037
+    kernel::arch::x86_shared::interrupt::exception::page
+  FP ffffffff800fb1a0: PC ffffffff80085687
+    FFFFFFFF800855B0+00D7
+    kernel::arch::x86_shared::start::start
+ ffffffff800fb270: EMPTY RETURN
+KERNEL PANIC: panicked at src/context/switch.rs:535:14:
+not inside of context
+  FP ffffffff800fad30: PC ffffffff8006abd2
+    FFFFFFFF8006AA60+0172
+    kernel::panic::panic_handler_inner
+  FP ffffffff800fadd0: PC ffffffff80068ce9
+  FP ffffffff800fade0: PC ffffffff800b244b
+  FP ffffffff800fae20: PC ffffffff800bb610
+    FFFFFFFF800BB610+0000
+    core::option::unwrap_failed
+  FP ffffffff800fae50: PC ffffffff80088704
+    FFFFFFFF800885C0+0144
+    kernel::context::signal::excp_handler
+  FP ffffffff800faf10: PC ffffffff8004e08f
+    FFFFFFFF8004DE40+024F
+    kernel::arch::x86_shared::interrupt::exception::page::inner
+  FP ffffffff800fafb0: PC ffffffff80046caf
+    FFFFFFFF80046C78+0037
+    kernel::arch::x86_shared::interrupt::exception::page
+  FP ffffffff800fb1a0: PC ffffffff80085687
+    FFFFFFFF800855B0+00D7
+    kernel::arch::x86_shared::start::start
+ ffffffff800fb270: EMPTY RETURN