From b9e53c500a9f6b0e4fcac38b6ab8e29ceda08a72 Mon Sep 17 00:00:00 2001 From: vasilito Date: Thu, 9 Jul 2026 12:52:56 +0300 Subject: [PATCH] =?UTF-8?q?docs:=20networking=20stack=20state=20summary=20?= =?UTF-8?q?=E2=80=94=20architecture=20+=20feature=20checklist?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Comprehensive documentation of the current networking stack state including architecture diagram, transport/network/firewall/virtual device/traffic control/monitoring/management feature checklists, known limitations, and testing status. Generated from 66 implementation rounds across the netstack codebase. --- local/docs/NETWORKING-STACK-STATE.md | 120 +++++++++++++++++++++++++++ 1 file changed, 120 insertions(+) create mode 100644 local/docs/NETWORKING-STACK-STATE.md diff --git a/local/docs/NETWORKING-STACK-STATE.md b/local/docs/NETWORKING-STACK-STATE.md new file mode 100644 index 0000000000..e67dd9f17e --- /dev/null +++ b/local/docs/NETWORKING-STACK-STATE.md @@ -0,0 +1,120 @@ +# Red Bear OS Networking Stack — Current State (2026-07-09) + +## Overview + +The userspace TCP/IP stack (`netstack` / `smolnetd`) runs as a Redox scheme daemon +implementing the full IP stack in Rust on top of smoltcp 0.12.0. + +### Architecture + +``` +┌──────────────────────────────────────────────────────────────────────┐ +│ smolnetd (netstack) │ +│ │ +│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ +│ │ scheme: │ │ scheme: │ │ scheme: │ │ scheme: │ ... │ +│ │ tcp │ │ udp │ │ icmp │ │ netcfg │ │ +│ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ │ +│ │ │ │ │ │ +│ ┌────┴─────────────┴───────────┴────────────┴─────┐ │ +│ │ SocketSet (smoltcp) │ │ +│ └────────────────────────┬──────────────────────────┘ │ +│ │ │ +│ ┌────────────────────────┴──────────────────────────┐ │ +│ │ Router + Filter │ │ +│ │ ┌─────────┐ ┌──────────┐ ┌──────────┐ │ │ +│ │ │ Filter │ │ NAT │ │Conntrack │ │ │ +│ │ │ (rules) │ │(snat/dnat)│ │ (states) │ │ │ +│ │ └─────────┘ └──────────┘ └──────────┘ │ │ +│ └────────────────────────┬──────────────────────────┘ │ +│ │ │ +│ ┌────────────────────────┴──────────────────────────┐ │ +│ │ Ethernet / Loopback / Tunnel │ │ +│ └────────────────────────────────────────────────────┘ │ +└──────────────────────────────────────────────────────────────────────┘ +``` + +## Feature Checklist + +### Transport Layer + +- [x] **TCP**: Full scheme server, listen/accept, connect, close, send/recv +- [x] **TCP**: Socket options (SO_KEEPALIVE, TCP_NODELAY, TCP_KEEPIDLE, TCP_INFO, SO_LINGER) +- [x] **TCP**: SYN flood protection (100 SYN/sec per source) +- [x] **UDP**: Scheme server, bind, connect(), send, recv +- [x] **UDP**: `sendto()`/`sendmsg()` on unconnected sockets (R65) +- [x] **UDP**: Socket options (SO_REUSEADDR, SO_BROADCAST, IP_TTL) +- [x] **ICMP**: Echo request/reply (ping) +- [x] **ICMP**: ICMP error reception (Udp socket type for IP_RECVERR-style notifications) + +### Network Layer + +- [x] **IPv4**: Full routing, forwarding, dispatch +- [x] **IPv6**: Routing, NDP, SLAAC address formation, RS/RA exchange +- [x] **Route table**: Longest-prefix match, metric support, direct routes, flush +- [x] **Route types**: Unicast, Blackhole, Unreachable, Prohibit +- [x] **ARP**: Request/reply, cache with 1024-entry LRU limit, statistics +- [x] **NDP**: Neighbor Solicitation/Advertisement, router solicitation +- [x] **ICMP errors**: Port Unreachable, Time Exceeded generation +- [x] **IP forwarding toggle**: sysctl `net.ipv4.ip_forward` rw + +### Firewall & Security + +- [x] **Filter**: 5 netfilter hooks, rule evaluation, per-chain counters +- [x] **Rule format**: iptables-style (`ACCEPT input -p tcp --dport 80 --ctstate ESTABLISHED`) +- [x] **Verdicts**: ACCEPT, DROP, LOG, REJECT +- [x] **Conntrack**: Full TCP state machine (None→SynSent→SynRecv→Established→FinWait→TimeWait→Close) +- [x] **Conntrack**: UDP/ICMP tracking, ICMP error→Related matching +- [x] **Conntrack**: SYN/ICMP echo rate limiting per source +- [x] **Conntrack**: Max entries limit (65536), per-protocol/per-state statistics +- [x] **NAT**: SNAT/DNAT rules, IPv4 rewrite, checksum recomputation +- [x] **NAT**: Active binding tracking and display + +### Virtual Devices + +- [x] **Bridge**: MAC learning, aging (300s), STP 802.1D, FDB +- [x] **VLAN**: 802.1Q tag insertion/stripping, parent device forwarding +- [x] **TUN**: L3 tunnel, scheme interface, event loop integration +- [x] **VXLAN**: Encapsulation/decapsulation, parent forwarding +- [x] **GRE**: Encapsulation/decapsulation with key support +- [x] **IPIP**: IP-in-IP tunnel, parent forwarding +- [x] **Bond**: Round-robin forwarding to slaves + +### Traffic Control + +- [x] **Qdisc**: TokenBucket rate limiter, PriorityQueue 3-band pfifo_fast +- [x] **Qdisc**: Configurable per-interface via netcfg + +### Monitoring & Diagnostics + +- [x] **Interface stats**: rx/tx bytes/packets, errors, drops (RFC 1213 MIB-II) +- [x] **ARP stats**: Requests, replies, cache hits/misses per interface +- [x] **Conntrack stats**: Per-protocol/per-TCP-state breakdown +- [x] **Connection list**: TCP sockets with state, addresses, queue sizes +- [x] **Packet capture**: Ring buffer with BPF-style filter (proto + port) +- [x] **netdiag**: CLI tool with live bandwidth monitoring +- [x] **Help**: Self-documenting API at `/scheme/netcfg/help` +- [x] **NAT display**: Per-rule match counts, active binding display + +### Management + +- [x] **netcfg**: Full scheme for interface config, routing, DNS, capture +- [x] **netfilter**: Scheme for firewall rules, NAT rules, policy, counters +- [x] **sysctl**: `net.ipv4.ip_forward` toggle +- [x] **Interface config**: MAC, IP, MTU, enable/disable, promiscuous + +### Testing + +- [x] 31 unit tests across filter, conntrack, NAT, bridge, STP, SLAAC, ICMP error +- [x] Regression tests for critical bugs (verdict, ICMP offset, SYN detection, STP panic) + +## Known Limitations + +- No TCP SACK (smoltcp limitation) +- No ECN support +- No IP fragmentation offload +- No hardware checksum offload +- No multicast/IGMP/MLD +- No IPsec/VPN +- VXLAN/GRE/IPIP send path works but there's no automatic inbound RX wiring + (packets must be pushed via `push_received()` externally)