sysctl: add /scheme/netcfg/sysctl tree with ip_forward toggle

Router gains Rc<Cell<bool>> ip_forward flag (default: true).
When false, forward_packets() returns immediately — no packets forwarded
between interfaces. Security best practice for non-router hosts.

netcfg scheme gains sysctl subtree:
  /scheme/netcfg/sysctl/net/ipv4/ip_forward  (rw: 0 or 1)

Read:  echo /scheme/netcfg/sysctl/net/ipv4/ip_forward  →  1
Write: echo 0 > /scheme/netcfg/sysctl/net/ipv4/ip_forward  (disable)
Restore: echo 1 > /scheme/netcfg/sysctl/net/ipv4/ip_forward

Mirrors Linux /proc/sys/net/ipv4/ip_forward.
Shared via Rc<Cell<bool>> between Router and NetCfgScheme.

netstack/src/scheme/netcfg/mod.rs

@@ -8,7 +8,7 @@ use redox_scheme::{
 };
 use scheme_utils::HandleMap;
 use smoltcp::wire::{EthernetAddress, IpAddress, IpCidr, Ipv4Address, Ipv6Address};
-use std::cell::RefCell;
+use std::cell::{Cell, RefCell};
 use std::collections::BTreeMap;
 use std::mem;
 use std::rc::Rc;
@@ -101,6 +101,7 @@ fn mk_root_node(
     route_table: Rc<RefCell<RouteTable>>,
     devices: Rc<RefCell<DeviceList>>,
     socket_set: Rc<RefCell<SocketSet>>,
+    ip_forward: Rc<Cell<bool>>,
 ) -> CfgNodeRef {
     cfg_node! {
         "sockets" => {
@@ -221,6 +222,33 @@ fn mk_root_node(
                 }
             },
         },
+        "sysctl" => {
+            "net" => {
+                "ipv4" => {
+                    "ip_forward" => {
+                        rw [ip_forward] (Option<bool>, None)
+                        || {
+                            let val: u8 = if ip_forward.get() { 1 } else { 0 };
+                            format!("{}\n", val)
+                        }
+                        |cur_value, line| {
+                            let val = line.trim().parse::<u8>()
+                                .map_err(|_| SyscallError::new(syscall::EINVAL))?;
+                            match val {
+                                0 => { ip_forward.set(false); }
+                                1 => { ip_forward.set(true); }
+                                _ => return Err(SyscallError::new(syscall::EINVAL)),
+                            }
+                            *cur_value = Some(val == 1);
+                            Ok(())
+                        }
+                        |_cur_value| {
+                            Ok(())
+                        }
+                    }
+                }
+            }
+        },
         "ifaces" => {
             "eth0" => {
                 "mac" => {
@@ -484,6 +512,7 @@ impl NetCfgScheme {
         route_table: Rc<RefCell<RouteTable>>,
         devices: Rc<RefCell<DeviceList>>,
         socket_set: Rc<RefCell<SocketSet>>,
+        ip_forward: Rc<Cell<bool>>,
     ) -> Result<NetCfgScheme> {
         let notifier = Notifier::new_ref();
         let dns_config = Rc::new(RefCell::new(DNSConfig {
@@ -500,6 +529,7 @@ impl NetCfgScheme {
                 route_table,
                 devices,
                 socket_set,
+                ip_forward,
             ),
             notifier,
         };