# Red Bear OS Networking Stack — Current State (2026-07-09)

## Overview

The userspace TCP/IP stack (`netstack` / `smolnetd`) runs as a Redox scheme daemon
implementing the full IP stack in Rust on top of smoltcp 0.12.0.

### Architecture

```
┌──────────────────────────────────────────────────────────────────────┐
│                        smolnetd (netstack)                           │
│                                                                      │
│  ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐               │
│  │  scheme: │ │  scheme: │ │  scheme: │ │  scheme: │  ...          │
│  │  tcp     │ │  udp     │ │  icmp    │ │  netcfg  │               │
│  └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘               │
│       │             │           │            │                      │
│  ┌────┴─────────────┴───────────┴────────────┴─────┐               │
│  │              SocketSet (smoltcp)                  │               │
│  └────────────────────────┬──────────────────────────┘               │
│                           │                                         │
│  ┌────────────────────────┴──────────────────────────┐               │
│  │                   Router + Filter                   │               │
│  │  ┌─────────┐ ┌──────────┐ ┌──────────┐             │               │
│  │  │ Filter   │ │ NAT      │ │Conntrack │             │               │
│  │  │ (rules)  │ │(snat/dnat)│ │ (states) │             │               │
│  │  └─────────┘ └──────────┘ └──────────┘             │               │
│  └────────────────────────┬──────────────────────────┘               │
│                           │                                         │
│  ┌────────────────────────┴──────────────────────────┐               │
│  │               Ethernet / Loopback / Tunnel          │               │
│  └────────────────────────────────────────────────────┘               │
└──────────────────────────────────────────────────────────────────────┘
```

## Feature Checklist

### Transport Layer

- [x] **TCP**: Full scheme server, listen/accept, connect, close, send/recv
- [x] **TCP**: Socket options (SO_KEEPALIVE, TCP_NODELAY, TCP_KEEPIDLE, TCP_INFO, SO_LINGER)
- [x] **TCP**: SYN flood protection (100 SYN/sec per source)
- [x] **UDP**: Scheme server, bind, connect(), send, recv
- [x] **UDP**: `sendto()`/`sendmsg()` on unconnected sockets (R65)
- [x] **UDP**: Socket options (SO_REUSEADDR, SO_BROADCAST, IP_TTL)
- [x] **ICMP**: Echo request/reply (ping)
- [x] **ICMP**: ICMP error reception (Udp socket type for IP_RECVERR-style notifications)

### Network Layer

- [x] **IPv4**: Full routing, forwarding, dispatch
- [x] **IPv6**: Routing, NDP, SLAAC address formation, RS/RA exchange
- [x] **Route table**: Longest-prefix match, metric support, direct routes, flush
- [x] **Route types**: Unicast, Blackhole, Unreachable, Prohibit
- [x] **ARP**: Request/reply, cache with 1024-entry LRU limit, statistics
- [x] **NDP**: Neighbor Solicitation/Advertisement, router solicitation
- [x] **ICMP errors**: Port Unreachable, Time Exceeded generation
- [x] **IP forwarding toggle**: sysctl `net.ipv4.ip_forward` rw

### Firewall & Security

- [x] **Filter**: 5 netfilter hooks, rule evaluation, per-chain counters
- [x] **Rule format**: iptables-style (`ACCEPT input -p tcp --dport 80 --ctstate ESTABLISHED`)
- [x] **Verdicts**: ACCEPT, DROP, LOG, REJECT
- [x] **Conntrack**: Full TCP state machine (None→SynSent→SynRecv→Established→FinWait→TimeWait→Close)
- [x] **Conntrack**: UDP/ICMP tracking, ICMP error→Related matching
- [x] **Conntrack**: SYN/ICMP echo rate limiting per source
- [x] **Conntrack**: Max entries limit (65536), per-protocol/per-state statistics
- [x] **NAT**: SNAT/DNAT rules, IPv4 rewrite, checksum recomputation
- [x] **NAT**: Active binding tracking and display

### Virtual Devices

- [x] **Bridge**: MAC learning, aging (300s), STP 802.1D, FDB
- [x] **VLAN**: 802.1Q tag insertion/stripping, parent device forwarding
- [x] **TUN**: L3 tunnel, scheme interface, event loop integration
- [x] **VXLAN**: Encapsulation/decapsulation, parent forwarding
- [x] **GRE**: Encapsulation/decapsulation with key support
- [x] **IPIP**: IP-in-IP tunnel, parent forwarding
- [x] **Bond**: Round-robin forwarding to slaves

### Traffic Control

- [x] **Qdisc**: TokenBucket rate limiter, PriorityQueue 3-band pfifo_fast
- [x] **Qdisc**: Configurable per-interface via netcfg

### Monitoring & Diagnostics

- [x] **Interface stats**: rx/tx bytes/packets, errors, drops (RFC 1213 MIB-II)
- [x] **ARP stats**: Requests, replies, cache hits/misses per interface
- [x] **Conntrack stats**: Per-protocol/per-TCP-state breakdown
- [x] **Connection list**: TCP sockets with state, addresses, queue sizes
- [x] **Packet capture**: Ring buffer with BPF-style filter (proto + port)
- [x] **netdiag**: CLI tool with live bandwidth monitoring
- [x] **Help**: Self-documenting API at `/scheme/netcfg/help`
- [x] **NAT display**: Per-rule match counts, active binding display

### Management

- [x] **netcfg**: Full scheme for interface config, routing, DNS, capture
- [x] **netfilter**: Scheme for firewall rules, NAT rules, policy, counters
- [x] **sysctl**: `net.ipv4.ip_forward` toggle
- [x] **Interface config**: MAC, IP, MTU, enable/disable, promiscuous

### Testing

- [x] 31 unit tests across filter, conntrack, NAT, bridge, STP, SLAAC, ICMP error
- [x] Regression tests for critical bugs (verdict, ICMP offset, SYN detection, STP panic)

## Known Limitations

- No TCP SACK (smoltcp limitation)
- No ECN support
- No IP fragmentation offload
- No hardware checksum offload
- No multicast/IGMP/MLD
- No IPsec/VPN
- VXLAN/GRE/IPIP send path works but there's no automatic inbound RX wiring
  (packets must be pushed via `push_received()` externally)