vasilito
b9e53c500a
Comprehensive documentation of the current networking stack state including architecture diagram, transport/network/firewall/virtual device/traffic control/monitoring/management feature checklists, known limitations, and testing status. Generated from 66 implementation rounds across the netstack codebase.
121 lines
7.1 KiB
Markdown
121 lines
7.1 KiB
Markdown
# Red Bear OS Networking Stack — Current State (2026-07-09)
|
|
|
|
## Overview
|
|
|
|
The userspace TCP/IP stack (`netstack` / `smolnetd`) runs as a Redox scheme daemon
|
|
implementing the full IP stack in Rust on top of smoltcp 0.12.0.
|
|
|
|
### Architecture
|
|
|
|
```
|
|
┌──────────────────────────────────────────────────────────────────────┐
|
|
│ smolnetd (netstack) │
|
|
│ │
|
|
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
|
|
│ │ scheme: │ │ scheme: │ │ scheme: │ │ scheme: │ ... │
|
|
│ │ tcp │ │ udp │ │ icmp │ │ netcfg │ │
|
|
│ └────┬─────┘ └────┬─────┘ └────┬─────┘ └────┬─────┘ │
|
|
│ │ │ │ │ │
|
|
│ ┌────┴─────────────┴───────────┴────────────┴─────┐ │
|
|
│ │ SocketSet (smoltcp) │ │
|
|
│ └────────────────────────┬──────────────────────────┘ │
|
|
│ │ │
|
|
│ ┌────────────────────────┴──────────────────────────┐ │
|
|
│ │ Router + Filter │ │
|
|
│ │ ┌─────────┐ ┌──────────┐ ┌──────────┐ │ │
|
|
│ │ │ Filter │ │ NAT │ │Conntrack │ │ │
|
|
│ │ │ (rules) │ │(snat/dnat)│ │ (states) │ │ │
|
|
│ │ └─────────┘ └──────────┘ └──────────┘ │ │
|
|
│ └────────────────────────┬──────────────────────────┘ │
|
|
│ │ │
|
|
│ ┌────────────────────────┴──────────────────────────┐ │
|
|
│ │ Ethernet / Loopback / Tunnel │ │
|
|
│ └────────────────────────────────────────────────────┘ │
|
|
└──────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Feature Checklist
|
|
|
|
### Transport Layer
|
|
|
|
- [x] **TCP**: Full scheme server, listen/accept, connect, close, send/recv
|
|
- [x] **TCP**: Socket options (SO_KEEPALIVE, TCP_NODELAY, TCP_KEEPIDLE, TCP_INFO, SO_LINGER)
|
|
- [x] **TCP**: SYN flood protection (100 SYN/sec per source)
|
|
- [x] **UDP**: Scheme server, bind, connect(), send, recv
|
|
- [x] **UDP**: `sendto()`/`sendmsg()` on unconnected sockets (R65)
|
|
- [x] **UDP**: Socket options (SO_REUSEADDR, SO_BROADCAST, IP_TTL)
|
|
- [x] **ICMP**: Echo request/reply (ping)
|
|
- [x] **ICMP**: ICMP error reception (Udp socket type for IP_RECVERR-style notifications)
|
|
|
|
### Network Layer
|
|
|
|
- [x] **IPv4**: Full routing, forwarding, dispatch
|
|
- [x] **IPv6**: Routing, NDP, SLAAC address formation, RS/RA exchange
|
|
- [x] **Route table**: Longest-prefix match, metric support, direct routes, flush
|
|
- [x] **Route types**: Unicast, Blackhole, Unreachable, Prohibit
|
|
- [x] **ARP**: Request/reply, cache with 1024-entry LRU limit, statistics
|
|
- [x] **NDP**: Neighbor Solicitation/Advertisement, router solicitation
|
|
- [x] **ICMP errors**: Port Unreachable, Time Exceeded generation
|
|
- [x] **IP forwarding toggle**: sysctl `net.ipv4.ip_forward` rw
|
|
|
|
### Firewall & Security
|
|
|
|
- [x] **Filter**: 5 netfilter hooks, rule evaluation, per-chain counters
|
|
- [x] **Rule format**: iptables-style (`ACCEPT input -p tcp --dport 80 --ctstate ESTABLISHED`)
|
|
- [x] **Verdicts**: ACCEPT, DROP, LOG, REJECT
|
|
- [x] **Conntrack**: Full TCP state machine (None→SynSent→SynRecv→Established→FinWait→TimeWait→Close)
|
|
- [x] **Conntrack**: UDP/ICMP tracking, ICMP error→Related matching
|
|
- [x] **Conntrack**: SYN/ICMP echo rate limiting per source
|
|
- [x] **Conntrack**: Max entries limit (65536), per-protocol/per-state statistics
|
|
- [x] **NAT**: SNAT/DNAT rules, IPv4 rewrite, checksum recomputation
|
|
- [x] **NAT**: Active binding tracking and display
|
|
|
|
### Virtual Devices
|
|
|
|
- [x] **Bridge**: MAC learning, aging (300s), STP 802.1D, FDB
|
|
- [x] **VLAN**: 802.1Q tag insertion/stripping, parent device forwarding
|
|
- [x] **TUN**: L3 tunnel, scheme interface, event loop integration
|
|
- [x] **VXLAN**: Encapsulation/decapsulation, parent forwarding
|
|
- [x] **GRE**: Encapsulation/decapsulation with key support
|
|
- [x] **IPIP**: IP-in-IP tunnel, parent forwarding
|
|
- [x] **Bond**: Round-robin forwarding to slaves
|
|
|
|
### Traffic Control
|
|
|
|
- [x] **Qdisc**: TokenBucket rate limiter, PriorityQueue 3-band pfifo_fast
|
|
- [x] **Qdisc**: Configurable per-interface via netcfg
|
|
|
|
### Monitoring & Diagnostics
|
|
|
|
- [x] **Interface stats**: rx/tx bytes/packets, errors, drops (RFC 1213 MIB-II)
|
|
- [x] **ARP stats**: Requests, replies, cache hits/misses per interface
|
|
- [x] **Conntrack stats**: Per-protocol/per-TCP-state breakdown
|
|
- [x] **Connection list**: TCP sockets with state, addresses, queue sizes
|
|
- [x] **Packet capture**: Ring buffer with BPF-style filter (proto + port)
|
|
- [x] **netdiag**: CLI tool with live bandwidth monitoring
|
|
- [x] **Help**: Self-documenting API at `/scheme/netcfg/help`
|
|
- [x] **NAT display**: Per-rule match counts, active binding display
|
|
|
|
### Management
|
|
|
|
- [x] **netcfg**: Full scheme for interface config, routing, DNS, capture
|
|
- [x] **netfilter**: Scheme for firewall rules, NAT rules, policy, counters
|
|
- [x] **sysctl**: `net.ipv4.ip_forward` toggle
|
|
- [x] **Interface config**: MAC, IP, MTU, enable/disable, promiscuous
|
|
|
|
### Testing
|
|
|
|
- [x] 31 unit tests across filter, conntrack, NAT, bridge, STP, SLAAC, ICMP error
|
|
- [x] Regression tests for critical bugs (verdict, ICMP offset, SYN detection, STP panic)
|
|
|
|
## Known Limitations
|
|
|
|
- No TCP SACK (smoltcp limitation)
|
|
- No ECN support
|
|
- No IP fragmentation offload
|
|
- No hardware checksum offload
|
|
- No multicast/IGMP/MLD
|
|
- No IPsec/VPN
|
|
- VXLAN/GRE/IPIP send path works but there's no automatic inbound RX wiring
|
|
(packets must be pushed via `push_received()` externally)
|