feat(net,gui): TCP listen/accept, and a Network Monitor to watch it

Kernel: the passive-open half of TCP. tcp_listen claims a port, inbound
SYNs to it are completed by the receive path, and the finished
connections queue in a backlog until tcp_accept collects them. Accepted
connections run the same stream state machine as active opens, so
tcp_send/tcp_recv/tcp_close work on them unchanged. sys_listen and
sys_accept expose this through the BSD socket API, with sys_accept
returning a fresh descriptor and leaving the listener available for the
next caller. The built-in sshd and httpd predate this and are still
answered inline from the receive path; the role they use is now named
TCP_ROLE_SERVICE to keep that distinction explicit.

GUI: a Network Monitor app. Interface configuration and link state, a
rolling dual-line chart of receive and transmit rates sampled from the
NIC counters on a fixed 2 Hz cadence (so it reads in packets per half
second no matter how often the compositor repaints), byte and packet
totals, and the TCP engine's connection table with each connection's real
state and direction, scrollable when it outgrows the window.

Two bugs the monitor made visible, both fixed:

  - Served HTTP connections were never closed. The response advertises
    "Connection: close" but the engine left the connection ESTABLISHED
    forever, so the 32-entry table filled up and the server stopped
    answering after 32 requests. The service path now sends its FIN after
    the response and lingers in TIME_WAIT until the reaper takes it. 40
    sequential requests through a 32-slot table now yield 39 successes
    where the 33rd onwards previously failed permanently.

  - tcp_close gave up in FIN_WAIT2 after 500 ms and freed the slot, so a
    peer whose own FIN arrived later got an RST instead of an ACK. It now
    falls into TIME_WAIT instead, and TIME_WAIT acknowledges a first FIN
    rather than only a retransmitted one. Expired TIME_WAIT entries are
    also reaped from tcp_get_connections_count, so a table that sees no
    further connections still empties out.

Verified on x86_64 against real peers, checked packet by packet in a
capture: a host client connected to `tcpserve 9000` in the guest and got
its reply -- SYN/SYN-ACK/ACK with a random ISN, 30-byte request, 43-byte
reply, and a clean four-way close whose final ACK is correct even when
the peer's FIN arrives 1.2 s late. Zero bad checksums throughout. The
monitor was screenshotted under live load showing connections moving
through TIME_WAIT and being reclaimed. Builds clean on x86_64, aarch64
and armv8i.

Known limit: 32 connection slots with a 2 s TIME_WAIT linger means
sustained rates much above ~16 requests/second can transiently exhaust
the table; it recovers on its own as entries expire.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

net/core/socket.c

@@ -20,6 +20,7 @@
 
 #define SOCK_CONNECT_TIMEOUT_MS 4000
 #define SOCK_RECV_TIMEOUT_MS    2000
+#define SOCK_ACCEPT_TIMEOUT_MS  5000
 
 typedef struct {
     uint32_t src_ip;
@@ -36,6 +37,7 @@ typedef struct {
     int      count;  // queued datagrams
     bool     bound;  // a UDP binding is installed for local_port
     tcp_conn_t* tcp; // stream sockets only: the connection sys_connect opened
+    bool     listening; // stream sockets only: a TCP listener holds local_port
 } sock_priv_t;
 
 static socket_t    socket_table[MAX_SOCKETS];
@@ -144,15 +146,56 @@ int sys_connect(int sockfd, const struct sockaddr_in* addr, size_t addrlen) {
         if (!pv->tcp) return -1;
         s->local_ip   = pv->tcp->local_ip;
         s->local_port = pv->tcp->local_port;
-        s->state = 1;
+        s->state = SOCK_STATE_CONNECTED;
         return 0;
     }
 
-    s->state = 1; // "connected" (address memorised for send/recv)
+    s->state = SOCK_STATE_CONNECTED; // address memorised for send/recv
     if (s->type == SOCK_DGRAM) return dgram_ensure_bound(sockfd);
     return 0;
 }
 
+int sys_listen(int sockfd, int backlog) {
+    if (!valid_fd(sockfd)) return -1;
+    socket_t* s = &socket_table[sockfd];
+    if (s->type != SOCK_STREAM || s->local_port == 0) return -1;
+
+    if (tcp_listen(s->local_port, backlog) != 0) return -1;
+    socket_priv[sockfd].listening = true;
+    s->state = SOCK_STATE_LISTEN;
+    return 0;
+}
+
+int sys_accept(int sockfd, struct sockaddr_in* addr, size_t* addrlen) {
+    if (!valid_fd(sockfd)) return -1;
+    socket_t* s = &socket_table[sockfd];
+    if (s->type != SOCK_STREAM || !socket_priv[sockfd].listening) return -1;
+
+    tcp_conn_t* c = tcp_accept(s->local_port, SOCK_ACCEPT_TIMEOUT_MS);
+    if (!c) return -1;
+
+    // The accepted connection needs a descriptor of its own; the listening
+    // socket keeps its port and stays available for the next caller.
+    int fd = sys_socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (fd < 0) { tcp_close(c); return -1; }
+
+    socket_t* ns = &socket_table[fd];
+    ns->local_ip    = c->local_ip;
+    ns->local_port  = c->local_port;
+    ns->remote_ip   = c->remote_ip;
+    ns->remote_port = c->remote_port;
+    ns->state       = SOCK_STATE_CONNECTED;
+    socket_priv[fd].tcp = c;
+
+    if (addr) {
+        addr->sin_family = AF_INET;
+        addr->sin_addr   = c->remote_ip;
+        addr->sin_port   = htons(c->remote_port);
+        if (addrlen) *addrlen = sizeof(struct sockaddr_in);
+    }
+    return fd;
+}
+
 ssize_t sys_sendto(int sockfd, const void* buf, size_t len, int flags,
                    const struct sockaddr_in* dest, size_t addrlen) {
     (void)flags; (void)addrlen;
@@ -164,7 +207,7 @@ ssize_t sys_sendto(int sockfd, const void* buf, size_t len, int flags,
     uint32_t dip;
     uint16_t dport;
     if (dest) { dip = dest->sin_addr; dport = ntohs(dest->sin_port); }
-    else if (s->state == 1) { dip = s->remote_ip; dport = s->remote_port; }
+    else if (s->state == SOCK_STATE_CONNECTED) { dip = s->remote_ip; dport = s->remote_port; }
     else return -1;
 
     if (dgram_ensure_bound(sockfd) != 0) return -1;
@@ -235,6 +278,7 @@ int sys_close_socket(int sockfd) {
     if (!valid_fd(sockfd)) return -1;
     socket_t* s = &socket_table[sockfd];
     sock_priv_t* pv = &socket_priv[sockfd];
+    if (pv->listening && s->local_port) tcp_unlisten(s->local_port);
     if (pv->tcp) tcp_close(pv->tcp);
     if (pv->bound && s->local_port) udp_unbind(s->local_port);
     memset(s, 0, sizeof(socket_t));