feat(net,gui): TCP listen/accept, and a Network Monitor to watch it

Kernel: the passive-open half of TCP. tcp_listen claims a port, inbound
SYNs to it are completed by the receive path, and the finished
connections queue in a backlog until tcp_accept collects them. Accepted
connections run the same stream state machine as active opens, so
tcp_send/tcp_recv/tcp_close work on them unchanged. sys_listen and
sys_accept expose this through the BSD socket API, with sys_accept
returning a fresh descriptor and leaving the listener available for the
next caller. The built-in sshd and httpd predate this and are still
answered inline from the receive path; the role they use is now named
TCP_ROLE_SERVICE to keep that distinction explicit.

GUI: a Network Monitor app. Interface configuration and link state, a
rolling dual-line chart of receive and transmit rates sampled from the
NIC counters on a fixed 2 Hz cadence (so it reads in packets per half
second no matter how often the compositor repaints), byte and packet
totals, and the TCP engine's connection table with each connection's real
state and direction, scrollable when it outgrows the window.

Two bugs the monitor made visible, both fixed:

  - Served HTTP connections were never closed. The response advertises
    "Connection: close" but the engine left the connection ESTABLISHED
    forever, so the 32-entry table filled up and the server stopped
    answering after 32 requests. The service path now sends its FIN after
    the response and lingers in TIME_WAIT until the reaper takes it. 40
    sequential requests through a 32-slot table now yield 39 successes
    where the 33rd onwards previously failed permanently.

  - tcp_close gave up in FIN_WAIT2 after 500 ms and freed the slot, so a
    peer whose own FIN arrived later got an RST instead of an ACK. It now
    falls into TIME_WAIT instead, and TIME_WAIT acknowledges a first FIN
    rather than only a retransmitted one. Expired TIME_WAIT entries are
    also reaped from tcp_get_connections_count, so a table that sees no
    further connections still empties out.

Verified on x86_64 against real peers, checked packet by packet in a
capture: a host client connected to `tcpserve 9000` in the guest and got
its reply -- SYN/SYN-ACK/ACK with a random ISN, 30-byte request, 43-byte
reply, and a clean four-way close whose final ACK is correct even when
the peer's FIN arrives 1.2 s late. Zero bad checksums throughout. The
monitor was screenshotted under live load showing connections moving
through TIME_WAIT and being reclaimed. Builds clean on x86_64, aarch64
and armv8i.

Known limit: 32 connection slots with a 2 s TIME_WAIT linger means
sustained rates much above ~16 requests/second can transiently exhaust
the table; it recovers on its own as entries expire.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

userland/lazybox/lazybox.c

@@ -2216,6 +2216,14 @@ static int applet_netstat(int argc, char** argv) {
         }
     }
 
+    // Ports claimed through tcp_listen (the general passive-open path).
+    for (int i = 0; i < tcp_get_listener_count(); i++) {
+        uint16_t lp = tcp_get_listener_port(i);
+        if (!lp) continue;
+        printk("tcp        0      0 0.0.0.0:%-5u           0.0.0.0:*               "
+               "LISTEN (%d queued)\n", lp, tcp_get_listener_backlog(i));
+    }
+
     // Live connections from the TCP engine's own table: inbound ones accepted
     // by a listener, outbound ones opened by tcp_connect.
     for (size_t i = 0; i < 32; i++) {
@@ -2271,8 +2279,9 @@ static int applet_sockstat(int argc, char** argv) {
         snprintf(rbuf, sizeof(rbuf), "%s:%u", ra, s->remote_port);
         const char* ty = (s->type == SOCK_DGRAM) ? "dgram" :
                          (s->type == SOCK_STREAM) ? "stream" : "raw";
-        printk("%-4d %-8s %-24s %-24s %s\n", i, ty, lbuf, rbuf,
-               s->state == 1 ? "CONNECTED" : "OPEN");
+        const char* st = (s->state == SOCK_STATE_CONNECTED) ? "CONNECTED" :
+                         (s->state == SOCK_STATE_LISTEN)    ? "LISTEN"    : "OPEN";
+        printk("%-4d %-8s %-24s %-24s %s\n", i, ty, lbuf, rbuf, st);
         shown++;
     }
     if (!shown) printk("  (no open sockets)\n");
@@ -2356,6 +2365,76 @@ static int applet_tcpconnect(int argc, char** argv) {
     return 0;
 }
 
+// Listen on a port, take one connection, echo what the peer sends, and hang
+// up. This is the passive-open path end to end, through the BSD socket API
+// rather than the TCP engine directly: bind, listen, accept, recv, send, close.
+static int applet_tcpserve(int argc, char** argv) {
+    if (argc < 2) {
+        printk("usage: tcpserve <port> [seconds to wait]\n");
+        return 1;
+    }
+
+    uint16_t port = (uint16_t)atoi(argv[1]);
+    if (port == 0) {
+        printk(ANSI_BRIGHT_RED "tcpserve: invalid port '%s'\n" ANSI_RESET, argv[1]);
+        return 1;
+    }
+
+    int fd = sys_socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (fd < 0) {
+        printk(ANSI_BRIGHT_RED "tcpserve: no socket available\n" ANSI_RESET);
+        return 1;
+    }
+
+    sockaddr_in_t local;
+    memset(&local, 0, sizeof(local));
+    local.sin_family = AF_INET;
+    local.sin_port   = htons(port);
+    local.sin_addr   = 0;   // all interfaces
+
+    if (sys_bind(fd, &local, sizeof(local)) != 0 || sys_listen(fd, 4) != 0) {
+        printk(ANSI_BRIGHT_RED "tcpserve: cannot listen on port %u "
+               "(already claimed?)\n" ANSI_RESET, port);
+        sys_close_socket(fd);
+        return 1;
+    }
+
+    printk(ANSI_BRIGHT_GREEN "Listening" ANSI_RESET " on 0.0.0.0:%u -- waiting for a "
+           "connection ...\n", port);
+
+    sockaddr_in_t peer;
+    size_t plen = sizeof(peer);
+    int cfd = sys_accept(fd, &peer, &plen);
+    if (cfd < 0) {
+        printk(ANSI_YELLOW "tcpserve: nobody connected; giving up\n" ANSI_RESET);
+        sys_close_socket(fd);
+        return 1;
+    }
+
+    char pip[16];
+    ip_to_str(peer.sin_addr, pip);
+    printk(ANSI_BRIGHT_GREEN "Accepted" ANSI_RESET " connection from %s:%u\n",
+           pip, ntohs(peer.sin_port));
+
+    char buf[513];
+    ssize_t n = sys_recv(cfd, buf, sizeof(buf) - 1, 0);
+    if (n > 0) {
+        buf[n] = '\0';
+        printk(ANSI_YELLOW "--- %d byte(s) received ---\n" ANSI_RESET, (int)n);
+        printk("%s\n", buf);
+
+        const char* reply = "SUB-OS accepted your connection. Goodbye.\r\n";
+        sys_send(cfd, reply, strlen(reply), 0);
+    } else {
+        printk(ANSI_YELLOW "tcpserve: peer sent nothing\n" ANSI_RESET);
+    }
+
+    sys_close_socket(cfd);
+    sys_close_socket(fd);
+    printk("Connection closed, port %u released.\n", port);
+    return 0;
+}
+
 // A minimal HTTP/1.0 client over the active-open path.
 static int applet_httpget(int argc, char** argv) {
     if (argc < 2) {
@@ -2727,6 +2806,7 @@ static const lazybox_applet_t applets[] = {
     {"sockstat",      applet_sockstat,      "sockstat",                  "Socket table & UDP stats",   "Network"},
     {"tcpconnect",    applet_tcpconnect,    "tcpconnect <host> <port> [text]", "Open an outbound TCP stream", "Network"},
     {"httpget",       applet_httpget,       "httpget <host> [path] [port]",    "Fetch a URL over TCP",       "Network"},
+    {"tcpserve",      applet_tcpserve,      "tcpserve <port>",                 "Accept one inbound TCP stream", "Network"},
 
     // Storage & Devices
     {"lsblk",         applet_lsblk,         "lsblk",                     "List block storage devices", "Storage"},