fix(parse)!: Use u16 as our size type the parse traits

BREAKING_CHANGE: swap `usize` to `u16` in parse traits

DPDK uses `u16` where etherparse uses `usize`.
Both answers are reasonable in the context of packet processing.
That said, we need to be compatible with both of them.

The only practical answer is to switch the parse traits to use `u16`.

Any alternative requires constant downcast checks throughout the rest of the code base.

Signed-off-by: Daniel Noland <[email protected]>

Author: daniel-noland

net/src/eth/mod.rs

@@ -42,7 +42,8 @@ pub enum EthError {
 
 impl Eth {
     /// The length (in bytes) of an [`Eth`] header
-    pub const HEADER_LEN: usize = 14;
+    #[allow(clippy::unwrap_used)] // trivially safe const eval
+    pub const HEADER_LEN: NonZero<u16> = NonZero::new(14).unwrap();
 
     /// Create a new [Eth] header.
     #[must_use]
@@ -100,7 +101,10 @@ impl Eth {
 impl Parse for Eth {
     type Error = EthError;
 
-    fn parse(buf: &[u8]) -> Result<(Self, NonZero<usize>), ParseError<Self::Error>> {
+    fn parse(buf: &[u8]) -> Result<(Self, NonZero<u16>), ParseError<Self::Error>> {
+        if buf.len() > u16::MAX as usize {
+            return Err(ParseError::BufferTooLong(buf.len()));
+        }
         let (inner, rest) = Ethernet2Header::from_slice(buf).map_err(|e| {
             let expected = NonZero::new(e.required_len).unwrap_or_else(|| unreachable!());
             ParseError::Length(LengthError {
@@ -114,7 +118,9 @@ impl Parse for Eth {
             rest = rest.len(),
             buf = buf.len()
         );
-        let consumed = NonZero::new(buf.len() - rest.len()).ok_or_else(|| unreachable!())?;
+        #[allow(clippy::cast_possible_truncation)] // buffer length bounded above
+        let consumed =
+            NonZero::new((buf.len() - rest.len()) as u16).ok_or_else(|| unreachable!())?;
         let new = Self(inner);
         // integrity check for ethernet header
         new.destination()
@@ -132,12 +138,16 @@ impl Parse for Eth {
 impl DeParse for Eth {
     type Error = ();
 
-    fn size(&self) -> NonZero<usize> {
-        NonZero::new(self.0.header_len()).unwrap_or_else(|| unreachable!())
+    fn size(&self) -> NonZero<u16> {
+        #[allow(clippy::cast_possible_truncation)] // Eth headers have fixed length
+        NonZero::new(self.0.header_len() as u16).unwrap_or_else(|| unreachable!())
     }
 
-    fn deparse(&self, buf: &mut [u8]) -> Result<NonZero<usize>, DeParseError<Self::Error>> {
+    fn deparse(&self, buf: &mut [u8]) -> Result<NonZero<u16>, DeParseError<Self::Error>> {
         let len = buf.len();
+        if buf.len() > u16::MAX as usize {
+            return Err(DeParseError::BufferTooLong(len));
+        }
         let unused = self.0.write_to_slice(buf).map_err(|e| {
             let expected = NonZero::new(e.required_len).unwrap_or_else(|| unreachable!());
             DeParseError::Length(LengthError {
@@ -150,7 +160,8 @@ impl DeParse for Eth {
             "unused.len() >= buf.len() ({unused} >= {len})",
             unused = unused.len(),
         );
-        let consumed = NonZero::new(len - unused.len()).ok_or_else(|| unreachable!())?;
+        #[allow(clippy::cast_possible_truncation)] // buffer len upper bounded already
+        let consumed = NonZero::new((len - unused.len()) as u16).ok_or_else(|| unreachable!())?;
         Ok(consumed)
     }
 }
@@ -231,75 +242,79 @@ mod contract {
 #[allow(clippy::unwrap_used, clippy::expect_used)] // valid in test code for unreachable cases
 #[cfg(test)]
 mod test {
+    const HEADER_LEN_USIZE: usize = Eth::HEADER_LEN.get() as usize;
     use crate::eth::{DestinationMacAddressError, Eth, EthError, SourceMacAddressError};
-    use crate::parse::{DeParse, Parse, ParseError};
+    use crate::parse::{DeParse, IntoNonZeroUSize, Parse, ParseError};
 
     #[test]
     fn parse_back() {
         bolero::check!().with_type().for_each(|eth: &Eth| {
             assert!(eth.source().inner().valid_src().is_ok());
             assert!(eth.destination().inner().valid_dst().is_ok());
-            let mut buf = [0u8; Eth::HEADER_LEN];
+            let mut buf = [0u8; HEADER_LEN_USIZE];
             eth.deparse(&mut buf).unwrap();
             let (eth2, consumed) = Eth::parse(&buf).unwrap();
             assert_eq!(eth, &eth2);
-            assert_eq!(consumed.get(), Eth::HEADER_LEN);
+            assert_eq!(consumed, Eth::HEADER_LEN);
         });
     }
 
     fn parse_buffer_of_fixed_length<const LEN: usize>(buf: &[u8; LEN]) {
         let outcome = Eth::parse(buf);
         match outcome {
             Ok((eth, consumed)) => {
-                assert!(buf.len() >= Eth::HEADER_LEN);
-                assert_eq!(consumed.get(), Eth::HEADER_LEN);
+                assert!(buf.len() >= Eth::HEADER_LEN.into_non_zero_usize().get());
+                assert_eq!(consumed, Eth::HEADER_LEN);
                 assert!(eth.source().inner().valid_src().is_ok());
                 assert!(eth.destination().inner().valid_dst().is_ok());
-                let mut buf2 = [0u8; 14];
+                let mut buf2 = [0u8; HEADER_LEN_USIZE];
                 eth.deparse(&mut buf2).unwrap();
                 let (eth2, consumed2) = Eth::parse(&buf2).unwrap();
                 assert_eq!(eth, eth2);
-                assert_eq!(consumed2.get(), Eth::HEADER_LEN);
+                assert_eq!(consumed2, Eth::HEADER_LEN);
             }
             Err(ParseError::Length(e)) => {
-                assert_eq!(e.expected.get(), Eth::HEADER_LEN);
+                assert_eq!(e.expected, Eth::HEADER_LEN.into_non_zero_usize());
                 assert_eq!(e.actual, buf.len());
-                assert!(buf.len() < Eth::HEADER_LEN);
+                assert!(buf.len() < Eth::HEADER_LEN.into_non_zero_usize().get());
             }
             Err(ParseError::Invalid(
                 EthError::InvalidDestination(DestinationMacAddressError::ZeroDestination(z))
                 | EthError::InvalidSource(SourceMacAddressError::ZeroSource(z)),
             )) => {
-                assert!(buf.len() >= Eth::HEADER_LEN);
+                assert!(buf.len() >= Eth::HEADER_LEN.into_non_zero_usize().get());
                 assert!(z.is_zero());
             }
             Err(ParseError::Invalid(EthError::InvalidSource(
                 SourceMacAddressError::MulticastSource(m),
             ))) => {
-                assert!(buf.len() >= Eth::HEADER_LEN);
+                assert!(buf.len() >= Eth::HEADER_LEN.into_non_zero_usize().get());
                 assert!(m.is_multicast());
             }
+            Err(ParseError::BufferTooLong(e)) => {
+                assert_eq!(e, buf.len());
+            }
         }
     }
 
     #[test]
     fn parse_arbitrary_bytes() {
         bolero::check!()
             .with_type()
-            .for_each(parse_buffer_of_fixed_length::<{ Eth::HEADER_LEN }>);
+            .for_each(parse_buffer_of_fixed_length::<{ HEADER_LEN_USIZE }>);
     }
 
     #[test]
     fn parse_prop_test_buffer_too_short() {
         bolero::check!()
             .with_type()
-            .for_each(parse_buffer_of_fixed_length::<{ Eth::HEADER_LEN - 1 }>);
+            .for_each(parse_buffer_of_fixed_length::<{ HEADER_LEN_USIZE - 1 }>);
     }
 
     #[test]
     fn parse_prop_test_excess_buffer() {
         bolero::check!()
             .with_type()
-            .for_each(parse_buffer_of_fixed_length::<{ Eth::HEADER_LEN + 1 }>);
+            .for_each(parse_buffer_of_fixed_length::<{ HEADER_LEN_USIZE + 1 }>);
     }
 }

net/src/icmp4/mod.rs

@@ -3,7 +3,9 @@
 
 //! `ICMPv4` header type and logic.
 
-use crate::parse::{DeParse, DeParseError, LengthError, Parse, ParseError, ParsePayload, Reader};
+use crate::parse::{
+    DeParse, DeParseError, IntoNonZeroUSize, LengthError, Parse, ParseError, ParsePayload, Reader,
+};
 use etherparse::Icmpv4Header;
 use std::num::NonZero;
 
@@ -18,7 +20,10 @@ pub struct Icmp4(Icmpv4Header);
 impl Parse for Icmp4 {
     type Error = LengthError;
 
-    fn parse(buf: &[u8]) -> Result<(Self, NonZero<usize>), ParseError<Self::Error>> {
+    fn parse(buf: &[u8]) -> Result<(Self, NonZero<u16>), ParseError<Self::Error>> {
+        if buf.len() > u16::MAX as usize {
+            return Err(ParseError::BufferTooLong(buf.len()));
+        }
         let (inner, rest) = Icmpv4Header::from_slice(buf).map_err(|e| {
             let expected = NonZero::new(e.required_len).unwrap_or_else(|| unreachable!());
             ParseError::Length(LengthError {
@@ -32,27 +37,30 @@ impl Parse for Icmp4 {
             rest = rest.len(),
             buf = buf.len()
         );
-        let consumed = NonZero::new(buf.len() - rest.len()).ok_or_else(|| unreachable!())?;
+        #[allow(clippy::cast_possible_truncation)] // checked above
+        let consumed =
+            NonZero::new((buf.len() - rest.len()) as u16).ok_or_else(|| unreachable!())?;
         Ok((Self(inner), consumed))
     }
 }
 
 impl DeParse for Icmp4 {
     type Error = ();
 
-    fn size(&self) -> NonZero<usize> {
-        NonZero::new(self.0.header_len()).unwrap_or_else(|| unreachable!())
+    fn size(&self) -> NonZero<u16> {
+        #[allow(clippy::cast_possible_truncation)] // header length bounded
+        NonZero::new(self.0.header_len() as u16).unwrap_or_else(|| unreachable!())
     }
 
-    fn deparse(&self, buf: &mut [u8]) -> Result<NonZero<usize>, DeParseError<Self::Error>> {
+    fn deparse(&self, buf: &mut [u8]) -> Result<NonZero<u16>, DeParseError<Self::Error>> {
         let len = buf.len();
-        if len < self.size().get() {
+        if len < self.size().into_non_zero_usize().get() {
             return Err(DeParseError::Length(LengthError {
-                expected: self.size(),
+                expected: self.size().into_non_zero_usize(),
                 actual: len,
             }));
         }
-        buf[..self.size().get()].copy_from_slice(&self.0.to_bytes());
+        buf[..self.size().into_non_zero_usize().get()].copy_from_slice(&self.0.to_bytes());
         Ok(self.size())
     }
 }
@@ -81,6 +89,9 @@ mod contract {
                 Ok((icmp4, _)) => icmp4,
                 Err(ParseError::Length(l)) => unreachable!("{:?}", l),
                 Err(ParseError::Invalid(e)) => unreachable!("{:?}", e),
+                Err(ParseError::BufferTooLong(_)) => {
+                    unreachable!()
+                }
             };
             Some(icmp4)
         }
@@ -104,11 +115,13 @@ mod test {
                 Err(DeParseError::Invalid(())) => {
                     unreachable!()
                 }
+                Err(DeParseError::BufferTooLong(_)) => unreachable!(),
             };
             let (parsed, bytes_read) = match Icmp4::parse(&buffer) {
                 Ok((parsed, bytes_read)) => (parsed, bytes_read),
                 Err(ParseError::Invalid(e)) => unreachable!("{e:?}"),
                 Err(ParseError::Length(l)) => unreachable!("{l:?}"),
+                Err(ParseError::BufferTooLong(_)) => unreachable!(),
             };
             assert_eq!(input, &parsed);
             assert_eq!(bytes_written, bytes_read);

net/src/icmp6/mod.rs

@@ -3,7 +3,9 @@
 
 //! `ICMPv6` header type and logic.
 
-use crate::parse::{DeParse, DeParseError, LengthError, Parse, ParseError, ParsePayload, Reader};
+use crate::parse::{
+    DeParse, DeParseError, IntoNonZeroUSize, LengthError, Parse, ParseError, ParsePayload, Reader,
+};
 use etherparse::Icmpv6Header;
 use std::num::NonZero;
 
@@ -17,7 +19,10 @@ pub struct Icmp6(Icmpv6Header);
 impl Parse for Icmp6 {
     type Error = LengthError;
 
-    fn parse(buf: &[u8]) -> Result<(Self, NonZero<usize>), ParseError<Self::Error>> {
+    fn parse(buf: &[u8]) -> Result<(Self, NonZero<u16>), ParseError<Self::Error>> {
+        if buf.len() > u16::MAX as usize {
+            return Err(ParseError::BufferTooLong(buf.len()));
+        }
         let (inner, rest) = Icmpv6Header::from_slice(buf).map_err(|e| {
             let expected = NonZero::new(e.required_len).unwrap_or_else(|| unreachable!());
             ParseError::Length(LengthError {
@@ -31,7 +36,9 @@ impl Parse for Icmp6 {
             rest = rest.len(),
             buf = buf.len()
         );
-        let consumed = NonZero::new(buf.len() - rest.len()).ok_or_else(|| unreachable!())?;
+        #[allow(clippy::cast_possible_truncation)] // buffer length bounded above
+        let consumed =
+            NonZero::new((buf.len() - rest.len()) as u16).ok_or_else(|| unreachable!())?;
         Ok((Self(inner), consumed))
     }
 }
@@ -48,19 +55,20 @@ impl ParsePayload for Icmp6 {
 impl DeParse for Icmp6 {
     type Error = ();
 
-    fn size(&self) -> NonZero<usize> {
-        NonZero::new(self.0.header_len()).unwrap_or_else(|| unreachable!())
+    fn size(&self) -> NonZero<u16> {
+        #[allow(clippy::cast_possible_truncation)] // header size bounded
+        NonZero::new(self.0.header_len() as u16).unwrap_or_else(|| unreachable!())
     }
 
-    fn deparse(&self, buf: &mut [u8]) -> Result<NonZero<usize>, DeParseError<Self::Error>> {
+    fn deparse(&self, buf: &mut [u8]) -> Result<NonZero<u16>, DeParseError<Self::Error>> {
         let len = buf.len();
-        if len < self.size().get() {
+        if len < self.size().into_non_zero_usize().get() {
             return Err(DeParseError::Length(LengthError {
-                expected: self.size(),
+                expected: self.size().into_non_zero_usize(),
                 actual: len,
             }));
         }
-        buf[..self.size().get()].copy_from_slice(&self.0.to_bytes());
+        buf[..self.size().into_non_zero_usize().get()].copy_from_slice(&self.0.to_bytes());
         Ok(self.size())
     }
 }

net/src/ip_auth/mod.rs

@@ -22,7 +22,10 @@ pub struct IpAuth(Box<IpAuthHeader>);
 impl Parse for IpAuth {
     type Error = etherparse::err::ip_auth::HeaderSliceError;
 
-    fn parse(buf: &[u8]) -> Result<(Self, NonZero<usize>), ParseError<Self::Error>> {
+    fn parse(buf: &[u8]) -> Result<(Self, NonZero<u16>), ParseError<Self::Error>> {
+        if buf.len() > u16::MAX as usize {
+            return Err(ParseError::BufferTooLong(buf.len()));
+        }
         let (inner, rest) = IpAuthHeader::from_slice(buf)
             .map(|(h, rest)| (Box::new(h), rest))
             .map_err(ParseError::Invalid)?;
@@ -32,7 +35,9 @@ impl Parse for IpAuth {
             rest = rest.len(),
             buf = buf.len()
         );
-        let consumed = NonZero::new(buf.len() - rest.len()).ok_or_else(|| unreachable!())?;
+        #[allow(clippy::cast_possible_truncation)] // buffer length bounded above
+        let consumed =
+            NonZero::new((buf.len() - rest.len()) as u16).ok_or_else(|| unreachable!())?;
         Ok((Self(inner), consumed))
     }
 }