fix(proto): floor negative echo lengths

crates/irtt-proto/src/echo.rs

@@ -66,7 +66,7 @@ pub fn encode_echo_reply(
     hmac_key: Option<&[u8]>,
 ) -> Result<Vec<u8>> {
     let layout = PacketLayout::echo(hmac_key.is_some(), params);
-    let len = echo_packet_len(hmac_key.is_some(), params)?;
+    let len = echo_packet_len(hmac_key.is_some(), params);
     let payload_offset = layout.header_len();
     let available_payload_len = len.saturating_sub(payload_offset);
     if reply.payload.len() > available_payload_len {
@@ -186,7 +186,7 @@ fn validate_echo_length(packet: &[u8], params: &Params, layout: PacketLayout) ->
             actual: packet.len(),
         });
     }
-    let expected_len = echo_packet_len(layout.hmac, params)?;
+    let expected_len = echo_packet_len(layout.hmac, params);
     if packet.len() == expected_len {
         return Ok(false);
     }
@@ -396,7 +396,7 @@ mod tests {
         };
         params.received_stats = ReceivedStats::Both;
         let layout = PacketLayout::echo(true, &params);
-        let mut packet = Vec::with_capacity(echo_packet_len(true, &params).unwrap());
+        let mut packet = Vec::with_capacity(echo_packet_len(true, &params));
         write_header(&mut packet, FLAG_REPLY | FLAG_HMAC);
         packet.extend_from_slice(&[0; HMAC_SIZE]);
         packet.extend_from_slice(&0x7896_b6ab_8771_5213u64.to_le_bytes());

crates/irtt-proto/src/error.rs

@@ -30,8 +30,6 @@ pub enum ProtoError {
     InvalidUtf8,
     #[error("invalid enum value {value} for {name}")]
     InvalidEnum { name: &'static str, value: i64 },
-    #[error("packet length must be non-negative, got {length}")]
-    NegativePacketLength { length: i64 },
     #[error("parameter {tag} length is too large: {length} bytes")]
     ParameterLengthTooLarge { tag: u64, length: u64 },
     #[error("open reply has zero token without close flag")]

crates/irtt-proto/src/layout.rs

@@ -1,7 +1,7 @@
 use crate::{
     params::{Params, StampAt},
-    ProtoError, Result, HEADER_SIZE, HMAC_SIZE, RECV_COUNT_SIZE, RECV_WINDOW_SIZE, SEQ_SIZE,
-    TIMESTAMP_SIZE, TOKEN_SIZE,
+    HEADER_SIZE, HMAC_SIZE, RECV_COUNT_SIZE, RECV_WINDOW_SIZE, SEQ_SIZE, TIMESTAMP_SIZE,
+    TOKEN_SIZE,
 };
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -111,13 +111,23 @@ pub fn echo_header_len(hmac: bool, params: &Params) -> usize {
     PacketLayout::echo(hmac, params).header_len()
 }
 
-pub fn echo_packet_len(hmac: bool, params: &Params) -> Result<usize> {
-    let header_len = echo_header_len(hmac, params);
-    let requested =
-        usize::try_from(params.length).map_err(|_| ProtoError::NegativePacketLength {
-            length: params.length,
-        })?;
-    Ok(header_len.max(requested))
+/// The datagram length of an ECHO request or reply under `params`.
+///
+/// The negotiated length is a floor a peer asks for, never a ceiling: a packet
+/// can never be shorter than the field block its negotiated layout requires, so
+/// the result is `max(header, requested)`.
+///
+/// A negative negotiated length is a legitimate input rather than an encoder
+/// error. It is accepted during open and echoed back unchanged, so a session
+/// can genuinely carry one, and there is no datagram shorter than none — it
+/// therefore requests no space beyond the mandatory field block, exactly as
+/// zero does.
+pub fn echo_packet_len(hmac: bool, params: &Params) -> usize {
+    // Saturating rather than wrapping: on a target whose `usize` is narrower
+    // than the requested length, the largest representable packet is the
+    // closest honest answer, and the encoder's own limits reject it from there.
+    let requested = usize::try_from(params.length.max(0)).unwrap_or(usize::MAX);
+    echo_header_len(hmac, params).max(requested)
 }
 
 #[cfg(test)]
@@ -278,32 +288,18 @@ mod tests {
     }
 
     #[test]
-    fn negotiated_length_never_smaller_than_header() {
+    fn negotiated_length_is_floored_at_the_required_field_block() {
+        // The 60-byte header of this layout is the floor. A negative negotiated
+        // length is not an error: it asks for nothing beyond the mandatory
+        // fields, exactly as zero does.
         let mut p = params(ReceivedStats::Both, StampAt::Both, Clock::Both);
-        p.length = 20;
-        assert_eq!(echo_packet_len(false, &p).unwrap(), 60);
-        p.length = 92;
-        assert_eq!(echo_packet_len(false, &p).unwrap(), 92);
-    }
-
-    #[test]
-    fn checked_packet_len_rejects_negative_requested_length() {
-        let mut p = params(ReceivedStats::Both, StampAt::Both, Clock::Both);
-        p.length = -1;
-
-        assert_eq!(
-            echo_packet_len(false, &p),
-            Err(ProtoError::NegativePacketLength { length: -1 })
-        );
-    }
-
-    #[test]
-    fn checked_packet_len_preserves_non_negative_header_floor() {
-        let mut p = params(ReceivedStats::Both, StampAt::Both, Clock::Both);
-        p.length = 0;
-        assert_eq!(echo_packet_len(false, &p), Ok(60));
-
-        p.length = 92;
-        assert_eq!(echo_packet_len(false, &p), Ok(92));
+        for (length, expected) in [(-4096, 60), (-1, 60), (0, 60), (20, 60), (92, 92)] {
+            p.length = length;
+            assert_eq!(
+                echo_packet_len(false, &p),
+                expected,
+                "unexpected packet length for negotiated length {length}"
+            );
+        }
     }
 }

crates/irtt-proto/src/request.rs

@@ -84,8 +84,8 @@ pub enum DecodedRequestKind<'a> {
 /// # Errors
 ///
 /// Returns [`ProtoError::PayloadTooLarge`] when an ECHO payload does not fit
-/// the negotiated length, and [`ProtoError::NegativePacketLength`] when the
-/// negotiated length is negative.
+/// the negotiated length. A negative negotiated length is not an error: see
+/// [`echo_packet_len`], which floors it at the mandatory field block.
 pub fn encode_request(request: RequestToEncode<'_>, hmac_key: Option<&[u8]>) -> Result<Vec<u8>> {
     match request {
         RequestToEncode::Open { params, no_test } => encode_open(params, no_test, hmac_key),
@@ -205,7 +205,7 @@ fn encode_echo(
     hmac_key: Option<&[u8]>,
 ) -> Result<Vec<u8>> {
     let layout = PacketLayout::echo(hmac_key.is_some(), params);
-    let len = echo_packet_len(hmac_key.is_some(), params)?;
+    let len = echo_packet_len(hmac_key.is_some(), params);
     let payload_offset = layout.header_len();
     let available_payload_len = len.saturating_sub(payload_offset);
     if payload.len() > available_payload_len {