base red: cmux-wg-tun reads its buffers without indexing (panic ratchet indexing_slicing 4 > 0, new crate)

Merged
LA
2d ago
+7-7

Summary

The tip panic ratchet is red: cmux-wg-tun: clippy::indexing_slicing 4 > new crate (must be 0) (fleet job e3cabfe8f3a4526406d20a58). cmux-wg-tun came in lawrencecchen's direct push ad2c76731f28..cc33e089376e (commits b4f6d32a9a37 and d2b1b1c70ac5).

Neither #34198 (the revert, which keeps the Rust crate) nor #34204 (the extension forward fix) changes this crate, so this PR fixes the red alone. It does not depend on either of them.

The four indexes now read with get(), with no allow:

  • utun.rs interface_name: the name takes the whole buffer when the kernel reports a longer length (as the old min() did) and ends at its first NUL.
  • engine.rs drain_tun: a packet range outside the frame buffer, or an empty one, skips that packet.
  • engine.rs drain_socket: a datagram length outside its buffer stops the burst instead of panicking.

Behavior inside the bounds is unchanged.

Changelog

none

Testing

  • python3 scripts/cmux-next/prepush-gate.py: no new violations.
  • Fleet, macOS: cmux-tui-rust-check.sh test engine::tests::, step f74200465feb95b217cf67d8, green. It ran all 6 cmux-wg-tun tests (engine::tests::*) among 35 matched. 5 passed in the full run. a_socketpair_is_not_mistaken_for_utun failed in the full run and passed alone (nextest FLAKY). That test calls only interface_name, whose result this PR leaves unchanged for every in-bounds length, so the flake is in the crate from the push and not from this change; the crate owner must fix it. An earlier step a809c4f688e9 used the filter cmux_wg_tun, which selected 0 tests (exit 4) and proved nothing.
  • Fleet, Linux: panic ratchet cmux-tui-rust-check.sh panic, step 16044e3cf8c0c17c9078de52. Result in a comment.

Observed / Not run

  • Observed: the prepush gate; fleet results in the comment.
  • Not run: a live tunnel.

Autofix with [code]smith
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes the clippy::indexing_slicing panic ratchet violation in cmux-wg-tun by replacing direct slice indexing with get() reads, so the new crate meets the required zero-violation budget.

  • The utun interface name now takes the whole buffer when the kernel reports a longer length and ends at its first NUL.
  • Packet ranges or datagram lengths outside their buffer now skip that read instead of panicking.
  • Behavior inside the buffer bounds is unchanged.