fix(net): Bound the transport checksum by the network header's length

[daniel-noland]

The defect

Packet::new kept everything after the parsed headers as the payload, and nothing ever trimmed the buffer to the IPv4 total length / IPv6 payload length (TrimFromEnd existed but was never called). do_serialize then handed that whole slice to the checksum code, so ethernet padding was summed as if it were L4 payload.

Ethernet pads frames out to 64 octets including the Ethernet header, so any IPv4 frame under that was affected:

protocol	pseudo header length source	effect of padding
TCP	header_len + payload.len()	always wrong, off by the pad length, even for zeroed padding
ICMPv6	payload.len() + header_len	same, but IPv6 frames are ≥ 62 octets so rarely padded
UDP	the UDP header's own length field	wrong only when the padding is non-zero
ICMPv4	no length in the checksum	wrong only when the padding is non-zero

The sharp edge is IPv4 TCP: a bare ACK, RST, FIN, or option-less SYN is 54 octets on the wire. Every one of those this dataplane forwarded left with a checksum the far end drops. Flows carrying TCP timestamps produce 66-octet frames and escaped.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5ccde373-fea6-46a3-b8ce-a3846e9234ff

📥 Commits

Reviewing files that changed from the base of the PR and between a2916ca and f41630d.

📒 Files selected for processing (2)

• net/src/headers/mod.rs
• net/src/packet/mod.rs

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

Changes

Checksum payload bounds

Layer / File(s)	Summary
Transport payload length contract net/src/headers/mod.rs	Adds Headers::transport_payload_len for IPv4 and IPv6 payload bounds. Documents its use for checksum updates.
Checksum update integration and tests net/src/packet/mod.rs	Bounds checksum input to the declared transport payload when available. Preserves truncated-packet handling. Tests TCP, UDP, and ICMPv4 padding and payload cases.

Suggested reviewers: sergeymatov, fredi-raspall, qmonnet

Merge Risk: ⚪ Minimal · up to f4163

The PR bounds transport checksum calculations to the network packet length so Ethernet padding is not included. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: bounding transport checksum input by the network header length.
Description check	✅ Passed	The description directly explains the checksum defect, its cause, affected protocols, and the intended fix.
Docstring Coverage	✅ Passed	Docstring coverage is 94.12% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[mvachhar]

Do we want to have a fix for the serializer when there is a short payload or is that a separate PR?

[mvachhar]

Oh, and FYI, the commit message is just wrong. 802.3 includes the header in the frame and size, so the threshold is not a frame size of 60 bytes, but a frame size of 64 bytes. I didn't check its numbers on the IP packet size. Annoying. Fix if you want, I won't hold up the PR for it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.