bacnet-encoding 0.13.0

//! NPDU encoding and decoding per ASHRAE 135-2020 Clause 6.
//!
//! The Network Protocol Data Unit carries either an application-layer APDU
//! or a network-layer message, with optional source/destination routing
//! information for multi-hop BACnet internetworks.
//!
//! Both directions hold DADR and SADR to [`NpduAddress::MAX_MAC_LEN`] octets
//! (#1141), so the router, the non-router network layer and everything above
//! them only ever see an address that some data link could carry.

use bacnet_types::constructed::BACnetAddress;
use bacnet_types::enums::{NetworkPriority, RejectMessageReason};
use bacnet_types::error::Error;
use bacnet_types::MacAddr;
use bytes::{BufMut, Bytes, BytesMut};

mod decode_error;
pub use decode_error::{NpduAddressField, NpduDecodeError};

/// BACnet protocol version (always 1).
pub const BACNET_PROTOCOL_VERSION: u8 = 1;

// ---------------------------------------------------------------------------
// Address used in NPDU routing fields
// ---------------------------------------------------------------------------

/// Network-layer address: network number + MAC address.
///
/// Used for source/destination fields in routed NPDUs.
#[derive(Debug, Clone, PartialEq, Eq, Hash)]
pub struct NpduAddress {
    /// Network number (1-65534, or 0xFFFF for global broadcast destination).
    pub network: u16,
    /// MAC-layer address (variable length, empty for broadcast).
    pub mac_address: MacAddr,
}

impl NpduAddress {
    /// The longest DADR or SADR, in octets, the codec encodes or decodes
    /// (#1141). It is the same limit as [`BACnetAddress::MAX_MAC_LEN`].
    ///
    /// A length octet could announce up to 255 octets, yet no standard data
    /// link in Table 6-2 (Clause 6.2.2.2) needs more than 7, and the longest
    /// MAC this stack serves is 6 octets (a B/IPv6 node's is its 3-octet
    /// VMAC). The bound is the defensive 18 of [`BACnetAddress::MAX_MAC_LEN`].
    /// A longer DLEN or SLEN names no node on a standard data link or on any
    /// data link this stack serves.
    pub const MAX_MAC_LEN: usize = BACnetAddress::MAX_MAC_LEN;
}

// ---------------------------------------------------------------------------
// NPDU struct
// ---------------------------------------------------------------------------

/// Decoded Network Protocol Data Unit (Clause 6.2).
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Npdu {
    /// Whether this is a network-layer message (vs application-layer APDU).
    pub is_network_message: bool,
    /// Whether the sender expects a reply.
    pub expecting_reply: bool,
    /// Message priority.
    pub priority: NetworkPriority,
    /// Remote destination address, if routed.
    pub destination: Option<NpduAddress>,
    /// Originating source address (populated by routers).
    pub source: Option<NpduAddress>,
    /// Remaining hop count for routed messages (0-255).
    pub hop_count: u8,
    /// Network message type (when `is_network_message` is true).
    pub message_type: Option<u8>,
    /// Vendor ID for proprietary network messages (message_type >= 0x80).
    pub vendor_id: Option<u16>,
    /// Payload: either APDU bytes or network message data.
    pub payload: Bytes,
}

/// Decoded payload of a Reject-Message-To-Network control message.
///
/// The enclosing NPDU identifies the network-message type; this type models
/// only the fixed reason/DNET payload used by that message.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct RejectMessageToNetwork {
    /// Why the router rejected the message.
    pub reason: RejectMessageReason,
    /// Destination network named by the rejection.
    pub dnet: u16,
}

impl Default for Npdu {
    fn default() -> Self {
        Self {
            is_network_message: false,
            expecting_reply: false,
            priority: NetworkPriority::NORMAL,
            destination: None,
            source: None,
            hop_count: 255,
            message_type: None,
            vendor_id: None,
            payload: Bytes::new(),
        }
    }
}

// ---------------------------------------------------------------------------
// Encoding
// ---------------------------------------------------------------------------

/// Encode an NPDU to wire format.
pub fn encode_npdu(buf: &mut BytesMut, npdu: &Npdu) -> Result<(), Error> {
    buf.put_u8(BACNET_PROTOCOL_VERSION);

    let mut control: u8 = npdu.priority.to_raw() & 0x03;
    if npdu.is_network_message {
        control |= 0x80;
    }
    if npdu.destination.is_some() {
        control |= 0x20;
    }
    if npdu.source.is_some() {
        control |= 0x08;
    }
    if npdu.expecting_reply {
        control |= 0x04;
    }
    buf.put_u8(control);

    if let Some(dest) = &npdu.destination {
        if dest.network == 0 {
            return Err(Error::Encoding("NPDU DNET must not be 0".into()));
        }
        buf.put_u16(dest.network);
        check_encoded_len(NpduAddressField::Destination, &dest.mac_address)?;
        buf.put_u8(dest.mac_address.len() as u8);
        buf.put_slice(&dest.mac_address);
    }

    if let Some(src) = &npdu.source {
        if src.network == 0 || src.network == 0xFFFF {
            return Err(Error::Encoding(format!(
                "NPDU SNET must be 1..65534, got {}",
                src.network
            )));
        }
        if src.mac_address.is_empty() {
            return Err(Error::Encoding("NPDU SLEN must not be 0".into()));
        }
        buf.put_u16(src.network);
        check_encoded_len(NpduAddressField::Source, &src.mac_address)?;
        buf.put_u8(src.mac_address.len() as u8);
        buf.put_slice(&src.mac_address);
    }

    if npdu.destination.is_some() {
        buf.put_u8(npdu.hop_count);
    }

    if npdu.is_network_message {
        if let Some(msg_type) = npdu.message_type {
            buf.put_u8(msg_type);
            if msg_type >= 0x80 {
                buf.put_u16(npdu.vendor_id.unwrap_or(0));
            }
        }
    }

    buf.put_slice(&npdu.payload);

    Ok(())
}

/// Refuse to encode a DADR or SADR that the decoder would refuse (#1141).
fn check_encoded_len(field: NpduAddressField, mac: &[u8]) -> Result<(), Error> {
    if mac.len() > NpduAddress::MAX_MAC_LEN {
        return Err(Error::Encoding(format!(
            "NPDU {field} address of {} octets exceeds the {}-octet limit",
            mac.len(),
            NpduAddress::MAX_MAC_LEN
        )));
    }
    Ok(())
}

// ---------------------------------------------------------------------------
// Decoding
// ---------------------------------------------------------------------------

/// Decode an NPDU from raw bytes.
///
/// Returns the decoded [`Npdu`]. The `payload` field contains either the
/// APDU bytes or network message data.
///
/// A DLEN or SLEN past [`NpduAddress::MAX_MAC_LEN`] fails with
/// [`NpduDecodeError::AddressTooLong`], raised without reading the address
/// octets, so a caller can tell it apart from every other malformation
/// ([`NpduDecodeError::Malformed`]). For an over-long DADR the error still
/// carries the SNET/SADR behind it, when the frame holds a valid one, so a
/// router can address its reject (#1158).
pub fn decode_npdu(data: Bytes) -> Result<Npdu, NpduDecodeError> {
    if data.len() < 2 {
        return Err(Error::buffer_too_short(2, data.len()).into());
    }

    let version = data[0];
    if version != BACNET_PROTOCOL_VERSION {
        return Err(
            Error::decoding(0, format!("unsupported BACnet protocol version: {version}")).into(),
        );
    }

    let control = data[1];
    let is_network_message = control & 0x80 != 0;
    let has_destination = control & 0x20 != 0;
    let has_source = control & 0x08 != 0;
    let expecting_reply = control & 0x04 != 0;
    let priority = NetworkPriority::from_raw(control & 0x03);

    // Only hosted builds log; tracing is a std-only dependency.
    #[cfg(feature = "std")]
    if control & 0x50 != 0 {
        tracing::warn!(
            control_byte = control,
            "NPDU control byte has reserved bits set (bits 4 or 6)"
        );
    }

    let mut offset = 2;
    let mut destination = None;
    let mut source = None;
    let mut hop_count: u8 = 255;

    if has_destination {
        if offset + 3 > data.len() {
            return Err(Error::decoding(offset, "NPDU too short for destination fields").into());
        }
        let dnet = u16::from_be_bytes([data[offset], data[offset + 1]]);
        if dnet == 0 {
            return Err(Error::decoding(offset, "NPDU destination network 0 is invalid").into());
        }
        offset += 2;
        let dlen = data[offset];
        offset += 1;
        let dadr = match decode_address(&data, offset, NpduAddressField::Destination, dlen, dnet) {
            Ok(dadr) => dadr,
            Err(mut refused) => {
                if let NpduDecodeError::AddressTooLong { source, .. } = &mut refused {
                    *source = has_source
                        .then(|| source_behind(&data, offset + usize::from(dlen)))
                        .flatten();
                }
                return Err(refused);
            }
        };
        offset += dadr.len();

        destination = Some(NpduAddress {
            network: dnet,
            mac_address: dadr,
        });
    }

    if has_source {
        if offset + 3 > data.len() {
            return Err(Error::decoding(offset, "NPDU too short for source fields").into());
        }
        let snet = u16::from_be_bytes([data[offset], data[offset + 1]]);
        if snet == 0 {
            return Err(Error::decoding(offset, "NPDU source network 0 is invalid").into());
        }
        if snet == 0xFFFF {
            return Err(Error::decoding(offset, "NPDU source network 0xFFFF is invalid").into());
        }
        offset += 2;
        let slen = data[offset];
        offset += 1;

        if slen == 0 {
            return Err(Error::decoding(offset - 1, "NPDU source SLEN=0 is invalid").into());
        }
        let dnet = destination.as_ref().map(|d| d.network);
        let sadr = decode_address(&data, offset, NpduAddressField::Source, slen, dnet)?;
        offset += sadr.len();

        source = Some(NpduAddress {
            network: snet,
            mac_address: sadr,
        });
    }

    if has_destination {
        if offset >= data.len() {
            return Err(Error::decoding(offset, "NPDU too short for hop count").into());
        }
        hop_count = data[offset];
        offset += 1;
    }

    let mut message_type = None;
    let mut vendor_id = None;

    if is_network_message {
        if offset >= data.len() {
            return Err(Error::decoding(offset, "NPDU too short for network message type").into());
        }
        let msg_type = data[offset];
        offset += 1;
        message_type = Some(msg_type);

        if msg_type >= 0x80 {
            if offset + 2 > data.len() {
                return Err(
                    Error::decoding(offset, "NPDU too short for proprietary vendor ID").into(),
                );
            }
            vendor_id = Some(u16::from_be_bytes([data[offset], data[offset + 1]]));
            offset += 2;
        }
    }

    let payload = data.slice(offset..);

    Ok(Npdu {
        is_network_message,
        expecting_reply,
        priority,
        destination,
        source,
        hop_count,
        message_type,
        vendor_id,
        payload,
    })
}

/// Read the `length`-octet DADR or SADR at `offset`. A length past
/// [`NpduAddress::MAX_MAC_LEN`] is refused before any address octet is read,
/// whether or not the frame holds that many (#1141).
fn decode_address(
    data: &[u8],
    offset: usize,
    field: NpduAddressField,
    length: u8,
    dnet: impl Into<Option<u16>>,
) -> Result<MacAddr, NpduDecodeError> {
    if usize::from(length) > NpduAddress::MAX_MAC_LEN {
        return Err(NpduDecodeError::AddressTooLong {
            field,
            length,
            dnet: dnet.into(),
            source: None,
        });
    }
    let end = offset + usize::from(length);
    if end > data.len() {
        return Err(Error::decoding(
            offset,
            format!(
                "NPDU {field} address truncated: {}={length}",
                field.length_octet()
            ),
        )
        .into());
    }
    Ok(MacAddr::from_slice(&data[offset..end]))
}

/// The SNET/SADR that starts at `offset`, behind a DADR too long to decode.
///
/// A router answers such an NPDU with a reject addressed to its original
/// source (#1158), so the source is read past the DLEN octets the frame
/// announces. Only a source the decoder would accept counts: a usable SNET, an
/// SLEN within the bound and every SADR octet present.
fn source_behind(data: &[u8], offset: usize) -> Option<NpduAddress> {
    let header = data.get(offset..offset + 3)?;
    let network = u16::from_be_bytes([header[0], header[1]]);
    let length = usize::from(header[2]);
    if network == 0 || network == 0xFFFF || length == 0 || length > NpduAddress::MAX_MAC_LEN {
        return None;
    }
    let sadr = data.get(offset + 3..offset + 3 + length)?;
    Some(NpduAddress {
        network,
        mac_address: MacAddr::from_slice(sadr),
    })
}

/// Decode the fixed three-octet Reject-Message-To-Network payload.
///
/// The payload is rejected unless it contains exactly one reason octet and
/// one two-octet destination network. Callers remain responsible for checking
/// that the enclosing NPDU is the standard Reject-Message-To-Network type.
pub fn decode_reject_message_to_network(payload: &[u8]) -> Result<RejectMessageToNetwork, Error> {
    if payload.len() != 3 {
        return Err(Error::decoding(
            0,
            format!(
                "Reject-Message-To-Network payload must be exactly 3 octets, got {}",
                payload.len()
            ),
        ));
    }
    Ok(RejectMessageToNetwork {
        reason: RejectMessageReason::from_raw(payload[0]),
        dnet: u16::from_be_bytes([payload[1], payload[2]]),
    })
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod address_bound_tests;

#[cfg(test)]
mod tests {
    use super::*;

    fn encode_to_vec(npdu: &Npdu) -> Vec<u8> {
        let mut buf = BytesMut::with_capacity(64);
        encode_npdu(&mut buf, npdu).unwrap();
        buf.to_vec()
    }

    #[test]
    fn minimal_local_apdu() {
        // Simplest case: local, no routing, with APDU payload
        let npdu = Npdu {
            payload: Bytes::from_static(&[0x10, 0x08]), // UnconfirmedRequest WhoIs
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        // version=1, control=0x00 (normal priority, no flags), payload
        assert_eq!(encoded, vec![0x01, 0x00, 0x10, 0x08]);

        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn expecting_reply_flag() {
        let npdu = Npdu {
            expecting_reply: true,
            payload: Bytes::from_static(&[0xAA]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        assert_eq!(encoded[1], 0x04); // control: expecting_reply bit
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert!(decoded.expecting_reply);
    }

    #[test]
    fn priority_encoding() {
        for (prio, expected_bits) in [
            (NetworkPriority::NORMAL, 0x00),
            (NetworkPriority::URGENT, 0x01),
            (NetworkPriority::CRITICAL_EQUIPMENT, 0x02),
            (NetworkPriority::LIFE_SAFETY, 0x03),
        ] {
            let npdu = Npdu {
                priority: prio,
                payload: Bytes::new(),
                ..Default::default()
            };
            let encoded = encode_to_vec(&npdu);
            assert_eq!(encoded[1] & 0x03, expected_bits);
            let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
            assert_eq!(decoded.priority, prio);
        }
    }

    #[test]
    fn destination_only_round_trip() {
        let npdu = Npdu {
            destination: Some(NpduAddress {
                network: 1000,
                mac_address: MacAddr::from_slice(&[0x0A, 0x00, 0x01, 0x01, 0xBA, 0xC0]),
            }),
            hop_count: 254,
            payload: Bytes::from_static(&[0x10, 0x08]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        // control: has_destination = 0x20
        assert_eq!(encoded[1] & 0x20, 0x20);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn destination_broadcast() {
        // Global broadcast: DNET=0xFFFF, DLEN=0 (no DADR)
        let npdu = Npdu {
            destination: Some(NpduAddress {
                network: 0xFFFF,
                mac_address: MacAddr::new(),
            }),
            hop_count: 255,
            payload: Bytes::from_static(&[0x10, 0x08]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        // version(1) + control(1) + DNET(2) + DLEN(1) + hop_count(1) + payload(2)
        assert_eq!(encoded.len(), 8);
        // DNET = 0xFFFF
        assert_eq!(&encoded[2..4], &[0xFF, 0xFF]);
        // DLEN = 0
        assert_eq!(encoded[4], 0);

        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn source_only_round_trip() {
        let npdu = Npdu {
            source: Some(NpduAddress {
                network: 500,
                mac_address: MacAddr::from_slice(&[0x01]),
            }),
            payload: Bytes::from_static(&[0x30, 0x01, 0x0C]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        // control: has_source = 0x08
        assert_eq!(encoded[1] & 0x08, 0x08);
        // No hop count (no destination)
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn source_and_destination_round_trip() {
        let npdu = Npdu {
            expecting_reply: true,
            destination: Some(NpduAddress {
                network: 2000,
                mac_address: MacAddr::from_slice(&[0x0A, 0x00, 0x02, 0x01, 0xBA, 0xC0]),
            }),
            source: Some(NpduAddress {
                network: 1000,
                mac_address: MacAddr::from_slice(&[0x0A, 0x00, 0x01, 0x01, 0xBA, 0xC0]),
            }),
            hop_count: 250,
            payload: Bytes::from_static(&[0x00, 0x05, 0x01, 0x0C]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        // control: destination(0x20) | source(0x08) | expecting_reply(0x04) = 0x2C
        assert_eq!(encoded[1], 0x2C);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn network_message_round_trip() {
        let npdu = Npdu {
            is_network_message: true,
            message_type: Some(0x01), // I-Am-Router-To-Network
            payload: Bytes::from_static(&[0x03, 0xE8]), // network 1000
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        // control: network_message = 0x80
        assert_eq!(encoded[1] & 0x80, 0x80);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn reject_message_to_network_payload_decodes_typed_reason_and_dnet() {
        let decoded = decode_reject_message_to_network(&[
            RejectMessageReason::MESSAGE_TOO_LONG.to_raw(),
            0x12,
            0x34,
        ])
        .unwrap();
        assert_eq!(decoded.reason, RejectMessageReason::MESSAGE_TOO_LONG);
        assert_eq!(decoded.dnet, 0x1234);
    }

    #[test]
    fn reject_message_to_network_payload_requires_exact_length() {
        for payload in [&[][..], &[4, 0][..], &[4, 0, 1, 2][..]] {
            assert!(decode_reject_message_to_network(payload).is_err());
        }
    }

    #[test]
    fn proprietary_network_message_round_trip() {
        let npdu = Npdu {
            is_network_message: true,
            message_type: Some(0x80), // Proprietary range
            vendor_id: Some(999),
            payload: Bytes::from_static(&[0xDE, 0xAD]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn wire_format_who_is_broadcast() {
        // Real-world WhoIs global broadcast:
        // Version=1, Control=0x20 (dest present), DNET=0xFFFF, DLEN=0,
        // HopCount=255, APDU=[0x10, 0x08]
        let wire = [0x01, 0x20, 0xFF, 0xFF, 0x00, 0xFF, 0x10, 0x08];
        let decoded = decode_npdu(Bytes::copy_from_slice(&wire)).unwrap();
        assert!(!decoded.is_network_message);
        assert!(!decoded.expecting_reply);
        assert_eq!(decoded.priority, NetworkPriority::NORMAL);
        assert_eq!(
            decoded.destination,
            Some(NpduAddress {
                network: 0xFFFF,
                mac_address: MacAddr::new(),
            })
        );
        assert!(decoded.source.is_none());
        assert_eq!(decoded.hop_count, 255);
        assert_eq!(decoded.payload, vec![0x10, 0x08]);

        // Re-encode should match
        let reencoded = encode_to_vec(&decoded);
        assert_eq!(reencoded, wire);
    }

    #[test]
    fn decode_too_short() {
        assert!(decode_npdu(Bytes::new()).is_err());
        assert!(decode_npdu(Bytes::from_static(&[0x01])).is_err());
    }

    #[test]
    fn decode_wrong_version() {
        assert!(decode_npdu(Bytes::from_static(&[0x02, 0x00])).is_err());
    }

    #[test]
    fn decode_truncated_destination() {
        // Has destination flag but not enough bytes
        assert!(decode_npdu(Bytes::from_static(&[0x01, 0x20, 0xFF])).is_err());
    }

    #[test]
    fn decode_truncated_source() {
        // Has source flag but not enough bytes after destination
        assert!(decode_npdu(Bytes::from_static(&[0x01, 0x08, 0x00])).is_err());
    }

    // --- NPDU edge case tests ---

    #[test]
    fn npdu_network_zero() {
        // DNET=0 is invalid per Clause 6.2.2 — rejected at encode time
        let npdu = Npdu {
            destination: Some(NpduAddress {
                network: 0,
                mac_address: MacAddr::from_slice(&[0x01]),
            }),
            hop_count: 255,
            payload: Bytes::from_static(&[0x10, 0x08]),
            ..Default::default()
        };
        let mut buf = BytesMut::new();
        let result = encode_npdu(&mut buf, &npdu);
        assert!(result.is_err());
        let err = format!("{}", result.unwrap_err());
        assert!(err.contains("DNET"), "got: {err}");
    }

    #[test]
    fn npdu_network_fffe() {
        // 0xFFFE is the max non-broadcast network number
        // (0xFFFF is broadcast, 0xFFFE is the largest valid unicast network)
        let npdu = Npdu {
            destination: Some(NpduAddress {
                network: 0xFFFE,
                mac_address: MacAddr::from_slice(&[0x01, 0x02]),
            }),
            hop_count: 200,
            payload: Bytes::from_static(&[0xAA]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded.destination.as_ref().unwrap().network, 0xFFFE);
        assert_eq!(decoded.hop_count, 200);
    }

    #[test]
    fn npdu_hop_count_zero() {
        // Hop count 0 is valid (means don't forward further)
        let npdu = Npdu {
            destination: Some(NpduAddress {
                network: 1000,
                mac_address: MacAddr::new(),
            }),
            hop_count: 0,
            payload: Bytes::from_static(&[0x10, 0x08]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded.hop_count, 0);
    }

    #[test]
    fn npdu_source_with_empty_mac() {
        // SLEN=0 is invalid for source per Clause 6.2.2 — rejected at encode time
        let npdu = Npdu {
            source: Some(NpduAddress {
                network: 500,
                mac_address: MacAddr::new(),
            }),
            payload: Bytes::from_static(&[0xBB]),
            ..Default::default()
        };
        let mut buf = BytesMut::new();
        let result = encode_npdu(&mut buf, &npdu);
        assert!(result.is_err());
        let err = format!("{}", result.unwrap_err());
        assert!(err.contains("SLEN"), "got: {err}");
    }

    #[test]
    fn npdu_destination_dlen_zero_broadcast_accepted() {
        // DLEN=0 is valid for destination (broadcast) per Clause 6.2.2
        let npdu = Npdu {
            destination: Some(NpduAddress {
                network: 0xFFFF,
                mac_address: MacAddr::new(),
            }),
            hop_count: 255,
            payload: Bytes::from_static(&[0x10, 0x08]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded.destination.as_ref().unwrap().network, 0xFFFF);
        assert!(decoded.destination.as_ref().unwrap().mac_address.is_empty());
    }

    #[test]
    fn npdu_destination_truncated_mac() {
        // DNET + DLEN present but MAC bytes are short
        // Version=1, Control=0x20 (dest present), DNET=1000, DLEN=6, only 2 MAC bytes
        let data = [0x01, 0x20, 0x03, 0xE8, 0x06, 0x01, 0x02];
        assert!(decode_npdu(Bytes::copy_from_slice(&data)).is_err());
    }

    #[test]
    fn npdu_source_truncated_mac() {
        // Source present but MAC bytes truncated
        let data = [0x01, 0x08, 0x01, 0xF4, 0x04, 0x01]; // SNET=500, SLEN=4, only 1 byte
        assert!(decode_npdu(Bytes::copy_from_slice(&data)).is_err());
    }

    #[test]
    fn npdu_missing_hop_count() {
        // Destination present but data ends before hop count
        // Version=1, Control=0x20, DNET=0xFFFF, DLEN=0
        let data = [0x01, 0x20, 0xFF, 0xFF, 0x00];
        assert!(decode_npdu(Bytes::copy_from_slice(&data)).is_err());
    }

    #[test]
    fn npdu_network_message_truncated_type() {
        // Network message flag set but no message type byte
        let data = [0x01, 0x80]; // is_network_message = true, but no type byte
        assert!(decode_npdu(Bytes::copy_from_slice(&data)).is_err());
    }

    #[test]
    fn npdu_proprietary_message_truncated_vendor() {
        // Proprietary message type (>=0x80) but vendor ID missing
        let data = [0x01, 0x80, 0x80]; // msg_type=0x80, need 2 more bytes for vendor
        assert!(decode_npdu(Bytes::copy_from_slice(&data)).is_err());
    }

    #[test]
    fn npdu_all_flags_round_trip() {
        // Maximum complexity: all flags set
        let npdu = Npdu {
            is_network_message: false,
            expecting_reply: true,
            priority: NetworkPriority::LIFE_SAFETY,
            destination: Some(NpduAddress {
                network: 2000,
                mac_address: MacAddr::from_slice(&[0x0A, 0x00, 0x02, 0x01, 0xBA, 0xC0]),
            }),
            source: Some(NpduAddress {
                network: 1000,
                mac_address: MacAddr::from_slice(&[0x0A, 0x00, 0x01, 0x01, 0xBA, 0xC0]),
            }),
            hop_count: 127,
            payload: Bytes::from_static(&[0xDE, 0xAD, 0xBE, 0xEF]),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert_eq!(decoded, npdu);
    }

    #[test]
    fn npdu_empty_payload() {
        // No payload at all
        let npdu = Npdu {
            payload: Bytes::new(),
            ..Default::default()
        };
        let encoded = encode_to_vec(&npdu);
        let decoded = decode_npdu(Bytes::from(encoded)).unwrap();
        assert!(decoded.payload.is_empty());
    }

    #[test]
    fn reject_snet_zero() {
        // Source network 0 is invalid per Clause 6.2.2 — rejected at encode time
        let npdu = Npdu {
            source: Some(NpduAddress {
                network: 0,
                mac_address: MacAddr::from_slice(&[0x01]),
            }),
            payload: Bytes::from_static(&[0x10, 0x08]),
            ..Default::default()
        };
        let mut buf = BytesMut::new();
        let result = encode_npdu(&mut buf, &npdu);
        assert!(result.is_err());
        let err = format!("{}", result.unwrap_err());
        assert!(err.contains("SNET"), "got: {err}");
    }

    #[test]
    fn reserved_bits_warning_still_decodes() {
        // Reserved bits set in control byte should NOT cause decode failure
        // (warning only). Construct wire bytes manually with reserved bit 6 set.
        let mut data = vec![0x01, 0x40]; // version=1, control with reserved bit 6
        data.extend_from_slice(&[0x10, 0x08]);

        // Should decode successfully (warning only, not error)
        let result = decode_npdu(Bytes::copy_from_slice(&data));
        assert!(
            result.is_ok(),
            "reserved bits should not cause decode failure"
        );
    }
}