Got rid of usages of Except and simplified Message.h

admin/Admin.c

@@ -117,7 +117,7 @@ static void sendMessage(struct Message* message, struct Sockaddr* dest, struct A
 {
     // stack overflow when used with admin logger.
     //Log_keys(admin->logger, "sending message to angel [%s]", message->bytes);
-    Message_push(message, dest, dest->addrLen, NULL);
+    Er_assert(Message_epush(message, dest, dest->addrLen));
     Iface_send(&admin->iface, message);
 }
 
@@ -128,9 +128,9 @@ static void sendBenc(Dict* message,
                      int fd)
 {
     Message_reset(admin->tempSendMsg);
-    BencMessageWriter_write(message, admin->tempSendMsg, NULL);
+    Er_assert(BencMessageWriter_write(message, admin->tempSendMsg));
     struct Message* msg = Message_new(0, admin->tempSendMsg->length + 32, alloc);
-    Message_push(msg, admin->tempSendMsg->bytes, admin->tempSendMsg->length, NULL);
+    Er_assert(Message_epush(msg, admin->tempSendMsg->bytes, admin->tempSendMsg->length));
     Message_setAssociatedFd(msg, fd);
     sendMessage(msg, dest, admin);
 }
@@ -457,7 +457,7 @@ static void handleMessage(struct Message* message,
     }
 
     // put the data back in the front of the message because it is used by the auth checker.
-    Message_shift(message, origMessageLen, NULL);
+    Er_assert(Message_eshift(message, origMessageLen));
 
     handleRequest(messageDict, message, src, alloc, admin);
 }
@@ -466,7 +466,7 @@ static Iface_DEFUN receiveMessage(struct Message* message, struct Iface* iface)
 {
     struct Admin_pvt* admin = Identity_containerOf(iface, struct Admin_pvt, iface);
     struct Allocator* alloc = Allocator_child(admin->allocator);
-    struct Sockaddr* addrPtr = AddrIface_popAddr(message, NULL);
+    struct Sockaddr* addrPtr = Er_assert(AddrIface_popAddr(message));
 
     admin->currentRequest = message;
     handleMessage(message, Sockaddr_clone(addrPtr, alloc), alloc, admin);

admin/angel/Core.c

@@ -458,7 +458,7 @@ int Core_main(int argc, char** argv)
     struct Message* preConf =
         InterfaceWaiter_waitForData(&clientPipe->iface.iface, eventBase, tempAlloc, eh);
     Log_debug(logger, "Finished getting pre-configuration from client");
-    struct Sockaddr* addr = Sockaddr_clone(AddrIface_popAddr(preConf, eh), tempAlloc);
+    struct Sockaddr* addr = Sockaddr_clone(Er_assert(AddrIface_popAddr(preConf)), tempAlloc);
     Dict* config = Except_er(eh, BencMessageReader_read(preConf, tempAlloc));
 
     String* privateKeyHex = Dict_getStringC(config, "privateKey");
@@ -524,8 +524,8 @@ int Core_main(int argc, char** argv)
     ));
     // This always times out because the angel doesn't respond.
     struct Message* clientResponse = Message_new(0, 512, tempAlloc);
-    BencMessageWriter_write(&response, clientResponse, eh);
-    AddrIface_pushAddr(clientResponse, addr, eh);
+    Er_assert(BencMessageWriter_write(&response, clientResponse));
+    Er_assert(AddrIface_pushAddr(clientResponse, addr));
     Iface_CALL(clientPipe->iface.iface.send, clientResponse, &clientPipe->iface.iface);
 
     Allocator_free(tempAlloc);

benc/serialization/standard/BencMessageWriter.c

@@ -18,80 +18,89 @@
 #include "benc/Dict.h"
 #include "benc/List.h"
 #include "benc/serialization/standard/BencMessageWriter.h"
-#include "exception/Except.h"
+#include "exception/Er.h"
 #include "wire/Message.h"
 #include "util/Base10.h"
 
-static void writeGeneric(Object* obj, struct Message* msg, struct Except* eh);
+static Er_DEFUN(void writeGeneric(Object* obj, struct Message* msg));
 
-static void writeListItems(struct List_Item* item, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeListItems(struct List_Item* item, struct Message* msg))
 {
-    if (!item) { return; }
-    writeListItems(item->next, msg, eh);
-    writeGeneric(item->elem, msg, eh);
+    if (!item) { Er_ret(); }
+    Er(writeListItems(item->next, msg));
+    Er(writeGeneric(item->elem, msg));
+    Er_ret();
 }
 
-static void writeList(List* l, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeList(List* l, struct Message* msg))
 {
-    Message_push8(msg, 'e', eh);
-    writeListItems(*l, msg, eh);
-    Message_push8(msg, 'l', eh);
+    Er(Message_epush8(msg, 'e'));
+    Er(writeListItems(*l, msg));
+    Er(Message_epush8(msg, 'l'));
+    Er_ret();
 }
 
-static void writeInt(int64_t num, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeInt(int64_t num, struct Message* msg))
 {
-    Message_push8(msg, 'e', eh);
-    Base10_write(msg, num, eh);
-    Message_push8(msg, 'i', eh);
+    Er(Message_epush8(msg, 'e'));
+    Er(Base10_write(msg, num));
+    Er(Message_epush8(msg, 'i'));
+    Er_ret();
 }
 
-static void writeString(String* str, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeString(String* str, struct Message* msg))
 {
-    Message_push(msg, str->bytes, str->len, eh);
-    Message_push8(msg, ':', eh);
-    Base10_write(msg, str->len, eh);
+    Er(Message_epush(msg, str->bytes, str->len));
+    Er(Message_epush8(msg, ':'));
+    Er(Base10_write(msg, str->len));
+    Er_ret();
 }
 
-static void writeDictEntries(struct Dict_Entry* entry, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeDictEntries(struct Dict_Entry* entry, struct Message* msg))
 {
-    if (!entry) { return; }
-    writeDictEntries(entry->next, msg, eh);
-    writeGeneric(entry->val, msg, eh);
-    writeString(entry->key, msg, eh);
+    if (!entry) { Er_ret(); }
+    Er(writeDictEntries(entry->next, msg));
+    Er(writeGeneric(entry->val, msg));
+    Er(writeString(entry->key, msg));
+    Er_ret();
 }
 
-static void writeDict(Dict* d, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeDict(Dict* d, struct Message* msg))
 {
-    Message_push8(msg, 'e', eh);
-    writeDictEntries(*d, msg, eh);
-    Message_push8(msg, 'd', eh);
+    Er(Message_epush8(msg, 'e'));
+    Er(writeDictEntries(*d, msg));
+    Er(Message_epush8(msg, 'd'));
+    Er_ret();
 }
 
-static void writeGeneric(Object* obj, struct Message* msg, struct Except* eh)
+static Er_DEFUN(void writeGeneric(Object* obj, struct Message* msg))
 {
     switch (obj->type) {
-        case Object_STRING:  writeString(obj->as.string, msg, eh); break;
-        case Object_DICT:    writeDict(obj->as.dictionary, msg, eh); break;
-        case Object_LIST:    writeList(obj->as.list, msg, eh); break;
-        case Object_INTEGER: writeInt(obj->as.number, msg, eh); break;
+        case Object_STRING:  Er(writeString(obj->as.string, msg)); break;
+        case Object_DICT:    Er(writeDict(obj->as.dictionary, msg)); break;
+        case Object_LIST:    Er(writeList(obj->as.list, msg)); break;
+        case Object_INTEGER: Er(writeInt(obj->as.number, msg)); break;
         default: Assert_failure("object of unknown type [%d]", obj->type);
     }
+    Er_ret();
 }
 
-void BencMessageWriter_write(Dict* toWrite, struct Message* msg, struct Except* eh)
+Er_DEFUN(void BencMessageWriter_write(Dict* toWrite, struct Message* msg))
 {
-    writeDict(toWrite, msg, eh);
+    Er(writeDict(toWrite, msg));
 
     // lucky
-    if (!((uintptr_t)msg->bytes % 8)) { return; }
+    if (!((uintptr_t)msg->bytes % 8)) { Er_ret(); }
 
-    Assert_true(Message_pop8(msg, eh) == 'd');
+    char d = Er(Message_epop8(msg));
+    Assert_true(d == 'd');
     Assert_true(msg->bytes[0] != 'e' && "Can't serialize empty messages");
     Assert_true(msg->bytes[0] >= '1' && msg->bytes[0] <= '9');
 
     // put the message into alignment by padding out the number with leading zeros :)
-    do { Message_push8(msg, '0', eh); } while ((uintptr_t)msg->bytes % 8);
+    do { Er(Message_epush8(msg, '0')); } while ((uintptr_t)msg->bytes % 8);
 
-    Message_pop8(msg, eh);
-    Message_push8(msg, 'd', eh);
+    Er(Message_epop8(msg));
+    Er(Message_epush8(msg, 'd'));
+    Er_ret();
 }

benc/serialization/standard/BencMessageWriter.h

@@ -21,6 +21,6 @@
 #include "util/Linker.h"
 Linker_require("benc/serialization/standard/BencMessageWriter.c");
 
-void BencMessageWriter_write(Dict* toWrite, struct Message* msg, struct Except* eh);
+Er_DEFUN(void BencMessageWriter_write(Dict* toWrite, struct Message* msg));
 
 #endif

client/AdminClient.c

@@ -90,7 +90,7 @@ static int calculateAuth(Dict* message,
 
     // serialize the message with the password hash
     struct Message* msg = Message_new(0, AdminClient_MAX_MESSAGE_SIZE, alloc);
-    BencMessageWriter_write(message, msg, NULL);
+    Er_assert(BencMessageWriter_write(message, msg));
 
     // calculate the hash of the message with the password hash
     crypto_hash_sha256(hash, msg->bytes, msg->length);
@@ -118,7 +118,7 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* addrIface)
     struct Context* ctx = Identity_containerOf(addrIface, struct Context, addrIface);
 
     struct Sockaddr_storage source;
-    Message_pop(msg, &source, ctx->targetAddr->addrLen, NULL);
+    Er_assert(Message_epop(msg, &source, ctx->targetAddr->addrLen));
     if (Bits_memcmp(&source, ctx->targetAddr, ctx->targetAddr->addrLen)) {
         Log_info(ctx->logger, "Got spurious message from [%s], expecting messages from [%s]",
                  Sockaddr_print(&source.addr, msg->alloc),
@@ -134,7 +134,7 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* addrIface)
     Dict* d = NULL;
     const char* err = BencMessageReader_readNoExcept(msg, alloc, &d);
     if (err) { return NULL; }
-    Message_shift(msg, origLen, NULL);
+    Er_assert(Message_eshift(msg, origLen));
 
     String* txid = Dict_getStringC(d, "txid");
     if (!txid || txid->len != 8) { return NULL; }
@@ -197,7 +197,7 @@ static struct Request* sendRaw(Dict* messageDict,
 
     struct Allocator* child = Allocator_child(req->alloc);
     struct Message* msg = Message_new(0, AdminClient_MAX_MESSAGE_SIZE + 256, child);
-    BencMessageWriter_write(messageDict, msg, NULL);
+    Er_assert(BencMessageWriter_write(messageDict, msg));
 
     req->timeoutAlloc = Allocator_child(req->alloc);
     req->timeout = Timeout_setTimeout(timeout,
@@ -209,7 +209,7 @@ static struct Request* sendRaw(Dict* messageDict,
 
     req->callback = callback;
 
-    Message_push(msg, ctx->targetAddr, ctx->targetAddr->addrLen, NULL);
+    Er_assert(Message_epush(msg, ctx->targetAddr, ctx->targetAddr->addrLen));
 
     Iface_send(&ctx->addrIface, msg);
     Allocator_free(child);

client/cjdroute2.c

@@ -564,7 +564,7 @@ static struct Message* readToMsg(FILE* f, struct Allocator* alloc)
     } while (c->length == Chunk_MAX_LEN);
     struct Message* out = Message_new(0, totalLength, alloc);
     while (c) {
-        Message_push(out, c->buf, c->length, NULL);
+        Er_assert(Message_epush(out, c->buf, c->length));
         c = c->next;
     }
     Allocator_free(child);
@@ -810,7 +810,7 @@ int main(int argc, char** argv)
     }
 
     struct Message* toCoreMsg = Message_new(0, 1024, allocator);
-    BencMessageWriter_write(preConf, toCoreMsg, eh);
+    Er_assert(BencMessageWriter_write(preConf, toCoreMsg));
     Iface_CALL(corePipe->iface.send, toCoreMsg, &corePipe->iface);
 
     Log_debug(logger, "Sent [%d] bytes to core", toCoreMsg->length);

crypto/CryptoAuth.c

@@ -199,7 +199,7 @@ static inline Gcc_USE_RET int decryptRndNonce(uint8_t nonce[24],
     }
 
     Bits_memcpy(startAt, paddingSpace, 16);
-    Message_shift(msg, -16, NULL);
+    Er_assert(Message_eshift(msg, -16));
     return 0;
 }
 
@@ -227,7 +227,7 @@ static inline void encryptRndNonce(uint8_t nonce[24],
     }
 
     Bits_memcpy(startAt, paddingSpace, 16);
-    Message_shift(msg, 16, NULL);
+    Er_assert(Message_eshift(msg, 16));
 }
 
 /**
@@ -342,7 +342,7 @@ static void encryptHandshake(struct Message* message,
                              struct CryptoAuth_Session_pvt* session,
                              int setupMessage)
 {
-    Message_shift(message, CryptoHeader_SIZE, NULL);
+    Er_assert(Message_eshift(message, CryptoHeader_SIZE));
 
     struct CryptoHeader* header = (struct CryptoHeader*) message->bytes;
 
@@ -447,7 +447,7 @@ static void encryptHandshake(struct Message* message,
                 Bits_isZero(session->herTempPubKey, 32));
 
     // Shift message over the encryptedTempKey field.
-    Message_shift(message, 32 - CryptoHeader_SIZE, NULL);
+    Er_assert(Message_eshift(message, 32 - CryptoHeader_SIZE));
 
     encryptRndNonce(header->handshakeNonce, message, sharedSecret);
 
@@ -467,7 +467,7 @@ static void encryptHandshake(struct Message* message,
     }
 
     // Shift it back -- encryptRndNonce adds 16 bytes of authenticator.
-    Message_shift(message, CryptoHeader_SIZE - 32 - 16, NULL);
+    Er_assert(Message_eshift(message, CryptoHeader_SIZE - 32 - 16));
 }
 
 /** @return 0 on success, -1 otherwise. */
@@ -517,7 +517,7 @@ int CryptoAuth_encrypt(struct CryptoAuth_Session* sessionPub, struct Message* ms
 
     encrypt(session->nextNonce, msg, session->sharedSecret, session->isInitiator);
 
-    Message_push32(msg, session->nextNonce, NULL);
+    Er_assert(Message_epush32be(msg, session->nextNonce));
     session->nextNonce++;
     return 0;
 }
@@ -641,7 +641,7 @@ static enum CryptoAuth_DecryptErr decryptHandshake(struct CryptoAuth_Session_pvt
     }
 
     // Shift it on top of the authenticator before the encrypted public key
-    Message_shift(message, 48 - CryptoHeader_SIZE, NULL);
+    Er_assert(Message_eshift(message, 48 - CryptoHeader_SIZE));
 
     if (Defined(Log_KEYS)) {
         uint8_t sharedSecretHex[65];
@@ -681,7 +681,7 @@ static enum CryptoAuth_DecryptErr decryptHandshake(struct CryptoAuth_Session_pvt
                   tempKeyHex);
     }
 
-    Message_shift(message, -32, NULL);
+    Er_assert(Message_eshift(message, -32));
 
     // Post-decryption checking
     if (nonce == Nonce_HELLO) {
@@ -847,7 +847,7 @@ enum CryptoAuth_DecryptErr CryptoAuth_decrypt(struct CryptoAuth_Session* session
     Assert_true(!((uintptr_t)msg->bytes % 4) || !"alignment fault");
     Assert_true(!(msg->capacity % 4) || !"length fault");
 
-    Message_shift(msg, -4, NULL);
+    Er_assert(Message_eshift(msg, -4));
 
     uint32_t nonce = Endian_bigEndianToHost32(header->nonce);
 
@@ -888,7 +888,7 @@ enum CryptoAuth_DecryptErr CryptoAuth_decrypt(struct CryptoAuth_Session* session
             return ret;
         }
 
-        Message_shift(msg, 4, NULL);
+        Er_assert(Message_eshift(msg, 4));
         return decryptHandshake(session, nonce, msg, header);
 
     } else if (nonce >= Nonce_FIRST_TRAFFIC_PACKET) {
@@ -904,7 +904,7 @@ enum CryptoAuth_DecryptErr CryptoAuth_decrypt(struct CryptoAuth_Session* session
         }
     } else if (nonce <= Nonce_REPEAT_HELLO) {
         cryptoAuthDebug(session, "hello packet during established session nonce=[%d]", nonce);
-        Message_shift(msg, 4, NULL);
+        Er_assert(Message_eshift(msg, 4));
         return decryptHandshake(session, nonce, msg, header);
     } else {
         cryptoAuthDebug(session, "DROP key packet during established session nonce=[%d]", nonce);

crypto/Sign.c

@@ -59,7 +59,7 @@ void Sign_signMsg(uint8_t keyPair[64], struct Message* msg, struct Random* rand)
     az[31] |= 64;
 
     // hash message + secret number
-    Message_push(msg, &az[32], 32, NULL);
+    Er_assert(Message_epush(msg, &az[32], 32));
     crypto_hash_sha512(r, msg->bytes, msg->length);
 
     // Replace secret number with public key
@@ -68,7 +68,7 @@ void Sign_signMsg(uint8_t keyPair[64], struct Message* msg, struct Random* rand)
     // push pointMul(r) to message
     sc_reduce(r);
     ge_scalarmult_base(&R,r);
-    Message_shift(msg, 32, NULL);
+    Er_assert(Message_eshift(msg, 32));
     ge_p3_tobytes(msg->bytes,&R);
 
     crypto_hash_sha512(hram, msg->bytes, msg->length);
@@ -87,7 +87,7 @@ int Sign_verifyMsg(uint8_t publicSigningKey[32], struct Message* msg)
     if (ret) {
         return -1;
     }
-    Message_pop(msg, NULL, 64, NULL);
+    Er_assert(Message_epop(msg, NULL, 64));
     return 0;
 }
 

crypto/test/CryptoAuth_fuzz_test.c

@@ -258,7 +258,7 @@ static void mainLoop(struct Context* ctx)
 
         struct Allocator* alloc = Allocator_child(ctx->alloc);
         struct Message* msg = Message_new(0, 512, alloc);
-        Message_push(msg, "hey", 4, NULL);
+        Er_assert(Message_epush(msg, "hey", 4));
         Assert_true(!CryptoAuth_encrypt(ctx->nodeA.session, msg));
         sendFrom(ctx, &ctx->nodeA, msg);
         Allocator_free(alloc);

crypto/test/CryptoAuth_unit_test.c

@@ -105,7 +105,7 @@ static void testHello(uint8_t* password, uint8_t* expectedOutput)
     struct Allocator* alloc = MallocAllocator_new(1<<20);
     struct Context* ctx = setUp(NULL, HERPUBKEY, password, alloc);
     struct Message* msg = Message_new(0, CryptoHeader_SIZE + 12, alloc);
-    Message_push(msg, HELLOWORLD, HELLOWORLDLEN, NULL);
+    Er_assert(Message_epush(msg, HELLOWORLD, HELLOWORLDLEN));
 
     Assert_true(!CryptoAuth_encrypt(ctx->sess, msg));
 
@@ -172,12 +172,12 @@ static void repeatHello()
     struct Allocator* alloc = MallocAllocator_new(1<<20);
     struct Context* ctx = setUp(NULL, HERPUBKEY, "password", alloc);
     struct Message* msg = Message_new(0, CryptoHeader_SIZE + HELLOWORLDLEN, alloc);
-    Message_push(msg, HELLOWORLD, HELLOWORLDLEN, NULL);
+    Er_assert(Message_epush(msg, HELLOWORLD, HELLOWORLDLEN));
 
     Assert_true(!CryptoAuth_encrypt(ctx->sess, msg));
 
     Message_reset(msg);
-    Message_push(msg, HELLOWORLD, HELLOWORLDLEN, NULL);
+    Er_assert(Message_epush(msg, HELLOWORLD, HELLOWORLDLEN));
 
     Assert_true(!CryptoAuth_encrypt(ctx->sess, msg));
 

crypto/test/Sign_test.c

@@ -35,7 +35,7 @@ int main()
     uint8_t signingKeyPair[64];
     Sign_signingKeyPairFromCurve25519(signingKeyPair, curve25519private);
     struct Message* msg = Message_new(0, 512, alloc);
-    Message_push(msg, "hello world", 12, NULL);
+    Er_assert(Message_epush(msg, "hello world", 12));
     Sign_signMsg(signingKeyPair, msg, rand);
 
     uint8_t curve25519publicB[32];

dht/Pathfinder.c

@@ -91,7 +91,7 @@ static int incomingFromDHT(struct DHTMessage* dmessage, void* vpf)
     // Sanity check (make sure the addr was actually calculated)
     Assert_true(AddressCalc_validAddress(addr->ip6.bytes));
 
-    Message_shift(msg, PFChan_Msg_MIN_SIZE, NULL);
+    Er_assert(Message_eshift(msg, PFChan_Msg_MIN_SIZE));
     struct PFChan_Msg* emsg = (struct PFChan_Msg*) msg->bytes;
     Bits_memset(emsg, 0, PFChan_Msg_MIN_SIZE);
 
@@ -109,7 +109,7 @@ static int incomingFromDHT(struct DHTMessage* dmessage, void* vpf)
     Assert_true(emsg->route.sh.label_be);
     Assert_true(emsg->route.version_be);
 
-    Message_push32(msg, PFChan_Pathfinder_SENDMSG, NULL);
+    Er_assert(Message_epush32be(msg, PFChan_Pathfinder_SENDMSG));
 
     if (dmessage->replyTo) {
         // see incomingMsg
@@ -139,12 +139,12 @@ static Iface_DEFUN sendNode(struct Message* msg,
                             struct Pathfinder_pvt* pf)
 {
     Message_reset(msg);
-    Message_shift(msg, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_eshift(msg, PFChan_Node_SIZE));
     nodeForAddress((struct PFChan_Node*) msg->bytes, addr, metric);
     if (addr->path == UINT64_MAX) {
         ((struct PFChan_Node*) msg->bytes)->path_be = 0;
     }
-    Message_push32(msg, PFChan_Pathfinder_NODE, NULL);
+    Er_assert(Message_epush32be(msg, PFChan_Pathfinder_NODE));
     return Iface_next(&pf->pub.eventIf, msg);
 }
 
@@ -168,7 +168,7 @@ static Iface_DEFUN connected(struct Pathfinder_pvt* pf, struct Message* msg)
     Log_debug(pf->log, "INIT");
 
     struct PFChan_Core_Connect conn;
-    Message_pop(msg, &conn, PFChan_Core_Connect_SIZE, NULL);
+    Er_assert(Message_epop(msg, &conn, PFChan_Core_Connect_SIZE));
     Assert_true(!msg->length);
 
     Bits_memcpy(pf->myAddr.key, conn.publicKey, 32);
@@ -240,7 +240,7 @@ static Iface_DEFUN connected(struct Pathfinder_pvt* pf, struct Message* msg)
 static void addressForNode(struct Address* addrOut, struct Message* msg)
 {
     struct PFChan_Node node;
-    Message_pop(msg, &node, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_epop(msg, &node, PFChan_Node_SIZE));
     Assert_true(!msg->length);
     addrOut->protocolVersion = Endian_bigEndianToHost32(node.version_be);
     addrOut->path = Endian_bigEndianToHost64(node.path_be);
@@ -251,7 +251,7 @@ static void addressForNode(struct Address* addrOut, struct Message* msg)
 static Iface_DEFUN switchErr(struct Message* msg, struct Pathfinder_pvt* pf)
 {
     struct PFChan_Core_SwitchErr switchErr;
-    Message_pop(msg, &switchErr, PFChan_Core_SwitchErr_MIN_SIZE, NULL);
+    Er_assert(Message_epop(msg, &switchErr, PFChan_Core_SwitchErr_MIN_SIZE));
 
     uint64_t path = Endian_bigEndianToHost64(switchErr.sh.label_be);
     uint64_t pathAtErrorHop = Endian_bigEndianToHost64(switchErr.ctrlErr.cause.label_be);
@@ -280,9 +280,9 @@ static Iface_DEFUN switchErr(struct Message* msg, struct Pathfinder_pvt* pf)
 static Iface_DEFUN searchReq(struct Message* msg, struct Pathfinder_pvt* pf)
 {
     uint8_t addr[16];
-    Message_pop(msg, addr, 16, NULL);
-    Message_pop32(msg, NULL);
-    uint32_t version = Message_pop32(msg, NULL);
+    Er_assert(Message_epop(msg, addr, 16));
+    Er_assert(Message_epop32be(msg));
+    uint32_t version = Er_assert(Message_epop32be(msg));
     if (version && version >= 20) { return NULL; }
     Assert_true(!msg->length);
     uint8_t printedAddr[40];
@@ -385,7 +385,7 @@ static Iface_DEFUN discoveredPath(struct Message* msg, struct Pathfinder_pvt* pf
 static Iface_DEFUN handlePing(struct Message* msg, struct Pathfinder_pvt* pf)
 {
     Log_debug(pf->log, "Received ping");
-    Message_push32(msg, PFChan_Pathfinder_PONG, NULL);
+    Er_assert(Message_epush32be(msg, PFChan_Pathfinder_PONG));
     return Iface_next(&pf->pub.eventIf, msg);
 }
 
@@ -399,7 +399,7 @@ static Iface_DEFUN incomingMsg(struct Message* msg, struct Pathfinder_pvt* pf)
 {
     struct Address addr;
     struct RouteHeader* hdr = (struct RouteHeader*) msg->bytes;
-    Message_shift(msg, -(RouteHeader_SIZE + DataHeader_SIZE), NULL);
+    Er_assert(Message_eshift(msg, -(RouteHeader_SIZE + DataHeader_SIZE)));
     Bits_memcpy(addr.ip6.bytes, hdr->ip6, 16);
     Bits_memcpy(addr.key, hdr->publicKey, 32);
     addr.protocolVersion = Endian_bigEndianToHost32(hdr->version_be);
@@ -430,7 +430,7 @@ static Iface_DEFUN incomingMsg(struct Message* msg, struct Pathfinder_pvt* pf)
 static Iface_DEFUN incomingFromEventIf(struct Message* msg, struct Iface* eventIf)
 {
     struct Pathfinder_pvt* pf = Identity_containerOf(eventIf, struct Pathfinder_pvt, pub.eventIf);
-    enum PFChan_Core ev = Message_pop32(msg, NULL);
+    enum PFChan_Core ev = Er_assert(Message_epop32be(msg));
     if (Pathfinder_pvt_state_INITIALIZING == pf->state) {
         Assert_true(ev == PFChan_Core_CONNECT);
         return connected(pf, msg);
@@ -460,8 +460,8 @@ static void sendEvent(struct Pathfinder_pvt* pf, enum PFChan_Pathfinder ev, void
 {
     struct Allocator* alloc = Allocator_child(pf->alloc);
     struct Message* msg = Message_new(0, 512+size, alloc);
-    Message_push(msg, data, size, NULL);
-    Message_push32(msg, ev, NULL);
+    Er_assert(Message_epush(msg, data, size));
+    Er_assert(Message_epush32be(msg, ev));
     Iface_send(&pf->pub.eventIf, msg);
     Allocator_free(alloc);
 }

dht/SerializationModule.c

@@ -84,7 +84,7 @@ static int handleOutgoing(struct DHTMessage* message,
         Dict_putStringC(message->asDict, "txid", newTxid, message->allocator);
     }
 
-    BencMessageWriter_write(message->asDict, message->binMessage, NULL);
+    Er_assert(BencMessageWriter_write(message->asDict, message->binMessage));
 
     Assert_true(!((uintptr_t)message->binMessage->bytes % 4) || !"alignment fault");
 

interface/ETHInterface_darwin.c

@@ -78,7 +78,7 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* iface)
     Assert_true(sa->addrLen <= ETHInterface_Sockaddr_SIZE);
 
     struct ETHInterface_Sockaddr sockaddr = { .generic = { .addrLen = 0 } };
-    Message_pop(msg, &sockaddr, sa->addrLen, NULL);
+    Er_assert(Message_epop(msg, &sockaddr, sa->addrLen));
 
     struct ETHInterface_Header hdr = {
         .version = ETHInterface_CURRENT_VERSION,
@@ -86,7 +86,7 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* iface)
         .length_be = Endian_hostToBigEndian16(msg->length + ETHInterface_Header_SIZE),
         .fc00_be = Endian_hostToBigEndian16(0xfc00)
     };
-    Message_push(msg, &hdr, ETHInterface_Header_SIZE, NULL);
+    Er_assert(Message_epush(msg, &hdr, ETHInterface_Header_SIZE));
 
     struct ethernet_frame ethFr = {
         .type = Ethernet_TYPE_CJDNS
@@ -97,14 +97,14 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* iface)
         Bits_memcpy(ethFr.dest, sockaddr.mac, 6);
     }
     Bits_memcpy(ethFr.src, ctx->myMac, 6);
-    Message_push(msg, &ethFr, ethernet_frame_SIZE, NULL);
+    Er_assert(Message_epush(msg, &ethFr, ethernet_frame_SIZE));
   /*
     struct bpf_hdr bpfPkt = {
         .bh_caplen = msg->length,
         .bh_datalen = msg->length,
         .bh_hdrlen = BPF_WORDALIGN(sizeof(struct bpf_hdr))
     };
-    Message_push(msg, &bpfPkt, bpfPkt.bh_hdrlen, NULL);
+    Er_assert(Message_epush(msg, &bpfPkt, bpfPkt.bh_hdrlen));
 */
     if (msg->length != write(ctx->socket, msg->bytes, msg->length)) {
         Log_debug(ctx->logger, "Error writing to eth device [%s]", strerror(errno));
@@ -160,7 +160,7 @@ static void handleEvent2(struct ETHInterface_pvt* context,
         sockaddr.generic.flags |= Sockaddr_flags_BCAST;
     }
 
-    Message_push(msg, &sockaddr, ETHInterface_Sockaddr_SIZE, NULL);
+    Er_assert(Message_epush(msg, &sockaddr, ETHInterface_Sockaddr_SIZE));
 
     Assert_true(!((uintptr_t)msg->bytes % 4) && "Alignment fault");
 

interface/ETHInterface_linux.c

@@ -110,7 +110,7 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* iface)
     Assert_true(sa->addrLen <= ETHInterface_Sockaddr_SIZE);
 
     struct ETHInterface_Sockaddr sockaddr = { .generic = { .addrLen = 0 } };
-    Message_pop(msg, &sockaddr, sa->addrLen, NULL);
+    Er_assert(Message_epop(msg, &sockaddr, sa->addrLen));
 
     struct sockaddr_ll addr;
     Bits_memcpy(&addr, &ctx->addrBase, sizeof(struct sockaddr_ll));
@@ -127,7 +127,7 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* iface)
         .length_be = Endian_hostToBigEndian16(msg->length + ETHInterface_Header_SIZE),
         .fc00_be = Endian_hostToBigEndian16(0xfc00)
     };
-    Message_push(msg, &hdr, ETHInterface_Header_SIZE, NULL);
+    Er_assert(Message_epush(msg, &hdr, ETHInterface_Header_SIZE));
     sendMessageInternal(msg, &addr, ctx);
     return NULL;
 }
@@ -141,7 +141,7 @@ static void handleEvent2(struct ETHInterface_pvt* context, struct Allocator* mes
 
     // Knock it out of alignment by 2 bytes so that it will be
     // aligned when the idAndPadding is shifted off.
-    Message_shift(msg, 2, NULL);
+    Er_assert(Message_eshift(msg, 2));
 
     int rc = recvfrom(context->socket,
                       msg->bytes,
@@ -161,7 +161,7 @@ static void handleEvent2(struct ETHInterface_pvt* context, struct Allocator* mes
     //Assert_true(addrLen == SOCKADDR_LL_LEN);
 
     struct ETHInterface_Header hdr;
-    Message_pop(msg, &hdr, ETHInterface_Header_SIZE, NULL);
+    Er_assert(Message_epop(msg, &hdr, ETHInterface_Header_SIZE));
 
     // here we could put a switch statement to handle different versions differently.
     if (hdr.version != ETHInterface_CURRENT_VERSION) {
@@ -190,7 +190,7 @@ static void handleEvent2(struct ETHInterface_pvt* context, struct Allocator* mes
         sockaddr.generic.flags |= Sockaddr_flags_BCAST;
     }
 
-    Message_push(msg, &sockaddr, ETHInterface_Sockaddr_SIZE, NULL);
+    Er_assert(Message_epush(msg, &sockaddr, ETHInterface_Sockaddr_SIZE));
 
     Assert_true(!((uintptr_t)msg->bytes % 4) && "Alignment fault");
 

interface/FramingIface.c

@@ -59,10 +59,10 @@ static struct Message* mergeMessage(struct FramingIface_pvt* fi, struct Message*
     }
 
     struct Message* out = Message_new(0, length + REQUIRED_PADDING, fi->frameAlloc);
-    Message_push(out, last->bytes, last->length, NULL);
+    Er_assert(Message_epush(out, last->bytes, last->length));
     out->associatedFd = last->associatedFd;
     for (part = fi->frameParts; part; part = part->next) {
-        Message_push(out, part->msg->bytes, part->msg->length, NULL);
+        Er_assert(Message_epush(out, part->msg->bytes, part->msg->length));
         if (!out->associatedFd) {
             out->associatedFd = part->msg->associatedFd;
         }
@@ -110,7 +110,7 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* streamIf)
                 return NULL;
             }
             fi->header.bytes[fi->headerIndex] = msg->bytes[0];
-            Message_shift(msg, -1, NULL);
+            Er_assert(Message_eshift(msg, -1));
             fi->headerIndex++;
         }
         fi->headerIndex = 0;
@@ -131,7 +131,7 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* streamIf)
             struct Message* m = Message_new(fi->bytesRemaining, REQUIRED_PADDING, alloc);
             m->associatedFd = msg->associatedFd;
             Bits_memcpy(m->bytes, msg->bytes, fi->bytesRemaining);
-            Message_shift(msg, -fi->bytesRemaining, NULL);
+            Er_assert(Message_eshift(msg, -fi->bytesRemaining));
             fi->bytesRemaining = 0;
             Iface_send(&fi->messageIf, m);
             Allocator_free(alloc);
@@ -144,9 +144,9 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* streamIf)
             m->capacity = m->length = msg->length + 4;
             m->bytes = Allocator_calloc(fi->frameAlloc, m->length, 1);
             m->alloc = fi->frameAlloc;
-            Message_shift(m, -m->length, NULL);
-            Message_push(m, msg->bytes, msg->length, NULL);
-            Message_push(m, fi->header.bytes, 4, NULL);
+            Er_assert(Message_eshift(m, -m->length));
+            Er_assert(Message_epush(m, msg->bytes, msg->length));
+            Er_assert(Message_epush(m, fi->header.bytes, 4));
 
             fi->bytesRemaining -= msg->length;
             fi->frameParts = Allocator_calloc(fi->frameAlloc, sizeof(struct MessageList), 1);
@@ -161,7 +161,7 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* messageIf)
 {
     struct FramingIface_pvt* fi =
         Identity_containerOf(messageIf, struct FramingIface_pvt, messageIf);
-    Message_push32(msg, msg->length, NULL);
+    Er_assert(Message_epush32be(msg, msg->length));
     return Iface_next(&fi->streamIf, msg);
 }
 

interface/UDPInterface.c

@@ -134,14 +134,14 @@ static Iface_DEFUN sendPacket(struct Message* m, struct Iface* iface)
         .zero = 0,
         .commPort_be = ctx->commPort_be
     };
-    Message_shift(m, -sa->addrLen, NULL);
-    Message_push(m, &hdr, UDPInterface_BroadcastHeader_SIZE, NULL);
+    Er_assert(Message_eshift(m, -sa->addrLen));
+    Er_assert(Message_epush(m, &hdr, UDPInterface_BroadcastHeader_SIZE));
 
     for (int i = 0; i < ctx->bcastAddrs->length; i++) {
         struct Allocator* tmpAlloc = Allocator_child(ctx->allocator);
         struct Message* mm = Message_clone(m, tmpAlloc);
         struct Sockaddr* addr = ArrayList_Sockaddr_get(ctx->bcastAddrs, i);
-        Message_push(mm, addr, addr->addrLen, NULL);
+        Er_assert(Message_epush(mm, addr, addr->addrLen));
         Iface_send(&ctx->bcastSock, mm);
         Allocator_free(tmpAlloc);
     }
@@ -167,15 +167,15 @@ static Iface_DEFUN fromBcastSock(struct Message* m, struct Iface* iface)
     }
 
     struct Sockaddr_storage ss;
-    Message_pop(m, &ss, Sockaddr_OVERHEAD, NULL);
+    Er_assert(Message_epop(m, &ss, Sockaddr_OVERHEAD));
     if (m->length < UDPInterface_BroadcastHeader_SIZE + ss.addr.addrLen - Sockaddr_OVERHEAD) {
         Log_debug(ctx->log, "DROP runt bcast");
         return NULL;
     }
-    Message_pop(m, &ss.nativeAddr, ss.addr.addrLen - Sockaddr_OVERHEAD, NULL);
+    Er_assert(Message_epop(m, &ss.nativeAddr, ss.addr.addrLen - Sockaddr_OVERHEAD));
 
     struct UDPInterface_BroadcastHeader hdr;
-    Message_pop(m, &hdr, UDPInterface_BroadcastHeader_SIZE, NULL);
+    Er_assert(Message_epop(m, &hdr, UDPInterface_BroadcastHeader_SIZE));
 
     if (hdr.fffffffc_be != Endian_hostToBigEndian32(0xfffffffc)) {
         Log_debug(ctx->log, "DROP bcast bad magic, expected 0xfffffffc got [%08x]",
@@ -199,7 +199,7 @@ static Iface_DEFUN fromBcastSock(struct Message* m, struct Iface* iface)
     Sockaddr_setPort(&ss.addr, commPort);
     ss.addr.flags |= Sockaddr_flags_BCAST;
 
-    Message_push(m, &ss.addr, ss.addr.addrLen, NULL);
+    Er_assert(Message_epush(m, &ss.addr, ss.addr.addrLen));
 
     return Iface_next(&ctx->pub.generic.iface, m);
 }

interface/addressable/AddrIface.h

@@ -40,20 +40,18 @@ struct AddrIface
     struct Allocator* alloc;
 };
 
-static inline void AddrIface_pushAddr(
-    struct Message* msg,
-    struct Sockaddr* addr,
-    struct Except* eh)
+static inline Er_DEFUN(void AddrIface_pushAddr(struct Message* msg, struct Sockaddr* addr))
 {
-    Message_push(msg, addr, addr->addrLen, eh);
+    Er(Message_epush(msg, addr, addr->addrLen));
+    Er_ret();
 }
 
-static inline struct Sockaddr* AddrIface_popAddr(struct Message* msg, struct Except* eh)
+static inline Er_DEFUN(struct Sockaddr* AddrIface_popAddr(struct Message* msg))
 {
     struct Sockaddr* out = (struct Sockaddr*) msg->bytes;
-    uint16_t len = Message_pop16h(msg, eh);
-    Message_pop(msg, NULL, len - 2, eh);
-    return out;
+    uint16_t len = Er(Message_epop16h(msg));
+    Er(Message_epop(msg, NULL, len - 2));
+    Er_ret(out);
 }
 
 #endif

interface/addressable/AddrIfaceAdapter.c

@@ -34,7 +34,7 @@ static Iface_DEFUN incomingFromAddrIf(struct Message* msg, struct Iface* addrIf)
     struct AddrIfaceAdapter_pvt* ctx =
         Identity_containerOf(addrIf, struct AddrIfaceAdapter_pvt, pub.generic.iface);
 
-    Message_shift(msg, -(ctx->pub.generic.addr->addrLen), NULL);
+    Er_assert(Message_eshift(msg, -(ctx->pub.generic.addr->addrLen)));
     return Iface_next(&ctx->pub.inputIf, msg);
 }
 
@@ -43,7 +43,7 @@ static Iface_DEFUN incomingFromInputIf(struct Message* msg, struct Iface* inputI
     struct AddrIfaceAdapter_pvt* ctx =
         Identity_containerOf(inputIf, struct AddrIfaceAdapter_pvt, pub.inputIf);
 
-    Message_push(msg, ctx->pub.generic.addr, ctx->pub.generic.addr->addrLen, NULL);
+    Er_assert(Message_epush(msg, ctx->pub.generic.addr, ctx->pub.generic.addr->addrLen));
     return Iface_next(&ctx->pub.generic.iface, msg);
 }
 

interface/addressable/AddrIfaceMuxer.c

@@ -48,13 +48,13 @@ static Iface_DEFUN incomingFromAddrIf(struct Message* msg, struct Iface* addrIf)
     struct AddrIfaceMuxer_pvt* ctx =
         Identity_containerOf(addrIf, struct AddrIfaceMuxer_pvt, pub.iface.iface);
 
-    struct Sockaddr* addr = AddrIface_popAddr(msg, NULL);
+    struct Sockaddr* addr = Er_assert(AddrIface_popAddr(msg));
     if (addr->addrLen > sizeof(struct Sockaddr)) {
         // There's another address packed under this one
         struct Sockaddr* subaddr = &addr[1];
         Assert_true(subaddr->addrLen == addr->addrLen - sizeof(struct Sockaddr));
         // Move the needle back to include it
-        Message_shift(msg, subaddr->addrLen, NULL);
+        Er_assert(Message_eshift(msg, subaddr->addrLen));
         addr->addrLen -= subaddr->addrLen;
     }
     uint32_t handle = Sockaddr_addrHandle(addr);
@@ -77,7 +77,7 @@ static Iface_DEFUN incomingFromInputIf(struct Message* msg, struct Iface* inputI
     }
 
     uint16_t addrLen = Bits_get16(msg->bytes);
-    AddrIface_pushAddr(msg, &cli->addr, NULL);
+    Er_assert(AddrIface_pushAddr(msg, &cli->addr));
 
     // After pushing the address, tweak the length
     Bits_put16(msg->bytes, cli->addr.addrLen + addrLen);

interface/addressable/PacketHeaderToUDPAddrIface.c

@@ -34,7 +34,7 @@ static Iface_DEFUN incomingFromUdpIf(struct Message* message, struct Iface* udpI
         Identity_containerOf(udpIf, struct PacketHeaderToUDPAddrIface_pvt, pub.udpIf.iface);
 
     struct Sockaddr_storage ss;
-    Message_pop(message, &ss, context->pub.udpIf.addr->addrLen, NULL);
+    Er_assert(Message_epop(message, &ss, context->pub.udpIf.addr->addrLen));
     struct Sockaddr* addr = &ss.addr;
 
     struct Headers_UDPHeader udp;
@@ -42,7 +42,7 @@ static Iface_DEFUN incomingFromUdpIf(struct Message* message, struct Iface* udpI
     udp.destPort_be = Endian_hostToBigEndian16(Sockaddr_getPort(addr));
     udp.length_be = Endian_hostToBigEndian16(message->length + Headers_UDPHeader_SIZE);
     udp.checksum_be = 0;
-    Message_push(message, &udp, sizeof(struct Headers_UDPHeader), NULL);
+    Er_assert(Message_epush(message, &udp, sizeof(struct Headers_UDPHeader)));
 
     struct Headers_IP6Header ip = {
         .nextHeader = 17,
@@ -59,7 +59,7 @@ static Iface_DEFUN incomingFromUdpIf(struct Message* message, struct Iface* udpI
     uint16_t checksum = Checksum_udpIp6(ip.sourceAddr, message->bytes, message->length);
     ((struct Headers_UDPHeader*)message->bytes)->checksum_be = checksum;
 
-    Message_push(message, &ip, sizeof(struct Headers_IP6Header), NULL);
+    Er_assert(Message_epush(message, &ip, sizeof(struct Headers_IP6Header)));
 
     return Iface_next(&context->pub.headerIf, message);
 }
@@ -96,8 +96,8 @@ static Iface_DEFUN incomingFromHeaderIf(struct Message* message, struct Iface* i
         return NULL;
     }
 
-    Message_shift(message, -(Headers_IP6Header_SIZE + Headers_UDPHeader_SIZE), NULL);
-    Message_push(message, addr, addr->addrLen, NULL);
+    Er_assert(Message_eshift(message, -(Headers_IP6Header_SIZE + Headers_UDPHeader_SIZE)));
+    Er_assert(Message_epush(message, addr, addr->addrLen));
 
     return Iface_next(&context->pub.udpIf.iface, message);
 }

interface/test/FramingIface_fuzz_test.c

@@ -47,9 +47,9 @@ void CJDNS_FUZZ_MAIN(void* vctx, struct Message* fuzz)
 {
     struct Context* ctx = Identity_check((struct Context*) vctx);
     if (fuzz->length <= 2) { return; }
-    ctx->messageLen = Message_pop16(fuzz, NULL) % BUF_SZ;
+    ctx->messageLen = Er_assert(Message_epop16be(fuzz)) % BUF_SZ;
     ctx->buf->length = ctx->messageLen;
-    Message_push32(ctx->buf, ctx->messageLen, NULL);
+    Er_assert(Message_epush32be(ctx->buf, ctx->messageLen));
     for (int i = 0; ; i++) {
         uint8_t len = fuzz->bytes[i % fuzz->length] + 1;
         if (len > ctx->buf->length) {
@@ -57,7 +57,7 @@ void CJDNS_FUZZ_MAIN(void* vctx, struct Message* fuzz)
         }
         struct Allocator* a = Allocator_child(ctx->alloc);
         struct Message* m = Message_new(len, 0, a);
-        Message_pop(ctx->buf, m->bytes, len, NULL);
+        Er_assert(Message_epop(ctx->buf, m->bytes, len));
         Iface_send(&ctx->outer, m);
         Allocator_free(a);
         if (ctx->success) {

interface/tuntap/ARPServer.c

@@ -37,8 +37,8 @@ struct ARPServer_pvt
 static bool isValidARP(struct Message* msg)
 {
     struct ARPHeader_6_4 arp;
-    Message_pop(msg, &arp, ARPHeader_6_4_SIZE, NULL);
-    Message_shift(msg, ARPHeader_6_4_SIZE, NULL); // Get copy and restore.
+    Er_assert(Message_epop(msg, &arp, ARPHeader_6_4_SIZE));
+    Er_assert(Message_eshift(msg, ARPHeader_6_4_SIZE)); // Get copy and restore.
     if (!ARPHeader_isEthIP4(&arp.prefix)) {
         return false; // not ARP.
     }
@@ -57,7 +57,7 @@ static bool isValidARP(struct Message* msg)
 static Iface_DEFUN answerARP(struct Message* msg, struct ARPServer_pvt* as)
 {
     struct ARPHeader_6_4 arp;
-    Message_pop(msg, &arp, ARPHeader_6_4_SIZE, NULL);
+    Er_assert(Message_epop(msg, &arp, ARPHeader_6_4_SIZE));
     if (msg->length) {
         Log_warn(as->log, "%d extra bytes in ARP, weird", msg->length);
     }
@@ -72,8 +72,8 @@ static Iface_DEFUN answerARP(struct Message* msg, struct ARPServer_pvt* as)
     // Set answer opcode.
     arp.prefix.operation = ARPHeader_OP_A;
 
-    Message_push(msg, &arp, ARPHeader_6_4_SIZE, NULL);
-    TUNMessageType_push(msg, Ethernet_TYPE_ARP, NULL);
+    Er_assert(Message_epush(msg, &arp, ARPHeader_6_4_SIZE));
+    Er_assert(TUNMessageType_push(msg, Ethernet_TYPE_ARP));
 
     Log_debug(as->log, "Sending ARP answer.");
 
@@ -85,13 +85,13 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* external)
     struct ARPServer_pvt* as = Identity_containerOf(external, struct ARPServer_pvt, external);
     // Length should be ARP + Ethertype
     if (msg->length >= ARPHeader_6_4_SIZE + 4) {
-        uint16_t ethertype = TUNMessageType_pop(msg, NULL);
+        uint16_t ethertype = Er_assert(TUNMessageType_pop(msg));
         if (ethertype == Ethernet_TYPE_ARP) {
             if (isValidARP(msg)) {
                 return answerARP(msg, as);
             }
         }
-        TUNMessageType_push(msg, ethertype, NULL);
+        Er_assert(TUNMessageType_push(msg, ethertype));
     }
     return Iface_next(&as->pub.internal, msg);
 }

interface/tuntap/AndroidWrapper.c

@@ -57,7 +57,7 @@ static Iface_DEFUN incomingFromWire(struct Message* msg, struct Iface* externalI
         return NULL;
     }
 
-    Message_shift(msg, 4, NULL);
+    Er_assert(Message_eshift(msg, 4));
     ((uint16_t*) msg->bytes)[0] = 0;
     ((uint16_t*) msg->bytes)[1] = ethertype;
 
@@ -74,7 +74,7 @@ static Iface_DEFUN incomingFromUs(struct Message* msg, struct Iface* internalIf)
         return NULL;
     }
 
-    Message_shift(msg, -4, NULL);
+    Er_assert(Message_eshift(msg, -4));
 
     return Iface_next(&ctx->pub.externalIf, msg);
 }

interface/tuntap/NDPServer.c

@@ -73,9 +73,9 @@ static bool isNeighborSolicitation(struct Message* msg, struct NDPServer_pvt* ns
 static Iface_DEFUN answerNeighborSolicitation(struct Message* msg, struct NDPServer_pvt* ns)
 {
     struct Headers_IP6Header ip6;
-    Message_pop(msg, &ip6, Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_epop(msg, &ip6, Headers_IP6Header_SIZE));
     struct NDPHeader_NeighborSolicitation sol;
-    Message_pop(msg, &sol, NDPHeader_NeighborSolicitation_SIZE, NULL);
+    Er_assert(Message_epop(msg, &sol, NDPHeader_NeighborSolicitation_SIZE));
     if (msg->length) {
         /* Right now we ignore any ICMP options. Windows will send them. */
         Log_debug(ns->log, "%d extra bytes (ICMP options?) in neighbor solicitation",
@@ -87,7 +87,7 @@ static Iface_DEFUN answerNeighborSolicitation(struct Message* msg, struct NDPSer
         .one = 1
     };
     Bits_memcpy(macOpt.mac, ns->localMac, Ethernet_ADDRLEN);
-    Message_push(msg, &macOpt, sizeof(struct NDPHeader_MacOpt), NULL);
+    Er_assert(Message_epush(msg, &macOpt, sizeof(struct NDPHeader_MacOpt)));
 
     struct NDPHeader_NeighborAdvert na = {
         .oneThirtySix = 136,
@@ -98,7 +98,7 @@ static Iface_DEFUN answerNeighborSolicitation(struct Message* msg, struct NDPSer
             | NDPHeader_NeighborAdvert_bits_OVERRIDE
     };
     Bits_memcpy(na.targetAddr, sol.targetAddr, 16);
-    Message_push(msg, &na, sizeof(struct NDPHeader_NeighborAdvert), NULL);
+    Er_assert(Message_epush(msg, &na, sizeof(struct NDPHeader_NeighborAdvert)));
 
     Bits_memcpy(ip6.destinationAddr, ip6.sourceAddr, 16);
     Bits_memcpy(ip6.sourceAddr, sol.targetAddr, 16);
@@ -108,9 +108,9 @@ static Iface_DEFUN answerNeighborSolicitation(struct Message* msg, struct NDPSer
     struct NDPHeader_RouterAdvert* adv = (struct NDPHeader_RouterAdvert*) msg->bytes;
     adv->checksum = Checksum_icmp6(ip6.sourceAddr, msg->bytes, msg->length);
 
-    Message_push(msg, &ip6, sizeof(struct Headers_IP6Header), NULL);
+    Er_assert(Message_epush(msg, &ip6, sizeof(struct Headers_IP6Header)));
 
-    TUNMessageType_push(msg, Ethernet_TYPE_IP6, NULL);
+    Er_assert(TUNMessageType_push(msg, Ethernet_TYPE_IP6));
 
     Log_debug(ns->log, "Sending neighbor advert");
 
@@ -122,13 +122,13 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* external)
     struct NDPServer_pvt* ns = Identity_containerOf(external, struct NDPServer_pvt, external);
 
     if (msg->length > Headers_IP6Header_SIZE + 4) {
-        uint16_t ethertype = TUNMessageType_pop(msg, NULL);
+        uint16_t ethertype = Er_assert(TUNMessageType_pop(msg));
         if (ethertype != Ethernet_TYPE_IP6) {
         } else if (isNeighborSolicitation(msg, ns)) {
             //TODO(cjdns, Kubuxu): Filtering basing on cjdns network and tunnels.
             return answerNeighborSolicitation(msg, ns);
         }
-        TUNMessageType_push(msg, ethertype, NULL);
+        Er_assert(TUNMessageType_push(msg, ethertype));
     }
     return Iface_next(&ns->pub.internal, msg);
 }

interface/tuntap/SocketWrapper.c

@@ -41,12 +41,12 @@ static Iface_DEFUN incomingFromSocket(struct Message* msg, struct Iface* externa
     }
 
     // get ess packet type
-    uint8_t type = Message_pop8(msg, NULL);
+    uint8_t type = Er_assert(Message_epop8h(msg));
     Log_debug(ctx->logger, "Packet type [%d]", type);
 
     if (type == SocketWrapper_TYPE_TUN_PACKET) {
         // skip tun packet length
-        Message_pop32(msg, NULL);
+        Er_assert(Message_epop32be(msg));
         return Iface_next(&ctx->pub.internalIf, msg);
     }
 
@@ -65,9 +65,9 @@ static Iface_DEFUN incomingFromUs(struct Message* msg, struct Iface* internalIf)
     }
 
     // send payload length
-    Message_push32(msg, msg->length, NULL);
+    Er_assert(Message_epush32be(msg, msg->length));
     // mark this as a normal tun packet
-    Message_push8(msg, SocketWrapper_TYPE_TUN_PACKET, NULL);
+    Er_assert(Message_epush8(msg, SocketWrapper_TYPE_TUN_PACKET));
 
     return Iface_next(&ctx->pub.externalIf, msg);
 }

interface/tuntap/TAPWrapper.c

@@ -40,10 +40,10 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* external)
     }
 
     // wacky 14 byte headers, back off into outer-space to create the padding...
-    Message_shift(msg, 2, NULL);
+    Er_assert(Message_eshift(msg, 2));
 
     struct Ethernet eth;
-    Message_pop(msg, &eth, sizeof(struct Ethernet), NULL);
+    Er_assert(Message_epop(msg, &eth, sizeof(struct Ethernet)));
 
     // Not for us and not multicast...
     if (Bits_memcmp(eth.destAddr, TAPWrapper_LOCAL_MAC, Ethernet_ADDRLEN)
@@ -69,7 +69,7 @@ static Iface_DEFUN receiveMessage(struct Message* msg, struct Iface* external)
             return 0;
         }
     }
-    TUNMessageType_push(msg, eth.ethertype, NULL);
+    Er_assert(TUNMessageType_push(msg, eth.ethertype));
     return Iface_next(&tw->pub.internal, msg);
 }
 
@@ -77,7 +77,7 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* internal)
 {
     struct TAPWrapper_pvt* tw = Identity_containerOf(internal, struct TAPWrapper_pvt, pub.internal);
 
-    uint16_t etherType = TUNMessageType_pop(msg, NULL);
+    uint16_t etherType = Er_assert(TUNMessageType_pop(msg));
     struct Ethernet eth = { .ethertype = etherType };
     Bits_memcpy(eth.srcAddr, TAPWrapper_LOCAL_MAC, Ethernet_ADDRLEN);
     Bits_memcpy(eth.destAddr, tw->pub.peerAddress, Ethernet_ADDRLEN);
@@ -86,10 +86,10 @@ static Iface_DEFUN sendMessage(struct Message* msg, struct Iface* internal)
         return NULL;
     }
 
-    Message_push(msg, &eth, sizeof(struct Ethernet), NULL);
+    Er_assert(Message_epush(msg, &eth, sizeof(struct Ethernet)));
 
     // struct Ethernet contains 2 bytes of padding at the beginning.
-    Message_shift(msg, -2, NULL);
+    Er_assert(Message_eshift(msg, -2));
 
     return Iface_next(&tw->external, msg);
 }

interface/tuntap/TUNInterface_sunos.c

@@ -68,7 +68,7 @@ static Iface_DEFUN incomingFromWire(struct Message* message, struct Iface* exter
         return 0;
     }
 
-    Message_shift(message, 4, NULL);
+    Er_assert(Message_eshift(message, 4));
     ((uint16_t*) message->bytes)[0] = 0;
     ((uint16_t*) message->bytes)[1] = ethertypeForPacketType(message->bytes[4]);
 
@@ -80,7 +80,7 @@ static Iface_DEFUN incomingFromUs(struct Message* message, struct Iface* interna
     struct TUNInterface_Illumos_pvt* ctx =
         Identity_containerOf(internalIf, struct TUNInterface_Illumos_pvt, internalIf);
 
-    Message_shift(message, -4, NULL);
+    Er_assert(Message_eshift(message, -4));
     uint16_t ethertype = ((uint16_t*) message->bytes)[-1];
     if (ethertype != Ethernet_TYPE_IP6 && ethertype != Ethernet_TYPE_IP4) {
         Assert_true(!"Unsupported ethertype");

interface/tuntap/TUNMessageType.h

@@ -18,19 +18,19 @@
 #include "util/Defined.h"
 #include "wire/Message.h"
 
-static inline void TUNMessageType_push(struct Message* message,
-                                       uint16_t ethertype,
-                                       struct Except* eh)
+static inline Er_DEFUN(void TUNMessageType_push(struct Message* message,
+                                       uint16_t ethertype))
 {
-    Message_shift(message, 4, eh);
+    Er(Message_eshift(message, 4));
     ((uint16_t*) message->bytes)[0] = 0;
     ((uint16_t*) message->bytes)[1] = ethertype;
+    Er_ret();
 }
 
-static inline uint16_t TUNMessageType_pop(struct Message* message, struct Except* eh)
+static inline Er_DEFUN(uint16_t TUNMessageType_pop(struct Message* message))
 {
-    Message_shift(message, -4, eh);
-    return ((uint16_t*) message->bytes)[-1];
+    Er(Message_eshift(message, -4));
+    Er_ret( ((uint16_t*) message->bytes)[-1] );
 }
 
 enum TUNMessageType {

interface/tuntap/test/BSDMessageTypeWrapper_test.c

@@ -30,7 +30,7 @@ struct Context
 static Iface_DEFUN sendInside(struct Message* msg, struct Iface* inside)
 {
     struct Context* ctx = Identity_containerOf(inside, struct Context, inside);
-    uint32_t top = Message_pop32(msg, NULL);
+    uint32_t top = Er_assert(Message_epop32be(msg));
     Assert_true(top == 0x00000800);
     Assert_true(!(ctx->received & 1));
     ctx->received |= 1;
@@ -57,7 +57,7 @@ int main()
     Iface_plumb(&ctx->outside, &wrapper->wireSide);
 
     struct Message* msg = Message_new(256, 256, alloc);
-    Message_push32(msg, 0x00000800, NULL);
+    Er_assert(Message_epush32be(msg, 0x00000800));
     Iface_send(&ctx->inside, msg);
 
     Assert_true(ctx->received == 3);

interface/tuntap/test/TUNInterface_ipv4_root_test.c

@@ -32,7 +32,7 @@ static const uint8_t testAddrB[4] = {11, 0, 0, 2};
 
 static Iface_DEFUN receiveMessageTUN(struct Message* msg, struct TUNTools* tt)
 {
-    uint16_t ethertype = TUNMessageType_pop(msg, NULL);
+    uint16_t ethertype = Er_assert(TUNMessageType_pop(msg));
     if (ethertype != Ethernet_TYPE_IP4) {
         Log_debug(tt->log, "Spurious packet with ethertype [%u]\n",
                   Endian_bigEndianToHost16(ethertype));
@@ -49,7 +49,7 @@ static Iface_DEFUN receiveMessageTUN(struct Message* msg, struct TUNTools* tt)
     Bits_memcpy(header->destAddr, testAddrA, 4);
     Bits_memcpy(header->sourceAddr, testAddrB, 4);
 
-    TUNMessageType_push(msg, ethertype, NULL);
+    Er_assert(TUNMessageType_push(msg, ethertype));
 
     return Iface_next(&tt->tunIface, msg);
 }

interface/tuntap/test/TUNTools.c

@@ -58,8 +58,8 @@ static void sendHello(void* vctx)
     struct TUNTools_pvt* ctx = Identity_check((struct TUNTools_pvt*) vctx);
     struct Allocator* tempAlloc = Allocator_child(ctx->pub.alloc);
     struct Message* msg = Message_new(0, 64, tempAlloc);
-    Message_push(msg, "Hello World", 12, NULL);
-    Message_push(msg, ctx->pub.tunDestAddr, ctx->pub.tunDestAddr->addrLen, NULL);
+    Er_assert(Message_epush(msg, "Hello World", 12));
+    Er_assert(Message_epush(msg, ctx->pub.tunDestAddr, ctx->pub.tunDestAddr->addrLen));
     Iface_send(&ctx->pub.udpIface, msg);
     Allocator_free(tempAlloc);
 }
@@ -79,7 +79,7 @@ const uint8_t* TUNTools_testIP6AddrC = (uint8_t[])
 
 Iface_DEFUN TUNTools_genericIP6Echo(struct Message* msg, struct TUNTools* tt)
 {
-    uint16_t ethertype = TUNMessageType_pop(msg, NULL);
+    uint16_t ethertype = Er_assert(TUNMessageType_pop(msg));
     if (ethertype != Ethernet_TYPE_IP6) {
         Log_debug(tt->log, "Spurious packet with ethertype [%04x]\n",
                   Endian_bigEndianToHost16(ethertype));
@@ -105,7 +105,7 @@ Iface_DEFUN TUNTools_genericIP6Echo(struct Message* msg, struct TUNTools* tt)
     Sockaddr_getAddress(tt->tunDestAddr, &address);
     Bits_memcpy(header->sourceAddr, address, 16);
 
-    TUNMessageType_push(msg, ethertype, NULL);
+    Er_assert(TUNMessageType_push(msg, ethertype));
 
     return Iface_next(&tt->tunIface, msg);
 }

interface/tuntap/windows/test/TAPInterface_root_test.c

@@ -39,18 +39,18 @@ static uint8_t receiveMessage(struct Message* msg, struct Iface* iface)
         return 0;
     }
     // ethernet padding.
-    Message_shift(msg, -2, NULL);
+    Er_assert(Message_eshift(msg, -2));
 
     uint8_t from[13];
     uint8_t to[13];
     Hex_encode(from, 13, msg->bytes, 6);
-    Message_shift(msg, -6, NULL);
+    Er_assert(Message_eshift(msg, -6));
     Hex_encode(to, 13, msg->bytes, 6);
-    Message_shift(msg, -6, NULL);
+    Er_assert(Message_eshift(msg, -6));
 
     uint8_t type[5];
     Hex_encode(type, 5, msg->bytes, 2);
-    Message_shift(msg, -2, NULL);
+    Er_assert(Message_eshift(msg, -2));
 
     int subsubtype = -1;
     int subtype = -1;

net/Benchmark.c

@@ -186,7 +186,7 @@ static void switching(struct Context* ctx)
     struct Control_Header* ch = (struct Control_Header*) msg->bytes;
     struct Control_Ping* ping = (struct Control_Ping*) &ch[1];
     ping->version_be = Endian_hostToBigEndian32(Version_CURRENT_PROTOCOL);
-    Message_push(msg, NULL, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epush(msg, NULL, RouteHeader_SIZE));
     struct RouteHeader* rh = (struct RouteHeader*) msg->bytes;
     // TODO(cjd): this will fail with a different encoding scheme
     rh->sh.label_be = Endian_hostToBigEndian64(0x13);

net/ControlHandler.c

@@ -48,9 +48,9 @@ static Iface_DEFUN handleError(struct Message* msg,
         return NULL;
     }
     msg->length = handleError_MIN_SIZE;
-    Message_push(msg, &rh->sh, SwitchHeader_SIZE, NULL);
-    Message_push32(msg, 0xffffffff, NULL);
-    Message_push32(msg, PFChan_Core_SWITCH_ERR, NULL);
+    Er_assert(Message_epush(msg, &rh->sh, SwitchHeader_SIZE));
+    Er_assert(Message_epush32be(msg, 0xffffffff));
+    Er_assert(Message_epush32be(msg, PFChan_Core_SWITCH_ERR));
     return Iface_next(&ch->eventIf, msg);
 }
 
@@ -70,7 +70,7 @@ static Iface_DEFUN handlePing(struct Message* msg,
     }
 
     struct Control* ctrl = (struct Control*) msg->bytes;
-    Message_shift(msg, -Control_Header_SIZE, NULL);
+    Er_assert(Message_eshift(msg, -Control_Header_SIZE));
 
     // Ping and keyPing share version location
     struct Control_Ping* ping = (struct Control_Ping*) msg->bytes;
@@ -117,12 +117,12 @@ static Iface_DEFUN handlePing(struct Message* msg,
 
     ping->version_be = Endian_hostToBigEndian32(Version_CURRENT_PROTOCOL);
 
-    Message_shift(msg, Control_Header_SIZE, NULL);
+    Er_assert(Message_eshift(msg, Control_Header_SIZE));
 
     ctrl->header.checksum_be = 0;
     ctrl->header.checksum_be = Checksum_engine(msg->bytes, msg->length);
 
-    Message_shift(msg, RouteHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, RouteHeader_SIZE));
 
     struct RouteHeader* routeHeader = (struct RouteHeader*) msg->bytes;
     Bits_memset(routeHeader, 0, RouteHeader_SIZE);
@@ -182,7 +182,7 @@ static Iface_DEFUN handleGetSnodeQuery(struct Message* msg,
     ctrl->header.checksum_be = 0;
     ctrl->header.checksum_be = Checksum_engine(msg->bytes, msg->length);
 
-    Message_shift(msg, RouteHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, RouteHeader_SIZE));
     struct RouteHeader* routeHeader = (struct RouteHeader*) msg->bytes;
     Bits_memset(routeHeader, 0, RouteHeader_SIZE);
     SwitchHeader_setVersion(&routeHeader->sh, SwitchHeader_CURRENT_VERSION);
@@ -206,7 +206,7 @@ static Iface_DEFUN incomingFromCore(struct Message* msg, struct Iface* coreIf)
     struct ControlHandler_pvt* ch = Identity_check((struct ControlHandler_pvt*) coreIf);
 
     struct RouteHeader routeHdr;
-    Message_pop(msg, &routeHdr, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epop(msg, &routeHdr, RouteHeader_SIZE));
     uint8_t labelStr[20];
     uint64_t label = Endian_bigEndianToHost64(routeHdr.sh.label_be);
     AddrTools_printPath(labelStr, label);
@@ -239,7 +239,7 @@ static Iface_DEFUN incomingFromCore(struct Message* msg, struct Iface* coreIf)
             || ctrl->header.type_be == Control_PONG_be)
     {
         Log_debug(ch->log, "got switch pong from [%s]", labelStr);
-        Message_push(msg, &routeHdr, RouteHeader_SIZE, NULL);
+        Er_assert(Message_epush(msg, &routeHdr, RouteHeader_SIZE));
         return Iface_next(&ch->pub.switchPingerIf, msg);
 
     } else if (ctrl->header.type_be == Control_GETSNODE_QUERY_be) {
@@ -247,9 +247,9 @@ static Iface_DEFUN incomingFromCore(struct Message* msg, struct Iface* coreIf)
 
     } else if (ctrl->header.type_be == Control_GETSNODE_REPLY_be) {
         Log_debug(ch->log, "got GETSNODE_REPLY from [%s]", labelStr);
-        Message_push(msg, &routeHdr, RouteHeader_SIZE, NULL);
-        Message_push32(msg, 0xffffffff, NULL);
-        Message_push32(msg, PFChan_Core_CTRL_MSG, NULL);
+        Er_assert(Message_epush(msg, &routeHdr, RouteHeader_SIZE));
+        Er_assert(Message_epush32be(msg, 0xffffffff));
+        Er_assert(Message_epush32be(msg, PFChan_Core_CTRL_MSG));
         return Iface_next(&ch->eventIf, msg);
     }
 
@@ -271,12 +271,12 @@ static Iface_DEFUN changeSnode(struct Message* msg, struct Iface* eventIf)
 {
     struct ControlHandler_pvt* ch =
         Identity_containerOf(eventIf, struct ControlHandler_pvt, eventIf);
-    enum PFChan_Pathfinder ev = Message_pop32(msg, NULL);
+    enum PFChan_Pathfinder ev = Er_assert(Message_epop32be(msg));
     Assert_true(ev == PFChan_Pathfinder_SNODE);
-    Message_pop32(msg, NULL);
+    Er_assert(Message_epop32be(msg));
 
     struct PFChan_Node node;
-    Message_pop(msg, &node, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_epop(msg, &node, PFChan_Node_SIZE));
     Assert_true(!msg->length);
 
     Bits_memcpy(ch->activeSnode.key, node.publicKey, 32);

net/EventEmitter.c

@@ -88,9 +88,9 @@ static Iface_DEFUN sendToPathfinder(struct Message* msg, struct Pathfinder* pf)
     if (!pf || pf->state != Pathfinder_state_CONNECTED) { return NULL; }
     if (pf->bytesSinceLastPing < 8192 && pf->bytesSinceLastPing + msg->length >= 8192) {
         struct Message* ping = Message_new(0, 512, msg->alloc);
-        Message_push32(ping, pf->bytesSinceLastPing, NULL);
-        Message_push32(ping, PING_MAGIC, NULL);
-        Message_push32(ping, PFChan_Core_PING, NULL);
+        Er_assert(Message_epush32be(ping, pf->bytesSinceLastPing));
+        Er_assert(Message_epush32be(ping, PING_MAGIC));
+        Er_assert(Message_epush32be(ping, PFChan_Core_PING));
         Iface_send(&pf->iface, ping);
     }
     pf->bytesSinceLastPing += msg->length;
@@ -176,10 +176,10 @@ static Iface_DEFUN incomingFromCore(struct Message* msg, struct Iface* trickIf)
 {
     struct EventEmitter_pvt* ee = Identity_containerOf(trickIf, struct EventEmitter_pvt, trickIf);
     Assert_true(!((uintptr_t)msg->bytes % 4) && "alignment");
-    enum PFChan_Core ev = Message_pop32(msg, NULL);
+    enum PFChan_Core ev = Er_assert(Message_epop32be(msg));
     Assert_true(PFChan_Core_sizeOk(ev, msg->length+4));
-    uint32_t pathfinderNum = Message_pop32(msg, NULL);
-    Message_push32(msg, ev, NULL);
+    uint32_t pathfinderNum = Er_assert(Message_epop32be(msg));
+    Er_assert(Message_epush32be(msg, ev));
     if (pathfinderNum != 0xffffffff) {
         struct Pathfinder* pf = ArrayList_Pathfinders_get(ee->pathfinders, pathfinderNum);
         Assert_true(pf && pf->state == Pathfinder_state_CONNECTED);
@@ -204,8 +204,8 @@ static struct Message* pathfinderMsg(enum PFChan_Core ev,
     pathfinder->superiority_be = Endian_hostToBigEndian32(pf->superiority);
     pathfinder->pathfinderId_be = Endian_hostToBigEndian32(pf->pathfinderId);
     Bits_memcpy(pathfinder->userAgent, pf->userAgent, 64);
-    Message_push32(msg, 0xffffffff, NULL);
-    Message_push32(msg, ev, NULL);
+    Er_assert(Message_epush32be(msg, 0xffffffff));
+    Er_assert(Message_epush32be(msg, ev));
     return msg;
 }
 
@@ -219,8 +219,8 @@ static int handleFromPathfinder(enum PFChan_Pathfinder ev,
 
         case PFChan_Pathfinder_CONNECT: {
             struct PFChan_Pathfinder_Connect connect;
-            Message_shift(msg, -8, NULL);
-            Message_pop(msg, &connect, PFChan_Pathfinder_Connect_SIZE, NULL);
+            Er_assert(Message_eshift(msg, -8));
+            Er_assert(Message_epop(msg, &connect, PFChan_Pathfinder_Connect_SIZE));
             pf->superiority = Endian_bigEndianToHost32(connect.superiority_be);
             pf->version = Endian_bigEndianToHost32(connect.version_be);
             Bits_memcpy(pf->userAgent, connect.userAgent, 64);
@@ -230,15 +230,15 @@ static int handleFromPathfinder(enum PFChan_Pathfinder ev,
             resp.version_be = Endian_bigEndianToHost32(Version_CURRENT_PROTOCOL);
             resp.pathfinderId_be = Endian_hostToBigEndian32(pf->pathfinderId);
             Bits_memcpy(resp.publicKey, ee->publicKey, 32);
-            Message_push(msg, &resp, PFChan_Core_Connect_SIZE, NULL);
-            Message_push32(msg, PFChan_Core_CONNECT, NULL);
+            Er_assert(Message_epush(msg, &resp, PFChan_Core_Connect_SIZE));
+            Er_assert(Message_epush32be(msg, PFChan_Core_CONNECT));
             struct Message* sendMsg = Message_clone(msg, msg->alloc);
             Iface_CALL(sendToPathfinder, sendMsg, pf);
             break;
         }
         case PFChan_Pathfinder_SUPERIORITY: {
-            Message_shift(msg, -8, NULL);
-            pf->superiority = Message_pop32(msg, NULL);
+            Er_assert(Message_eshift(msg, -8));
+            pf->superiority = Er_assert(Message_epop32be(msg));
             struct Message* resp = pathfinderMsg(PFChan_Core_PATHFINDER, pf, msg->alloc);
             Iface_CALL(incomingFromCore, resp, &ee->trickIf);
             break;
@@ -250,9 +250,9 @@ static int handleFromPathfinder(enum PFChan_Pathfinder ev,
             break;
         }
         case PFChan_Pathfinder_PONG: {
-            Message_shift(msg, -8, NULL);
-            uint32_t cookie = Message_pop32(msg, NULL);
-            uint32_t count = Message_pop32(msg, NULL);
+            Er_assert(Message_eshift(msg, -8));
+            uint32_t cookie = Er_assert(Message_epop32be(msg));
+            uint32_t count = Er_assert(Message_epop32be(msg));
             if (cookie != PING_MAGIC || count > pf->bytesSinceLastPing) {
                 pf->state = Pathfinder_state_ERROR;
                 struct Message* resp = pathfinderMsg(PFChan_Core_PATHFINDER_GONE, pf, msg->alloc);
@@ -285,9 +285,9 @@ static Iface_DEFUN incomingFromPathfinder(struct Message* msg, struct Iface* ifa
         Log_debug(ee->log, "DROPPF runt");
         return NULL;
     }
-    enum PFChan_Pathfinder ev = Message_pop32(msg, NULL);
-    Message_push32(msg, pf->pathfinderId, NULL);
-    Message_push32(msg, ev, NULL);
+    enum PFChan_Pathfinder ev = Er_assert(Message_epop32be(msg));
+    Er_assert(Message_epush32be(msg, pf->pathfinderId));
+    Er_assert(Message_epush32be(msg, ev));
     if (ev <= PFChan_Pathfinder__TOO_LOW || ev >= PFChan_Pathfinder__TOO_HIGH) {
         Log_debug(ee->log, "DROPPF invalid type [%d]", ev);
         return NULL;

net/InterfaceController.c

@@ -242,8 +242,8 @@ static void sendPeer(uint32_t pathfinderId,
     } else {
         node->metric_be = 0xffffffff;
     }
-    Message_push32(msg, pathfinderId, NULL);
-    Message_push32(msg, ev, NULL);
+    Er_assert(Message_epush32be(msg, pathfinderId));
+    Er_assert(Message_epush32be(msg, ev));
     Iface_send(&ic->eventEmitterIf, msg);
     Allocator_free(alloc);
 }
@@ -357,13 +357,13 @@ static void linkState(void* vic)
                 .sumOfDrops = ep->lastDrops,
                 .sumOfKb = (ep->bytesIn >> 10),
             };
-            Message_push(msg, &e, PFChan_LinkState_Entry_SIZE, NULL);
+            Er_assert(Message_epush(msg, &e, PFChan_LinkState_Entry_SIZE));
         }
     }
 
     if (msg->length) {
-        Message_push32(msg, 0xffffffff, NULL);
-        Message_push32(msg, PFChan_Core_LINK_STATE, NULL);
+        Er_assert(Message_epush32be(msg, 0xffffffff));
+        Er_assert(Message_epush32be(msg, PFChan_Core_LINK_STATE));
         Iface_send(&ic->eventEmitterIf, msg);
     }
     Allocator_free(alloc);
@@ -562,7 +562,7 @@ static Iface_DEFUN sendFromSwitch(struct Message* msg, struct Iface* switchIf)
         Assert_true(!(((uintptr_t)msg->bytes) % 4) && "alignment fault");
 
         // push the lladdr...
-        Message_push(msg, ep->lladdr, ep->lladdr->addrLen, NULL);
+        Er_assert(Message_epush(msg, ep->lladdr, ep->lladdr->addrLen));
 
         // very noisy
         if (Defined(Log_DEBUG) && false) {
@@ -619,10 +619,10 @@ static Iface_DEFUN handleBeacon(struct Message* msg, struct InterfaceController_
     // clear the bcast flag
     lladdrInmsg->flags = 0;
 
-    Message_shift(msg, -lladdrInmsg->addrLen, NULL);
+    Er_assert(Message_eshift(msg, -lladdrInmsg->addrLen));
 
     struct Headers_Beacon beacon;
-    Message_pop(msg, &beacon, Headers_Beacon_SIZE, NULL);
+    Er_assert(Message_epop(msg, &beacon, Headers_Beacon_SIZE));
 
     if (Defined(Log_DEBUG)) {
         char* content = Hex_print(&beacon, Headers_Beacon_SIZE, msg->alloc);
@@ -716,7 +716,7 @@ static Iface_DEFUN handleUnexpectedIncoming(struct Message* msg,
     struct InterfaceController_pvt* ic = ici->ic;
 
     struct Sockaddr* lladdr = (struct Sockaddr*) msg->bytes;
-    Message_shift(msg, -lladdr->addrLen, NULL);
+    Er_assert(Message_eshift(msg, -lladdr->addrLen));
     if (msg->length < CryptoHeader_SIZE) {
         return NULL;
     }
@@ -800,7 +800,7 @@ static Iface_DEFUN handleIncomingFromWire(struct Message* msg, struct Iface* add
     }
 
     struct Peer* ep = Identity_check((struct Peer*) ici->peerMap.values[epIndex]);
-    Message_shift(msg, -lladdr->addrLen, NULL);
+    Er_assert(Message_eshift(msg, -lladdr->addrLen));
     CryptoAuth_resetIfTimeout(ep->caSession);
     uint32_t nonce = Endian_bigEndianToHost32( ((uint32_t*)msg->bytes)[0] );
     if (CryptoAuth_decrypt(ep->caSession, msg)) {
@@ -884,7 +884,7 @@ static void sendBeacon(struct InterfaceController_Iface_pvt* ici, struct Allocat
     Log_debug(ici->ic->logger, "sendBeacon(%s)", ici->pub.name->bytes);
 
     struct Message* msg = Message_new(0, 128, tempAlloc);
-    Message_push(msg, &ici->ic->beacon, Headers_Beacon_SIZE, NULL);
+    Er_assert(Message_epush(msg, &ici->ic->beacon, Headers_Beacon_SIZE));
 
     if (Defined(Log_DEBUG)) {
         char* content = Hex_print(msg->bytes, msg->length, tempAlloc);
@@ -895,7 +895,7 @@ static void sendBeacon(struct InterfaceController_Iface_pvt* ici, struct Allocat
         .addrLen = Sockaddr_OVERHEAD,
         .flags = Sockaddr_flags_BCAST
     };
-    Message_push(msg, &sa, Sockaddr_OVERHEAD, NULL);
+    Er_assert(Message_epush(msg, &sa, Sockaddr_OVERHEAD));
 
     Iface_send(&ici->pub.addrIf, msg);
 }
@@ -1124,8 +1124,9 @@ static Iface_DEFUN incomingFromEventEmitterIf(struct Message* msg, struct Iface*
 {
     struct InterfaceController_pvt* ic =
          Identity_containerOf(eventEmitterIf, struct InterfaceController_pvt, eventEmitterIf);
-    Assert_true(Message_pop32(msg, NULL) == PFChan_Pathfinder_PEERS);
-    uint32_t pathfinderId = Message_pop32(msg, NULL);
+    uint32_t peers = Er_assert(Message_epop32be(msg));
+    Assert_true(peers == PFChan_Pathfinder_PEERS);
+    uint32_t pathfinderId = Er_assert(Message_epop32be(msg));
     Assert_true(!msg->length);
 
     for (int j = 0; j < ic->icis->length; j++) {

net/SessionManager.c

@@ -133,9 +133,9 @@ static void sendSession(struct SessionManager_Session_pvt* sess,
 
     struct Allocator* alloc = Allocator_child(sess->alloc);
     struct Message* msg = Message_new(0, PFChan_Node_SIZE + 512, alloc);
-    Message_push(msg, &session, PFChan_Node_SIZE, NULL);
-    Message_push32(msg, destPf, NULL);
-    Message_push32(msg, ev, NULL);
+    Er_assert(Message_epush(msg, &session, PFChan_Node_SIZE));
+    Er_assert(Message_epush32be(msg, destPf));
+    Er_assert(Message_epush32be(msg, ev));
     Iface_send(&sess->sessionManager->eventIf, msg);
     Allocator_free(alloc);
 }
@@ -277,10 +277,10 @@ static Iface_DEFUN ctrlFrame(struct Message* msg, struct SessionManager_pvt* sm)
 {
     struct RouteHeader rh;
     Bits_memset(&rh, 0, RouteHeader_SIZE);
-    Message_pop(msg, &rh.sh, SwitchHeader_SIZE, NULL);
-    Message_pop(msg, NULL, 4, NULL);
+    Er_assert(Message_epop(msg, &rh.sh, SwitchHeader_SIZE));
+    Er_assert(Message_epop(msg, NULL, 4));
     rh.flags = RouteHeader_flags_INCOMING | RouteHeader_flags_CTRLMSG;
-    Message_push(msg, &rh, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epush(msg, &rh, RouteHeader_SIZE));
     return Iface_next(&sm->pub.insideIf, msg);
 }
 
@@ -288,21 +288,21 @@ static Iface_DEFUN failedDecrypt(struct Message* msg,
                                  uint64_t label_be,
                                  struct SessionManager_pvt* sm)
 {
-    Message_push32(msg, Error_AUTHENTICATION, NULL);
-    Message_push16(msg, Control_ERROR, NULL);
-    Message_push16(msg, 0, NULL);
+    Er_assert(Message_epush32be(msg, Error_AUTHENTICATION));
+    Er_assert(Message_epush16be(msg, Control_ERROR));
+    Er_assert(Message_epush16be(msg, 0));
     uint16_t csum = Checksum_engine(msg->bytes, msg->length);
-    Message_pop16(msg, NULL);
-    Message_push16(msg, csum, NULL);
+    Er_assert(Message_epop16be(msg));
+    Er_assert(Message_epush16be(msg, csum));
 
-    Message_push32(msg, 0xffffffff, NULL);
+    Er_assert(Message_epush32be(msg, 0xffffffff));
 
     struct SwitchHeader sh;
     Bits_memset(&sh, 0, SwitchHeader_SIZE);
     SwitchHeader_setSuppressErrors(&sh, true);
     SwitchHeader_setVersion(&sh, SwitchHeader_CURRENT_VERSION);
     sh.label_be = label_be;
-    Message_push(msg, &sh, SwitchHeader_SIZE, NULL);
+    Er_assert(Message_epush(msg, &sh, SwitchHeader_SIZE));
 
     return Iface_next(&sm->pub.switchIf, msg);
 }
@@ -319,7 +319,7 @@ static Iface_DEFUN incomingFromSwitchIf(struct Message* msg, struct Iface* iface
     }
 
     struct SwitchHeader* switchHeader = (struct SwitchHeader*) msg->bytes;
-    Message_shift(msg, -SwitchHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, -SwitchHeader_SIZE));
 
     // The label comes in reversed from the switch because the switch doesn't know that we aren't
     // another switch ready to parse more bits, bit reversing the label yields the source address.
@@ -329,7 +329,7 @@ static Iface_DEFUN incomingFromSwitchIf(struct Message* msg, struct Iface* iface
     struct SessionManager_Session_pvt* session;
     uint32_t nonceOrHandle = Endian_bigEndianToHost32(((uint32_t*)msg->bytes)[0]);
     if (nonceOrHandle == 0xffffffff) {
-        Message_shift(msg, SwitchHeader_SIZE, NULL);
+        Er_assert(Message_eshift(msg, SwitchHeader_SIZE));
         return ctrlFrame(msg, sm);
     }
 
@@ -352,7 +352,7 @@ static Iface_DEFUN incomingFromSwitchIf(struct Message* msg, struct Iface* iface
             Log_debug(sm->log, "DROP message with unrecognized handle [%u]", nonceOrHandle);
             return NULL;
         }
-        Message_shift(msg, -4, NULL);
+        Er_assert(Message_eshift(msg, -4));
         uint32_t nonce = Endian_bigEndianToHost32(((uint32_t*)msg->bytes)[0]);
         if (nonce < 4) {
             Log_debug(sm->log, "DROP setup message [%u] with specified handle [%u]",
@@ -393,12 +393,12 @@ static Iface_DEFUN incomingFromSwitchIf(struct Message* msg, struct Iface* iface
                              "DROP Failed decrypting message NoH[%d] state[%s]",
                              nonceOrHandle,
                              CryptoAuth_stateString(CryptoAuth_getState(session->pub.caSession)));
-        Message_shift(msg, length0 - msg->length - 24, NULL);
+        Er_assert(Message_eshift(msg, length0 - msg->length - 24));
         msg->length = 0;
-        Message_push32(msg, CryptoAuth_getState(session->pub.caSession), NULL);
-        Message_push32(msg, ret, NULL);
-        Message_push(msg, firstSixteen, 16, NULL);
-        Message_shift(msg, SwitchHeader_SIZE, NULL);
+        Er_assert(Message_epush32be(msg, CryptoAuth_getState(session->pub.caSession)));
+        Er_assert(Message_epush32be(msg, ret));
+        Er_assert(Message_epush(msg, firstSixteen, 16));
+        Er_assert(Message_eshift(msg, SwitchHeader_SIZE));
         Assert_true(msg->bytes == (uint8_t*)switchHeader);
         uint64_t label_be = switchHeader->label_be;
         switchHeader->label_be = Bits_bitReverse64(switchHeader->label_be);
@@ -406,10 +406,10 @@ static Iface_DEFUN incomingFromSwitchIf(struct Message* msg, struct Iface* iface
     }
 
     if (currentMessageSetup) {
-        session->pub.sendHandle = Message_pop32(msg, NULL);
+        session->pub.sendHandle = Er_assert(Message_epop32be(msg));
     }
 
-    Message_shift(msg, RouteHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, RouteHeader_SIZE));
     struct RouteHeader* header = (struct RouteHeader*) msg->bytes;
 
     Assert_true(msg->length >= DataHeader_SIZE);
@@ -482,9 +482,9 @@ static void unsetupSession(struct SessionManager_pvt* sm, struct SessionManager_
     n.version_be = Endian_hostToBigEndian32(sess->pub.version);
     Bits_memcpy(n.publicKey, sess->pub.caSession->herPublicKey, 32);
     Bits_memcpy(n.ip6, sess->pub.caSession->herIp6, 16);
-    Message_push(eventMsg, &n, PFChan_Node_SIZE, NULL);
-    Message_push32(eventMsg, 0xffffffff, NULL);
-    Message_push32(eventMsg, PFChan_Core_UNSETUP_SESSION, NULL);
+    Er_assert(Message_epush(eventMsg, &n, PFChan_Node_SIZE));
+    Er_assert(Message_epush32be(eventMsg, 0xffffffff));
+    Er_assert(Message_epush32be(eventMsg, PFChan_Core_UNSETUP_SESSION));
     Iface_send(&sm->eventIf, eventMsg);
     Allocator_free(eventAlloc);
 }
@@ -493,11 +493,11 @@ static void triggerSearch(struct SessionManager_pvt* sm, uint8_t target[16], uin
 {
     struct Allocator* eventAlloc = Allocator_child(sm->alloc);
     struct Message* eventMsg = Message_new(0, 512, eventAlloc);
-    Message_push32(eventMsg, version, NULL);
-    Message_push32(eventMsg, 0, NULL);
-    Message_push(eventMsg, target, 16, NULL);
-    Message_push32(eventMsg, 0xffffffff, NULL);
-    Message_push32(eventMsg, PFChan_Core_SEARCH_REQ, NULL);
+    Er_assert(Message_epush32be(eventMsg, version));
+    Er_assert(Message_epush32be(eventMsg, 0));
+    Er_assert(Message_epush(eventMsg, target, 16));
+    Er_assert(Message_epush32be(eventMsg, 0xffffffff));
+    Er_assert(Message_epush32be(eventMsg, PFChan_Core_SEARCH_REQ));
     Iface_send(&sm->eventIf, eventMsg);
     Allocator_free(eventAlloc);
 }
@@ -593,18 +593,18 @@ static Iface_DEFUN readyToSend(struct Message* msg,
     if (DataHeader_getContentType(dh) != ContentType_CJDHT) {
         sess->pub.timeOfLastOut = Time_currentTimeMilliseconds(sm->eventBase);
     }
-    Message_shift(msg, -RouteHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, -RouteHeader_SIZE));
     struct SwitchHeader* sh;
     CryptoAuth_resetIfTimeout(sess->pub.caSession);
     if (CryptoAuth_getState(sess->pub.caSession) < CryptoAuth_State_RECEIVED_KEY) {
         // Put the handle into the message so that it's authenticated.
-        Message_push32(msg, sess->pub.receiveHandle, NULL);
+        Er_assert(Message_epush32be(msg, sess->pub.receiveHandle));
 
         // Copy back the SwitchHeader so it is not clobbered.
-        Message_shift(msg, (CryptoHeader_SIZE + SwitchHeader_SIZE), NULL);
+        Er_assert(Message_eshift(msg, (CryptoHeader_SIZE + SwitchHeader_SIZE)));
         Bits_memcpy(msg->bytes, &header->sh, SwitchHeader_SIZE);
         sh = (struct SwitchHeader*) msg->bytes;
-        Message_shift(msg, -(CryptoHeader_SIZE + SwitchHeader_SIZE), NULL);
+        Er_assert(Message_eshift(msg, -(CryptoHeader_SIZE + SwitchHeader_SIZE)));
     } else {
         sh = &header->sh;
     }
@@ -623,7 +623,7 @@ static Iface_DEFUN readyToSend(struct Message* msg,
                                   Endian_bigEndianToHost64(sh->label_be),
                                   "sending run message");
         }
-        Message_push32(msg, sess->pub.sendHandle, NULL);
+        Er_assert(Message_epush32be(msg, sess->pub.sendHandle));
     } else {
         debugHandlesAndLabel0(sm->log,
                               sess,
@@ -632,7 +632,7 @@ static Iface_DEFUN readyToSend(struct Message* msg,
     }
 
     // The SwitchHeader should have been moved to the correct location.
-    Message_shift(msg, SwitchHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, SwitchHeader_SIZE));
     Assert_true((uint8_t*)sh == msg->bytes);
 
     if (!sh->label_be) {
@@ -658,9 +658,9 @@ static Iface_DEFUN outgoingCtrlFrame(struct Message* msg, struct SessionManager_
     }
     struct SwitchHeader sh;
     Bits_memcpy(&sh, &header->sh, SwitchHeader_SIZE);
-    Message_pop(msg, NULL, RouteHeader_SIZE, NULL);
-    Message_push32(msg, 0xffffffff, NULL);
-    Message_push(msg, &sh, SwitchHeader_SIZE, NULL);
+    Er_assert(Message_epop(msg, NULL, RouteHeader_SIZE));
+    Er_assert(Message_epush32be(msg, 0xffffffff));
+    Er_assert(Message_epush(msg, &sh, SwitchHeader_SIZE));
     return Iface_next(&sm->pub.switchIf, msg);
 }
 
@@ -736,8 +736,8 @@ static Iface_DEFUN sessions(struct SessionManager_pvt* sm,
 static Iface_DEFUN incomingFromEventIf(struct Message* msg, struct Iface* iface)
 {
     struct SessionManager_pvt* sm = Identity_containerOf(iface, struct SessionManager_pvt, eventIf);
-    enum PFChan_Pathfinder ev = Message_pop32(msg, NULL);
-    uint32_t sourcePf = Message_pop32(msg, NULL);
+    enum PFChan_Pathfinder ev = Er_assert(Message_epop32be(msg));
+    uint32_t sourcePf = Er_assert(Message_epop32be(msg));
     if (ev == PFChan_Pathfinder_SESSIONS) {
         Assert_true(!msg->length);
         return sessions(sm, sourcePf, msg->alloc);
@@ -745,7 +745,7 @@ static Iface_DEFUN incomingFromEventIf(struct Message* msg, struct Iface* iface)
     Assert_true(ev == PFChan_Pathfinder_NODE);
 
     struct PFChan_Node node;
-    Message_pop(msg, &node, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_epop(msg, &node, PFChan_Node_SIZE));
     Assert_true(!msg->length);
     int index = Map_BufferedMessages_indexForKey((struct Ip6*)node.ip6, &sm->bufMap);
     struct SessionManager_Session_pvt* sess = sessionForIp6(node.ip6, sm);

net/SwitchPinger.c

@@ -83,13 +83,13 @@ static Iface_DEFUN messageFromControlHandler(struct Message* msg, struct Iface*
 {
     struct SwitchPinger_pvt* ctx = Identity_check((struct SwitchPinger_pvt*) iface);
     struct RouteHeader rh;
-    Message_pop(msg, &rh, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epop(msg, &rh, RouteHeader_SIZE));
     ctx->incomingLabel = Endian_bigEndianToHost64(rh.sh.label_be);
     ctx->incomingVersion = 0;
 
     struct Control* ctrl = (struct Control*) msg->bytes;
     if (ctrl->header.type_be == Control_PONG_be) {
-        Message_shift(msg, -Control_Header_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Control_Header_SIZE));
         ctx->error = Error_NONE;
         if (msg->length >= Control_Pong_MIN_SIZE) {
             struct Control_Ping* pongHeader = (struct Control_Ping*) msg->bytes;
@@ -98,14 +98,14 @@ static Iface_DEFUN messageFromControlHandler(struct Message* msg, struct Iface*
                 Log_debug(ctx->logger, "dropped invalid switch pong");
                 return NULL;
             }
-            Message_shift(msg, -Control_Pong_HEADER_SIZE, NULL);
+            Er_assert(Message_eshift(msg, -Control_Pong_HEADER_SIZE));
         } else {
             Log_debug(ctx->logger, "got runt pong message, length: [%d]", msg->length);
             return NULL;
         }
 
     } else if (ctrl->header.type_be == Control_KEYPONG_be) {
-        Message_shift(msg, -Control_Header_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Control_Header_SIZE));
         ctx->error = Error_NONE;
         if (msg->length >= Control_KeyPong_HEADER_SIZE && msg->length <= Control_KeyPong_MAX_SIZE) {
             struct Control_KeyPing* pongHeader = (struct Control_KeyPing*) msg->bytes;
@@ -115,7 +115,7 @@ static Iface_DEFUN messageFromControlHandler(struct Message* msg, struct Iface*
                 return NULL;
             }
             Bits_memcpy(ctx->incomingKey, pongHeader->key, 32);
-            Message_shift(msg, -Control_KeyPong_HEADER_SIZE, NULL);
+            Er_assert(Message_eshift(msg, -Control_KeyPong_HEADER_SIZE));
         } else if (msg->length > Control_KeyPong_MAX_SIZE) {
             Log_debug(ctx->logger, "got overlong key-pong message, length: [%d]", msg->length);
             return NULL;
@@ -125,7 +125,7 @@ static Iface_DEFUN messageFromControlHandler(struct Message* msg, struct Iface*
         }
 
     } else if (ctrl->header.type_be == Control_GETSNODE_REPLY_be) {
-        Message_shift(msg, -Control_Header_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Control_Header_SIZE));
         ctx->error = Error_NONE;
         if (msg->length < Control_GetSnode_HEADER_SIZE) {
             Log_debug(ctx->logger, "got runt GetSnode message, length: [%d]", msg->length);
@@ -147,20 +147,20 @@ static Iface_DEFUN messageFromControlHandler(struct Message* msg, struct Iface*
         ctx->incomingSnodeAddr.path = Endian_bigEndianToHost64(pathToSnode_be);
         ctx->incomingSnodeAddr.protocolVersion = Endian_bigEndianToHost32(hdr->snodeVersion_be);
         ctx->incomingSnodeKbps = Endian_bigEndianToHost32(hdr->kbps_be);
-        Message_shift(msg, -Control_GetSnode_HEADER_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Control_GetSnode_HEADER_SIZE));
 
     } else if (ctrl->header.type_be == Control_ERROR_be) {
-        Message_shift(msg, -Control_Header_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Control_Header_SIZE));
         Assert_true((uint8_t*)&ctrl->content.error.errorType_be == msg->bytes);
         if (msg->length < (Control_Error_HEADER_SIZE + SwitchHeader_SIZE + Control_Header_SIZE)) {
             Log_debug(ctx->logger, "runt error packet");
             return NULL;
         }
 
-        ctx->error = Message_pop32(msg, NULL);
-        Message_push32(msg, 0, NULL);
+        ctx->error = Er_assert(Message_epop32be(msg));
+        Er_assert(Message_epush32be(msg, 0));
 
-        Message_shift(msg, -(Control_Error_HEADER_SIZE + SwitchHeader_SIZE), NULL);
+        Er_assert(Message_eshift(msg, -(Control_Error_HEADER_SIZE + SwitchHeader_SIZE)));
 
         struct Control* origCtrl = (struct Control*) msg->bytes;
 
@@ -179,7 +179,7 @@ static Iface_DEFUN messageFromControlHandler(struct Message* msg, struct Iface*
         if (msg->length < -shift) {
             Log_debug(ctx->logger, "runt error packet");
         }
-        Message_shift(msg, shift, NULL);
+        Er_assert(Message_eshift(msg, shift));
 
     } else {
         // If it gets here then Ducttape.c is failing.
@@ -234,26 +234,26 @@ static void sendPing(String* data, void* sendPingContext)
     struct Message* msg = Message_new(0, data->len + 512, p->pub.pingAlloc);
 
     while (((uintptr_t)msg->bytes - data->len) % 4) {
-        Message_push8(msg, 0, NULL);
+        Er_assert(Message_epush8(msg, 0));
     }
     msg->length = 0;
 
-    Message_push(msg, data->bytes, data->len, NULL);
+    Er_assert(Message_epush(msg, data->bytes, data->len));
     Assert_true(!((uintptr_t)msg->bytes % 4) && "alignment fault");
 
     if (p->pub.type == SwitchPinger_Type_KEYPING) {
-        Message_push(msg, NULL, Control_KeyPing_HEADER_SIZE, NULL);
+        Er_assert(Message_epush(msg, NULL, Control_KeyPing_HEADER_SIZE));
         struct Control_KeyPing* keyPingHeader = (struct Control_KeyPing*) msg->bytes;
         keyPingHeader->magic = Control_KeyPing_MAGIC;
         keyPingHeader->version_be = Endian_hostToBigEndian32(Version_CURRENT_PROTOCOL);
         Bits_memcpy(keyPingHeader->key, p->context->myAddr->key, 32);
     } else if (p->pub.type == SwitchPinger_Type_PING) {
-        Message_push(msg, NULL, Control_Ping_HEADER_SIZE, NULL);
+        Er_assert(Message_epush(msg, NULL, Control_Ping_HEADER_SIZE));
         struct Control_Ping* pingHeader = (struct Control_Ping*) msg->bytes;
         pingHeader->magic = Control_Ping_MAGIC;
         pingHeader->version_be = Endian_hostToBigEndian32(Version_CURRENT_PROTOCOL);
     } else if (p->pub.type == SwitchPinger_Type_GETSNODE) {
-        Message_push(msg, NULL, Control_GetSnode_HEADER_SIZE, NULL);
+        Er_assert(Message_epush(msg, NULL, Control_GetSnode_HEADER_SIZE));
         struct Control_GetSnode* hdr = (struct Control_GetSnode*) msg->bytes;
         hdr->magic = Control_GETSNODE_QUERY_MAGIC;
         hdr->version_be = Endian_hostToBigEndian32(Version_CURRENT_PROTOCOL);
@@ -266,7 +266,7 @@ static void sendPing(String* data, void* sendPingContext)
         Assert_failure("unexpected ping type");
     }
 
-    Message_shift(msg, Control_Header_SIZE, NULL);
+    Er_assert(Message_eshift(msg, Control_Header_SIZE));
     struct Control* ctrl = (struct Control*) msg->bytes;
     ctrl->header.checksum_be = 0;
     if (p->pub.type == SwitchPinger_Type_PING) {
@@ -286,7 +286,7 @@ static void sendPing(String* data, void* sendPingContext)
     rh.sh.label_be = Endian_hostToBigEndian64(p->label);
     SwitchHeader_setVersion(&rh.sh, SwitchHeader_CURRENT_VERSION);
 
-    Message_push(msg, &rh, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epush(msg, &rh, RouteHeader_SIZE));
 
     Iface_send(&p->context->pub.controlHandlerIf, msg);
 }

net/TUNAdapter.c

@@ -37,7 +37,7 @@ static Iface_DEFUN incomingFromTunIf(struct Message* msg, struct Iface* tunIf)
 {
     struct TUNAdapter_pvt* ud = Identity_containerOf(tunIf, struct TUNAdapter_pvt, pub.tunIf);
 
-    uint16_t ethertype = TUNMessageType_pop(msg, NULL);
+    uint16_t ethertype = Er_assert(TUNMessageType_pop(msg));
 
     int version = Headers_getIpVersion(msg->bytes);
     if ((ethertype == Ethernet_TYPE_IP4 && version != 4)
@@ -80,14 +80,14 @@ static Iface_DEFUN incomingFromTunIf(struct Message* msg, struct Iface* tunIf)
     }
     if (!Bits_memcmp(header->destinationAddr, ud->myIp6, 16)) {
         // I'm Gonna Sit Right Down and Write Myself a Letter
-        TUNMessageType_push(msg, ethertype, NULL);
+        Er_assert(TUNMessageType_push(msg, ethertype));
         return Iface_next(tunIf, msg);
     }
 
     // first move the dest addr to the right place.
     Bits_memmove(header->destinationAddr - DataHeader_SIZE, header->destinationAddr, 16);
 
-    Message_shift(msg, DataHeader_SIZE + RouteHeader_SIZE - Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_eshift(msg, DataHeader_SIZE + RouteHeader_SIZE - Headers_IP6Header_SIZE));
     struct RouteHeader* rh = (struct RouteHeader*) msg->bytes;
 
     struct DataHeader* dh = (struct DataHeader*) &rh[1];
@@ -133,14 +133,14 @@ static Iface_DEFUN incomingFromUpperDistributorIf(struct Message* msg,
     // put my address as destination.
     Bits_memcpy(&hdr->ip6[DataHeader_SIZE], ud->myIp6, 16);
 
-    Message_shift(msg, Headers_IP6Header_SIZE - DataHeader_SIZE - RouteHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, Headers_IP6Header_SIZE - DataHeader_SIZE - RouteHeader_SIZE));
     struct Headers_IP6Header* ip6 = (struct Headers_IP6Header*) msg->bytes;
     Bits_memset(ip6, 0, Headers_IP6Header_SIZE - 32);
     Headers_setIpVersion(ip6);
     ip6->payloadLength_be = Endian_bigEndianToHost16(msg->length - Headers_IP6Header_SIZE);
     ip6->nextHeader = type;
     ip6->hopLimit = 42;
-    TUNMessageType_push(msg, Ethernet_TYPE_IP6, NULL);
+    Er_assert(TUNMessageType_push(msg, Ethernet_TYPE_IP6));
     return sendToTunIf(msg, ud);
 }
 

net/UpperDistributor.c

@@ -56,9 +56,9 @@ static Iface_DEFUN incomingFromSessionManagerIf(struct Message*, struct Iface*);
 
 static Iface_DEFUN fromHandler(struct Message* msg, struct UpperDistributor_pvt* ud)
 {
-    Message_pop(msg, NULL, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epop(msg, NULL, RouteHeader_SIZE));
     struct DataHeader dh;
-    Message_pop(msg, &dh, DataHeader_SIZE, NULL);
+    Er_assert(Message_epop(msg, &dh, DataHeader_SIZE));
     enum ContentType type = DataHeader_getContentType(&dh);
     if (type != ContentType_IP6_UDP) {
         Log_debug(ud->log, "DROP Message from handler with invalid type [%d]", type);
@@ -87,7 +87,7 @@ static Iface_DEFUN fromHandler(struct Message* msg, struct UpperDistributor_pvt*
         Log_debug(ud->log, "DROP Message from unregistered port [%d]", udpPort);
         return NULL;
     }
-    Message_pop(msg, NULL, Headers_UDPHeader_SIZE, NULL);
+    Er_assert(Message_epop(msg, NULL, Headers_UDPHeader_SIZE));
 
     Assert_true(msg->length >= RouteHeader_SIZE);
     struct RouteHeader* hdr = (struct RouteHeader*) msg->bytes;
@@ -119,7 +119,7 @@ static void sendToHandlers(struct Message* msg,
             udpH.destPort_be = Endian_hostToBigEndian16(ud->handlers->values[i]->pub.udpPort);
             udpH.length_be = Endian_hostToBigEndian16(cmsg->length + Headers_UDPHeader_SIZE);
             udpH.checksum_be = 0;
-            Message_push(cmsg, &udpH, Headers_UDPHeader_SIZE, NULL);
+            Er_assert(Message_epush(cmsg, &udpH, Headers_UDPHeader_SIZE));
             uint8_t srcAndDest[32] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1};
             AddressCalc_makeValidAddress(srcAndDest);
             Bits_memcpy(&srcAndDest[16], ud->myAddress->ip6.bytes, 16);
@@ -130,7 +130,7 @@ static void sendToHandlers(struct Message* msg,
             struct DataHeader dh = { .unused = 0 };
             DataHeader_setVersion(&dh, DataHeader_CURRENT_VERSION);
             DataHeader_setContentType(&dh, ContentType_IP6_UDP);
-            Message_push(cmsg, &dh, DataHeader_SIZE, NULL);
+            Er_assert(Message_epush(cmsg, &dh, DataHeader_SIZE));
         }
         {
             struct RouteHeader rh = {
@@ -138,7 +138,7 @@ static void sendToHandlers(struct Message* msg,
                 .ip6 = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1}
             };
             AddressCalc_makeValidAddress(rh.ip6);
-            Message_push(cmsg, &rh, RouteHeader_SIZE, NULL);
+            Er_assert(Message_epush(cmsg, &rh, RouteHeader_SIZE));
         }
 
         Iface_send(&ud->pub.tunAdapterIf, cmsg);
@@ -160,10 +160,10 @@ static Iface_DEFUN incomingFromEventIf(struct Message* msg, struct Iface* eventI
 {
     struct UpperDistributor_pvt* ud =
         Identity_containerOf(eventIf, struct UpperDistributor_pvt, eventIf);
-    uint32_t messageType = Message_pop32(msg, NULL);
+    uint32_t messageType = Er_assert(Message_epop32be(msg));
     Assert_true(messageType == PFChan_Pathfinder_SENDMSG ||
         messageType == PFChan_Pathfinder_CTRL_SENDMSG);
-    Message_pop32(msg, NULL);
+    Er_assert(Message_epop32be(msg));
     return toSessionManagerIf(msg, ud);
 }
 
@@ -219,8 +219,8 @@ static Iface_DEFUN incomingFromSessionManagerIf(struct Message* msg, struct Ifac
         return Iface_next(&ud->pub.tunAdapterIf, msg);
     }
     if (type == ContentType_CJDHT) {
-        Message_push32(msg, 0xffffffff, NULL);
-        Message_push32(msg, PFChan_Core_MSG, NULL);
+        Er_assert(Message_epush32be(msg, 0xffffffff));
+        Er_assert(Message_epush32be(msg, PFChan_Core_MSG));
         return Iface_next(&ud->eventIf, msg);
     }
     if (type == ContentType_IPTUN) {

node_build/builder.js

@@ -195,7 +195,7 @@ var mkBuilder = function (state) {
 };
 
 // You Were Warned
-var execJs = function (js, builder, file, fileName, callback) {
+var execJs = function (js, builder, file, fileName, callback, content) {
     var res;
     var x;
     var err;
@@ -248,7 +248,8 @@ var execJs = function (js, builder, file, fileName, callback) {
                           builder);
         } catch (e) {
             err = e;
-            err.message += "\nContent: [" + js + "]";
+            err.message += "\nContent: [" + js + "] in File [" + fileName + "] ";
+                //"full content: [" + content + "]";
             clearTimeout(to);
             throw err;
         }
@@ -265,7 +266,7 @@ var execJs = function (js, builder, file, fileName, callback) {
 
 var debug = console.log;
 
-var preprocessBlock = function (block, builder, fileObj, fileName, callback) {
+var preprocessBlock = function (block, builder, fileObj, fileName, callback, content) {
     // a block is an array of strings and arrays, any inside arrays must be
     // preprocessed first. deep first top to bottom.
 
@@ -280,7 +281,7 @@ var preprocessBlock = function (block, builder, fileObj, fileName, callback) {
                 if (err) { throw err; }
 
                 block[i] = ret;
-            }));
+            }), content);
         }).nThen;
     });
 
@@ -291,7 +292,7 @@ var preprocessBlock = function (block, builder, fileObj, fileName, callback) {
         execJs(capture, builder, fileObj, fileName, waitFor(function (err, ret) {
             if (err) { throw err; }
             callback(undefined, ret);
-        }));
+        }), content);
 
     });
 };
@@ -333,7 +334,7 @@ var preprocess = function (content, builder, fileObj, fileName, callback) {
                 if (err) { throw err; }
 
                 elems[i] = ret;
-            }));
+            }), content);
         }).nThen;
     });
 

subnode/LinkState.h

@@ -68,19 +68,19 @@ static inline int LinkState_encode(
     Assert_true(!VarInt_push(&iter, ls->nodeId));
 
     int beginLength = msg->length;
-    Message_shift(msg, (msg->bytes - iter.ptr), NULL);
+    Er_assert(Message_eshift(msg, (msg->bytes - iter.ptr)));
     Assert_true(msg->bytes == iter.ptr);
 
     int padCount = 0;
     while ((uintptr_t)(&msg->bytes[-3]) & 7) {
-        Message_push8(msg, 0, NULL);
+        Er_assert(Message_epush8(msg, 0));
         padCount++;
     }
-    Message_push8(msg, padCount, NULL);
+    Er_assert(Message_epush8(msg, padCount));
 
-    Message_push8(msg, Announce_Type_LINK_STATE, NULL);
+    Er_assert(Message_epush8(msg, Announce_Type_LINK_STATE));
     int finalLength = msg->length - beginLength;
-    Message_push8(msg, finalLength + 1, NULL);
+    Er_assert(Message_epush8(msg, finalLength + 1));
 
     Assert_true(!(((uintptr_t)msg->bytes) & 7));
     return 0;

subnode/MsgCore.c

@@ -155,7 +155,7 @@ static void sendMsg(struct MsgCore_pvt* mcp,
     }
 
     struct Message* msg = Message_new(0, 2048, alloc);
-    BencMessageWriter_write(msgDict, msg, NULL);
+    Er_assert(BencMessageWriter_write(msgDict, msg));
 
     //Log_debug(mcp->log, "Sending msg [%s]", Escape_getEscaped(msg->bytes, msg->length, alloc));
 
@@ -166,7 +166,7 @@ static void sendMsg(struct MsgCore_pvt* mcp,
     Bits_memset(&data, 0, sizeof(struct DataHeader));
     DataHeader_setVersion(&data, DataHeader_CURRENT_VERSION);
     DataHeader_setContentType(&data, ContentType_CJDHT);
-    Message_push(msg, &data, sizeof(struct DataHeader), NULL);
+    Er_assert(Message_epush(msg, &data, sizeof(struct DataHeader)));
 
     struct RouteHeader route;
     Bits_memset(&route, 0, sizeof(struct RouteHeader));
@@ -174,7 +174,7 @@ static void sendMsg(struct MsgCore_pvt* mcp,
     route.version_be = Endian_hostToBigEndian32(addr->protocolVersion);
     route.sh.label_be = Endian_hostToBigEndian64(addr->path);
     Bits_memcpy(route.publicKey, addr->key, 32);
-    Message_push(msg, &route, sizeof(struct RouteHeader), NULL);
+    Er_assert(Message_epush(msg, &route, sizeof(struct RouteHeader)));
 
     Iface_send(&mcp->pub.interRouterIf, msg);
 }
@@ -281,7 +281,7 @@ static Iface_DEFUN incoming(struct Message* msg, struct Iface* interRouterIf)
 
     struct Address addr = { .padding = 0 };
     struct RouteHeader* hdr = (struct RouteHeader*) msg->bytes;
-    Message_shift(msg, -(RouteHeader_SIZE + DataHeader_SIZE), NULL);
+    Er_assert(Message_eshift(msg, -(RouteHeader_SIZE + DataHeader_SIZE)));
     Bits_memcpy(addr.ip6.bytes, hdr->ip6, 16);
     Bits_memcpy(addr.key, hdr->publicKey, 32);
     addr.protocolVersion = Endian_bigEndianToHost32(hdr->version_be);

subnode/ReachabilityAnnouncer.c

@@ -96,9 +96,9 @@ static void hashMsgList(struct ArrayList_OfMessages* msgList, uint8_t out[64])
     uint8_t hash[64] = {0};
     for (int i = 0; i < msgList->length; i++) {
         struct Message* msg = ArrayList_OfMessages_get(msgList, i);
-        Message_push(msg, hash, 64, NULL);
+        Er_assert(Message_epush(msg, hash, 64));
         crypto_hash_sha512(hash, msg->bytes, msg->length);
-        Message_pop(msg, NULL, 64, NULL);
+        Er_assert(Message_epop(msg, NULL, 64));
     }
     Bits_memcpy(out, hash, 64);
 }
@@ -240,7 +240,7 @@ static bool pushLinkState(struct ReachabilityAnnouncer_pvt* rap,
             Log_debug(rap->log, "Failed to add link state for [%s]", peerIpPrinted);
         }
         if (msg->length > 904) {
-            Message_pop(msg, NULL, msg->length - lastLen, NULL);
+            Er_assert(Message_epop(msg, NULL, msg->length - lastLen));
             Log_debug(rap->log, "Couldn't add link state for [%s] (out of space)", peerIpPrinted);
             return true;
         } else {
@@ -300,9 +300,9 @@ static int updatePeer(struct ReachabilityAnnouncer_pvt* rap,
         return updatePeer_ENOSPACE;
     }
 
-    Message_pop(rap->nextMsg, NULL, Announce_Header_SIZE, NULL);
-    Message_push(rap->nextMsg, refPeer, Announce_Peer_SIZE, NULL);
-    Message_push(rap->nextMsg, NULL, Announce_Header_SIZE, NULL);
+    Er_assert(Message_epop(rap->nextMsg, NULL, Announce_Header_SIZE));
+    Er_assert(Message_epush(rap->nextMsg, refPeer, Announce_Peer_SIZE));
+    Er_assert(Message_epush(rap->nextMsg, NULL, Announce_Header_SIZE));
     return (peer) ? updatePeer_UPDATE : updatePeer_ADD;
 }
 
@@ -348,7 +348,7 @@ static void setupNextMsg(struct ReachabilityAnnouncer_pvt* rap)
 {
     struct Allocator* msgAlloc = Allocator_child(rap->alloc);
     struct Message* nextMsg = Message_new(0, 1300, msgAlloc);
-    Message_push(nextMsg, NULL, Announce_Header_SIZE, NULL);
+    Er_assert(Message_epush(nextMsg, NULL, Announce_Header_SIZE));
     rap->nextMsg = nextMsg;
 }
 
@@ -668,7 +668,7 @@ static void onAnnounceCycle(void* vRap)
         loadAllState(rap, true);
     }
 
-    Message_pop(msg, NULL, Announce_Header_SIZE, NULL);
+    Er_assert(Message_epop(msg, NULL, Announce_Header_SIZE));
 
     if (pushLinkState(rap, msg)) {
         stateUpdate(rap, ReachabilityAnnouncer_State_LINKSTATE_FULL);
@@ -679,10 +679,10 @@ static void onAnnounceCycle(void* vRap)
         Announce_EncodingScheme_push(msg, rap->encodingSchemeStr);
         struct Announce_Version version;
         Announce_Version_init(&version);
-        Message_push(msg, &version, Announce_Version_SIZE, NULL);
+        Er_assert(Message_epush(msg, &version, Announce_Version_SIZE));
     }
 
-    Message_push(msg, NULL, Announce_Header_SIZE, NULL);
+    Er_assert(Message_epush(msg, NULL, Announce_Header_SIZE));
 
     struct Announce_Header* hdr = (struct Announce_Header*) msg->bytes;
     Bits_memset(hdr, 0, Announce_Header_SIZE);
@@ -692,7 +692,7 @@ static void onAnnounceCycle(void* vRap)
     Announce_Header_setTimestamp(hdr, snNow);
     Bits_memcpy(hdr->pubSigningKey, rap->pubSigningKey, 32);
     Bits_memcpy(hdr->snodeIp, rap->snode.ip6.bytes, 16);
-    Message_pop(msg, NULL, 64, NULL);
+    Er_assert(Message_epop(msg, NULL, 64));
     Sign_signMsg(rap->signingKeypair, msg, rap->rand);
 
     struct MsgCore_Promise* qp = MsgCore_createQuery(rap->msgCore, 0, rap->alloc);

subnode/SubnodePathfinder.c

@@ -105,12 +105,12 @@ static Iface_DEFUN sendNode(struct Message* msg,
                             struct SubnodePathfinder_pvt* pf)
 {
     Message_reset(msg);
-    Message_shift(msg, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_eshift(msg, PFChan_Node_SIZE));
     nodeForAddress((struct PFChan_Node*) msg->bytes, addr, metric);
     if (addr->path == UINT64_MAX) {
         ((struct PFChan_Node*) msg->bytes)->path_be = 0;
     }
-    Message_push32(msg, msgType, NULL);
+    Er_assert(Message_epush32be(msg, msgType));
     return Iface_next(&pf->pub.eventIf, msg);
 }
 
@@ -124,7 +124,7 @@ static Iface_DEFUN connected(struct SubnodePathfinder_pvt* pf, struct Message* m
 static uint32_t addressForNode(struct Address* addrOut, struct Message* msg)
 {
     struct PFChan_Node node;
-    Message_pop(msg, &node, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_epop(msg, &node, PFChan_Node_SIZE));
     Assert_true(!msg->length);
     addrOut->protocolVersion = Endian_bigEndianToHost32(node.version_be);
     addrOut->path = Endian_bigEndianToHost64(node.path_be);
@@ -136,7 +136,7 @@ static uint32_t addressForNode(struct Address* addrOut, struct Message* msg)
 static Iface_DEFUN switchErr(struct Message* msg, struct SubnodePathfinder_pvt* pf)
 {
     struct PFChan_Core_SwitchErr switchErr;
-    Message_pop(msg, &switchErr, PFChan_Core_SwitchErr_MIN_SIZE, NULL);
+    Er_assert(Message_epop(msg, &switchErr, PFChan_Core_SwitchErr_MIN_SIZE));
 
     uint64_t path = Endian_bigEndianToHost64(switchErr.sh.label_be);
 
@@ -194,9 +194,9 @@ static void getRouteReply(Dict* msg, struct Address* src, struct MsgCore_Promise
 static Iface_DEFUN searchReq(struct Message* msg, struct SubnodePathfinder_pvt* pf)
 {
     uint8_t addr[16];
-    Message_pop(msg, addr, 16, NULL);
-    Message_pop32(msg, NULL);
-    uint32_t version = Message_pop32(msg, NULL);
+    Er_assert(Message_epop(msg, addr, 16));
+    Er_assert(Message_epop32be(msg));
+    uint32_t version = Er_assert(Message_epop32be(msg));
     if (version && version < 20) { return NULL; }
     Assert_true(!msg->length);
     uint8_t printedAddr[40];
@@ -345,7 +345,7 @@ static Iface_DEFUN discoveredPath(struct Message* msg, struct SubnodePathfinder_
 static Iface_DEFUN handlePing(struct Message* msg, struct SubnodePathfinder_pvt* pf)
 {
     //Log_debug(pf->log, "Received ping");
-    Message_push32(msg, PFChan_Pathfinder_PONG, NULL);
+    Er_assert(Message_epush32be(msg, PFChan_Pathfinder_PONG));
     return Iface_next(&pf->pub.eventIf, msg);
 }
 
@@ -359,7 +359,7 @@ static Iface_DEFUN ctrlMsgFromSwitchPinger(struct Message* msg, struct Iface* if
 {
     struct SubnodePathfinder_pvt* pf =
         Identity_containerOf(iface, struct SubnodePathfinder_pvt, switchPingerIf);
-    Message_push32(msg, PFChan_Pathfinder_CTRL_SENDMSG, NULL);
+    Er_assert(Message_epush32be(msg, PFChan_Pathfinder_CTRL_SENDMSG));
     return Iface_next(&pf->pub.eventIf, msg);
 }
 
@@ -396,7 +396,7 @@ static void unsetupSessionPingReply(Dict* msg, struct Address* src, struct MsgCo
 static Iface_DEFUN unsetupSession(struct Message* msg, struct SubnodePathfinder_pvt* pf)
 {
     struct PFChan_Node node;
-    Message_pop(msg, &node, PFChan_Node_SIZE, NULL);
+    Er_assert(Message_epop(msg, &node, PFChan_Node_SIZE));
     Assert_true(!msg->length);
     struct Query q = { .routeFrom = { 0 } };
     struct Address* addr = &q.target;
@@ -447,7 +447,7 @@ static Iface_DEFUN linkState(struct Message* msg, struct SubnodePathfinder_pvt*
 {
     while (msg->length) {
         struct PFChan_LinkState_Entry lse;
-        Message_pop(msg, &lse, PFChan_LinkState_Entry_SIZE, NULL);
+        Er_assert(Message_epop(msg, &lse, PFChan_LinkState_Entry_SIZE));
         ReachabilityCollector_updateBandwidthAndDrops(
             pf->pub.rc,
             lse.peerLabel,
@@ -469,7 +469,7 @@ static Iface_DEFUN incomingFromMsgCore(struct Message* msg, struct Iface* iface)
     Assert_true(!Bits_isZero(rh->publicKey, 32));
     Assert_true(rh->version_be);
     Assert_true(rh->sh.label_be);
-    Message_push32(msg, PFChan_Pathfinder_SENDMSG, NULL);
+    Er_assert(Message_epush32be(msg, PFChan_Pathfinder_SENDMSG));
     return Iface_next(&pf->pub.eventIf, msg);
 }
 
@@ -477,7 +477,7 @@ static Iface_DEFUN incomingFromEventIf(struct Message* msg, struct Iface* eventI
 {
     struct SubnodePathfinder_pvt* pf =
         Identity_containerOf(eventIf, struct SubnodePathfinder_pvt, pub.eventIf);
-    enum PFChan_Core ev = Message_pop32(msg, NULL);
+    enum PFChan_Core ev = Er_assert(Message_epop32be(msg));
     if (SubnodePathfinder_pvt_state_INITIALIZING == pf->state) {
         Assert_true(ev == PFChan_Core_CONNECT);
         return connected(pf, msg);
@@ -508,8 +508,8 @@ static void sendEvent(struct SubnodePathfinder_pvt* pf,
 {
     struct Allocator* alloc = Allocator_child(pf->alloc);
     struct Message* msg = Message_new(0, 512+size, alloc);
-    Message_push(msg, data, size, NULL);
-    Message_push32(msg, ev, NULL);
+    Er_assert(Message_epush(msg, data, size));
+    Er_assert(Message_epush32be(msg, ev));
     Iface_send(&pf->pub.eventIf, msg);
     Allocator_free(alloc);
 }

subnode/test/LinkState_test.c

@@ -81,7 +81,7 @@ static void applyStateUpdates(struct LinkState* local, struct Message* msg)
     uint32_t id = 0;
     Assert_true(!LinkState_getNodeId(&it, &id));
     Assert_true(id == local->nodeId);
-    Message_shift(msg, -length, NULL);
+    Er_assert(Message_eshift(msg, -length));
     applyStateUpdates(local, msg);
     Assert_true(!LinkState_decode(&it, local));
 }

switch/SwitchCore.c

@@ -88,10 +88,9 @@ static inline Iface_DEFUN sendError(struct SwitchInterface* iface,
         (cause->length < Control_Error_MAX_SIZE) ? cause->length : Control_Error_MAX_SIZE;
 
     // Shift back so we can add another header.
-    Message_push(cause,
+    Er_assert(Message_epush(cause,
                  NULL,
-                 SwitchHeader_SIZE + 4 + Control_Header_SIZE + Control_Error_HEADER_SIZE,
-                 NULL);
+                 SwitchHeader_SIZE + 4 + Control_Header_SIZE + Control_Error_HEADER_SIZE));
     struct ErrorPacket8* err = (struct ErrorPacket8*) cause->bytes;
 
     err->switchHeader.label_be = Bits_bitReverse64(causeHeader->label_be);

test/Beacon_test.c

@@ -71,8 +71,9 @@ struct TwoNodes
 static Iface_DEFUN incomingTunB(struct Message* msg, struct Iface* tunB)
 {
     struct TwoNodes* tn = Identity_containerOf(tunB, struct TwoNodes, tunB);
-    Assert_true(TUNMessageType_pop(msg, NULL) == Ethernet_TYPE_IP6);
-    Message_shift(msg, -Headers_IP6Header_SIZE, NULL);
+    uint16_t t = Er_assert(TUNMessageType_pop(msg));
+    Assert_true(t == Ethernet_TYPE_IP6);
+    Er_assert(Message_eshift(msg, -Headers_IP6Header_SIZE));
     printf("Message from TUN in node B [%s]\n", msg->bytes);
     tn->messageFrom = TUNB;
     return 0;
@@ -81,8 +82,9 @@ static Iface_DEFUN incomingTunB(struct Message* msg, struct Iface* tunB)
 static Iface_DEFUN incomingTunA(struct Message* msg, struct Iface* tunA)
 {
     struct TwoNodes* tn = Identity_containerOf(tunA, struct TwoNodes, tunA);
-    Assert_true(TUNMessageType_pop(msg, NULL) == Ethernet_TYPE_IP6);
-    Message_shift(msg, -Headers_IP6Header_SIZE, NULL);
+    uint16_t t = Er_assert(TUNMessageType_pop(msg));
+    Assert_true(t == Ethernet_TYPE_IP6);
+    Er_assert(Message_eshift(msg, -Headers_IP6Header_SIZE));
     uint8_t buff[1024];
     Hex_encode(buff, 1024, msg->bytes, msg->length);
     printf("Message from TUN in node A [%s] [%d] [%s]\n", msg->bytes, msg->length, buff);
@@ -185,13 +187,24 @@ static void start(struct Allocator* alloc,
     Log_debug(a->logger, "Waiting for nodes to link asynchronously...");
 }
 
+
+#define STACKMSG(name, messageLength, amountOfPadding) \
+    uint8_t UniqueName_get()[messageLength + amountOfPadding]; \
+    name = &(struct Message){                                  \
+        .length = messageLength,                               \
+        .bytes = UniqueName_last() + amountOfPadding,          \
+        .padding = amountOfPadding,                            \
+        .capacity = messageLength                              \
+    }
+
+
 static void sendMessage(struct TwoNodes* tn,
                         char* message,
                         struct TestFramework* from,
                         struct TestFramework* to)
 {
     struct Message* msg;
-    Message_STACK(msg, 64, 512);
+    STACKMSG(msg, 64, 512);
 
     Bits_memcpy(msg->bytes, message, CString_strlen(message) + 1);
     msg->length = CString_strlen(message) + 1;
@@ -210,7 +223,7 @@ static void sendMessage(struct TwoNodes* tn,
         Assert_true(false);
     }
 
-    TUNMessageType_push(msg, Ethernet_TYPE_IP6, NULL);
+    Er_assert(TUNMessageType_push(msg, Ethernet_TYPE_IP6));
     Iface_send(fromIf, msg);
 
     if (to == tn->nodeA) {

test/Main_fuzz_test.c

@@ -171,7 +171,7 @@ void CJDNS_FUZZ_MAIN(void* vctx, struct Message* msg)
         .length_be = Endian_hostToBigEndian16(msg->length + Headers_UDPHeader_SIZE),
         .checksum_be = 0,
     };
-    Message_push(msg, &udp, Headers_UDPHeader_SIZE, NULL);
+    Er_assert(Message_epush(msg, &udp, Headers_UDPHeader_SIZE));
     uint8_t srcAndDest[32] = { [31] = 1 };
     // fc00::1
     AddressCalc_makeValidAddress(&srcAndDest[16]);
@@ -182,7 +182,7 @@ void CJDNS_FUZZ_MAIN(void* vctx, struct Message* msg)
     TestFramework_craftIPHeader(msg, srcAndDest, &srcAndDest[16]);
     ((struct Headers_IP6Header*) msg->bytes)->nextHeader = 17;
 
-    TUNMessageType_push(msg, Ethernet_TYPE_IP6, NULL);
+    Er_assert(TUNMessageType_push(msg, Ethernet_TYPE_IP6));
 
     Iface_send(&ctx->tunA, Message_clone(msg, from->alloc));
 

test/TestFramework.c

@@ -234,7 +234,7 @@ void TestFramework_linkNodes(struct TestFramework* client,
 
 void TestFramework_craftIPHeader(struct Message* msg, uint8_t srcAddr[16], uint8_t destAddr[16])
 {
-    Message_shift(msg, Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_eshift(msg, Headers_IP6Header_SIZE));
     struct Headers_IP6Header* ip = (struct Headers_IP6Header*) msg->bytes;
 
     ip->versionClassAndFlowLabel = 0;

test/testcjdroute.c

@@ -132,7 +132,7 @@ static int runFuzzTest(
     int quiet)
 {
     if (fuzz->length < 4) { return 100; }
-    uint32_t selector = Message_pop32(fuzz, NULL);
+    uint32_t selector = Er_assert(Message_epop32be(fuzz));
     if (selector >= (uint32_t)FUZZ_TEST_COUNT) {
         printf("selector [%x] out of bounds [%u]\n", selector, FUZZ_TEST_COUNT);
         return 100;

tunnel/IpTunnel.c

@@ -199,11 +199,11 @@ static Iface_DEFUN sendToNode(struct Message* message,
                               struct IpTunnel_Connection* connection,
                               struct IpTunnel_pvt* context)
 {
-    Message_push(message, NULL, DataHeader_SIZE, NULL);
+    Er_assert(Message_epush(message, NULL, DataHeader_SIZE));
     struct DataHeader* dh = (struct DataHeader*) message->bytes;
     DataHeader_setContentType(dh, ContentType_IPTUN);
     DataHeader_setVersion(dh, DataHeader_CURRENT_VERSION);
-    Message_push(message, &connection->routeHeader, RouteHeader_SIZE, NULL);
+    Er_assert(Message_epush(message, &connection->routeHeader, RouteHeader_SIZE));
     return Iface_next(&context->pub.nodeInterface, message);
 }
 
@@ -213,12 +213,12 @@ static void sendControlMessage(Dict* dict,
                                struct IpTunnel_pvt* context)
 {
     struct Message* msg = Message_new(0, 1024, requestAlloc);
-    BencMessageWriter_write(dict, msg, NULL);
+    Er_assert(BencMessageWriter_write(dict, msg));
 
     int length = msg->length;
 
     // do UDP header.
-    Message_shift(msg, Headers_UDPHeader_SIZE, NULL);
+    Er_assert(Message_eshift(msg, Headers_UDPHeader_SIZE));
     struct Headers_UDPHeader* uh = (struct Headers_UDPHeader*) msg->bytes;
     uh->srcPort_be = 0;
     uh->destPort_be = 0;
@@ -227,7 +227,7 @@ static void sendControlMessage(Dict* dict,
 
     uint16_t payloadLength = msg->length;
 
-    Message_shift(msg, Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_eshift(msg, Headers_IP6Header_SIZE));
     struct Headers_IP6Header* header = (struct Headers_IP6Header*) msg->bytes;
     header->versionClassAndFlowLabel = 0;
     header->flowLabelLow_be = 0;
@@ -323,7 +323,7 @@ static bool isControlMessageInvalid(struct Message* message, struct IpTunnel_pvt
         return true;
     }
 
-    Message_shift(message, -Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_eshift(message, -Headers_IP6Header_SIZE));
     struct Headers_UDPHeader* udp = (struct Headers_UDPHeader*) message->bytes;
 
     if (Checksum_udpIp6(header->sourceAddr, message->bytes, length)) {
@@ -340,7 +340,7 @@ static bool isControlMessageInvalid(struct Message* message, struct IpTunnel_pvt
         return true;
     }
 
-    Message_shift(message, -Headers_UDPHeader_SIZE, NULL);
+    Er_assert(Message_eshift(message, -Headers_UDPHeader_SIZE));
 
     message->length = length;
     return false;
@@ -739,7 +739,7 @@ static Iface_DEFUN ip6FromNode(struct Message* message,
         return 0;
     }
 
-    TUNMessageType_push(message, Ethernet_TYPE_IP6, NULL);
+    Er_assert(TUNMessageType_push(message, Ethernet_TYPE_IP6));
     return Iface_next(&context->pub.tunInterface, message);
 }
 
@@ -762,7 +762,7 @@ static Iface_DEFUN ip4FromNode(struct Message* message,
         return 0;
     }
 
-    TUNMessageType_push(message, Ethernet_TYPE_IP4, NULL);
+    Er_assert(TUNMessageType_push(message, Ethernet_TYPE_IP4));
     return Iface_next(&context->pub.tunInterface, message);
 }
 
@@ -787,7 +787,7 @@ static Iface_DEFUN incomingFromNode(struct Message* message, struct Iface* nodeI
         return 0;
     }
 
-    Message_shift(message, -(RouteHeader_SIZE + DataHeader_SIZE), NULL);
+    Er_assert(Message_eshift(message, -(RouteHeader_SIZE + DataHeader_SIZE)));
 
     if (message->length > 40 && Headers_getIpVersion(message->bytes) == 6) {
         return ip6FromNode(message, conn, context);

tunnel/test/IpTunnel_test.c

@@ -64,7 +64,7 @@ static Iface_DEFUN responseWithIpCallback(struct Message* message, struct Iface*
     Assert_true(!Bits_memcmp(ctx->ipv6, rh->ip6, 16));
     Assert_true(!Bits_memcmp(ctx->pubKey, rh->publicKey, 32));
 
-    Message_shift(message, -(RouteHeader_SIZE + DataHeader_SIZE), NULL);
+    Er_assert(Message_eshift(message, -(RouteHeader_SIZE + DataHeader_SIZE)));
     struct Headers_IP6Header* ip = (struct Headers_IP6Header*) message->bytes;
     Assert_true(Headers_getIpVersion(ip) == 6);
     uint16_t length = Endian_bigEndianToHost16(ip->payloadLength_be);
@@ -72,7 +72,7 @@ static Iface_DEFUN responseWithIpCallback(struct Message* message, struct Iface*
     Assert_true(ip->nextHeader == 17);
     Assert_true(Bits_isZero(ip->sourceAddr, 32));
 
-    Message_shift(message, -Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_eshift(message, -Headers_IP6Header_SIZE));
     struct Headers_UDPHeader* uh = (struct Headers_UDPHeader*) message->bytes;
     Assert_true(!Checksum_udpIp6(ip->sourceAddr, message->bytes, length));
 
@@ -80,7 +80,7 @@ static Iface_DEFUN responseWithIpCallback(struct Message* message, struct Iface*
     Assert_true(uh->destPort_be == 0);
     Assert_true(Endian_bigEndianToHost16(uh->length_be) + Headers_UDPHeader_SIZE == length);
 
-    Message_shift(message, -Headers_UDPHeader_SIZE, NULL);
+    Er_assert(Message_eshift(message, -Headers_UDPHeader_SIZE));
 
     struct Allocator* alloc = Allocator_child(ctx->alloc);
     char* messageContent = Escape_getEscaped(message->bytes, message->length, alloc);
@@ -103,18 +103,18 @@ static Iface_DEFUN responseWithIpCallback(struct Message* message, struct Iface*
 static Iface_DEFUN messageToTun(struct Message* msg, struct Iface* iface)
 {
     struct Context* ctx = Identity_check(((struct IfaceContext*)iface)->ctx);
-    uint16_t type = TUNMessageType_pop(msg, NULL);
+    uint16_t type = Er_assert(TUNMessageType_pop(msg));
     if (type == Ethernet_TYPE_IP6) {
         struct Headers_IP6Header* ip = (struct Headers_IP6Header*) msg->bytes;
         Assert_true(Headers_getIpVersion(ip) == 6);
         Assert_true(!Bits_memcmp(ip->sourceAddr, ctx->sendingAddress, 16));
-        Message_shift(msg, -Headers_IP6Header_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Headers_IP6Header_SIZE));
         ctx->called |= 4;
     } else if (type == Ethernet_TYPE_IP4) {
         struct Headers_IP4Header* ip = (struct Headers_IP4Header*) msg->bytes;
         Assert_true(Headers_getIpVersion(ip) == 4);
         Assert_true(!Bits_memcmp(ip->sourceAddr, ctx->sendingAddress, 4));
-        Message_shift(msg, -Headers_IP4Header_SIZE, NULL);
+        Er_assert(Message_eshift(msg, -Headers_IP4Header_SIZE));
         ctx->called |= 1;
     } else {
         Assert_failure("unrecognized message type %u", (unsigned int)type);
@@ -125,7 +125,7 @@ static Iface_DEFUN messageToTun(struct Message* msg, struct Iface* iface)
 
 static void pushRouteDataHeaders(struct Context* ctx, struct Message* message)
 {
-    Message_shift(message, RouteHeader_SIZE + DataHeader_SIZE, NULL);
+    Er_assert(Message_eshift(message, RouteHeader_SIZE + DataHeader_SIZE));
     struct RouteHeader* rh = (struct RouteHeader*) message->bytes;
     struct DataHeader* dh = (struct DataHeader*) &rh[1];
     Bits_memset(rh, 0, RouteHeader_SIZE + DataHeader_SIZE);
@@ -140,8 +140,8 @@ static bool trySend4(struct Allocator* alloc,
                      struct Context* ctx)
 {
     struct Message* msg4 = Message_new(0, 512, alloc);
-    Message_push(msg4, "hello world", 12, NULL);
-    Message_push(msg4, NULL, Headers_IP4Header_SIZE, NULL);
+    Er_assert(Message_epush(msg4, "hello world", 12));
+    Er_assert(Message_epush(msg4, NULL, Headers_IP4Header_SIZE));
     struct Headers_IP4Header* iph = (struct Headers_IP4Header*) msg4->bytes;
     Headers_setIpVersion(iph);
     uint32_t addr_be = Endian_hostToBigEndian32(addr);
@@ -165,8 +165,8 @@ static bool trySend6(struct Allocator* alloc,
                      struct Context* ctx)
 {
     struct Message* msg6 = Message_new(0, 512, alloc);
-    Message_push(msg6, "hello world", 12, NULL);
-    Message_push(msg6, NULL, Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_epush(msg6, "hello world", 12));
+    Er_assert(Message_epush(msg6, NULL, Headers_IP6Header_SIZE));
     struct Headers_IP6Header* iph = (struct Headers_IP6Header*) msg6->bytes;
     Headers_setIpVersion(iph);
     uint64_t addrHigh_be = Endian_hostToBigEndian64(addrHigh);
@@ -215,7 +215,7 @@ static String* getExpectedResponse(struct Sockaddr* sa4, int prefix4, int alloc4
     Dict_putDict(output, String_new("addresses", alloc), addresses, alloc);
     Dict_putString(output, String_new("txid", alloc), String_new("abcd", alloc), alloc);
     struct Message* msg = Message_new(0, 512, alloc);
-    BencMessageWriter_write(output, msg, NULL);
+    Er_assert(BencMessageWriter_write(output, msg));
 
     String* outStr = String_newBinary(msg->bytes, msg->length, allocator);
     Allocator_free(alloc);
@@ -259,7 +259,7 @@ static void testAddr(struct Context* ctx,
     CString_strcpy(msg->bytes, requestForAddresses);
     msg->length = CString_strlen(requestForAddresses);
 
-    Message_push(msg, NULL, Headers_UDPHeader_SIZE, NULL);
+    Er_assert(Message_epush(msg, NULL, Headers_UDPHeader_SIZE));
     struct Headers_UDPHeader* uh = (struct Headers_UDPHeader*) msg->bytes;
     uh->length_be = Endian_hostToBigEndian16(msg->length - Headers_UDPHeader_SIZE);
 
@@ -268,7 +268,7 @@ static void testAddr(struct Context* ctx,
     uint32_t length = msg->length;
 
     // Because of old reasons, we need to have at least an empty IPv6 header
-    Message_push(msg, NULL, Headers_IP6Header_SIZE, NULL);
+    Er_assert(Message_epush(msg, NULL, Headers_IP6Header_SIZE));
     struct Headers_IP6Header* ip = (struct Headers_IP6Header*) msg->bytes;
     Headers_setIpVersion(ip);
     ip->payloadLength_be = Endian_hostToBigEndian16(msg->length - Headers_IP6Header_SIZE);

util/Base10.c

@@ -20,22 +20,23 @@
 
 #include <stdbool.h>
 
-void Base10_write(struct Message* msg, int64_t num, struct Except* eh)
+Er_DEFUN(void Base10_write(struct Message* msg, int64_t num))
 {
     bool negative = num < 0;
     if (negative) {
         num = -num;
     } else if (num == 0) {
-        Message_push8(msg, '0', eh);
-        return;
+        Er(Message_epush8(msg, '0'));
+        Er_ret();
     }
     while (num > 0) {
-        Message_push8(msg, '0' + (num % 10), eh);
+        Er(Message_epush8(msg, '0' + (num % 10)));
         num /= 10;
     }
     if (negative) {
-        Message_push8(msg, '-', eh);
+        Er(Message_epush8(msg, '-'));
     }
+    Er_ret();
 }
 
 Er_DEFUN(int64_t Base10_read(struct Message* msg))

util/Base10.h

@@ -16,14 +16,13 @@
 #define Base10_H
 
 #include "exception/Er.h"
-#include "exception/Except.h"
 #include "wire/Message.h"
 #include "util/Linker.h"
 Linker_require("util/Base10.c");
 
 #include <stdint.h>
 
-void Base10_write(struct Message* msg, int64_t num, struct Except* eh);
+Er_DEFUN(void Base10_write(struct Message* msg, int64_t num));
 Er_DEFUN(int64_t Base10_read(struct Message* msg));
 int Base10_fromString(uint8_t* str, int64_t* numOut);
 

util/Gcc.h

@@ -94,8 +94,10 @@
     #define Gcc_USE_RET
 #endif
 
+Js({ file.Gcc_shortFile = (x) => '"' + x.substring(x.lastIndexOf('/')+1) + '"'; })
+
 #define Gcc_SHORT_FILE \
-    Js_or({ return '"'+__FILE__.substring(__FILE__.lastIndexOf('/')+1)+'"' }, __FILE__)
+    Js_or({ return file.Gcc_shortFile(__FILE__); }, __FILE__)
 
 #define Gcc_FILE Gcc_SHORT_FILE
 #define Gcc_LINE __LINE__

util/events/libuv/FakeNetwork.c

@@ -61,16 +61,16 @@ struct FakeNetwork_UDPIface_pvt
 static void popSockaddr(struct Message* msg, struct Sockaddr_storage* ss)
 {
     uint64_t length = 0;
-    Message_pop(msg, &length, 8, NULL);
-    Message_shift(msg, 8, NULL);
+    Er_assert(Message_epop(msg, &length, 8));
+    Er_assert(Message_eshift(msg, 8));
     Assert_true(length >= Sockaddr_OVERHEAD);
     Assert_true(length <= sizeof(struct Sockaddr_storage));
-    Message_pop(msg, ss, length, NULL);
+    Er_assert(Message_epop(msg, ss, length));
 }
 
 static void pushSockaddr(struct Message* msg, struct Sockaddr* sa)
 {
-    Message_push(msg, sa, sa->addrLen, NULL);
+    Er_assert(Message_epush(msg, sa, sa->addrLen));
 }
 
 static Iface_DEFUN fromAsync(struct Message* msg, struct Iface* fnpFromAsync)

util/events/libuv/PipeServer.c

@@ -74,7 +74,7 @@ struct PipeServer_pvt
 static Iface_DEFUN sendMessage(struct Message* m, struct Iface* iface)
 {
     struct PipeServer_pvt* psp = Identity_check((struct PipeServer_pvt*) iface);
-    struct Sockaddr* addr = AddrIface_popAddr(m, NULL);
+    struct Sockaddr* addr = Er_assert(AddrIface_popAddr(m));
     uint32_t handle = Sockaddr_addrHandle(addr);
     int idx = Map_Clients_indexForHandle(handle, &psp->clients);
     if (idx < 0) {
@@ -89,7 +89,7 @@ static Iface_DEFUN incomingFromClient(struct Message* msg, struct Iface* iface)
 {
     struct Client* cli = Identity_containerOf(iface, struct Client, iface);
     struct PipeServer_pvt* psp = Identity_check(cli->psp);
-    AddrIface_pushAddr(msg, &cli->addr, NULL);
+    Er_assert(AddrIface_pushAddr(msg, &cli->addr));
     return Iface_next(&psp->pub.iface.iface, msg);
 }
 

util/events/libuv/UDPAddrIface.c

@@ -111,7 +111,7 @@ static Iface_DEFUN incomingFromIface(struct Message* m, struct Iface* iface)
     Identity_set(req);
 
     struct Sockaddr_storage ss;
-    Message_pop(m, &ss, context->pub.generic.addr->addrLen, NULL);
+    Er_assert(Message_epop(m, &ss, context->pub.generic.addr->addrLen));
     Assert_true(ss.addr.addrLen == context->pub.generic.addr->addrLen);
 
     req->length = m->length;
@@ -164,13 +164,13 @@ static void incoming(uv_udp_t* handle,
         m->capacity = buf->len;
         m->bytes = (uint8_t*)buf->base;
         m->alloc = alloc;
-        Message_push(m, addr, context->pub.generic.addr->addrLen - Sockaddr_OVERHEAD, NULL);
+        Er_assert(Message_epush(m, addr, context->pub.generic.addr->addrLen - Sockaddr_OVERHEAD));
 
         // make sure the sockaddr doesn't have crap in it which will
         // prevent it from being used as a lookup key
         Sockaddr_normalizeNative((struct sockaddr*) m->bytes);
 
-        Message_push(m, context->pub.generic.addr, Sockaddr_OVERHEAD, NULL);
+        Er_assert(Message_epush(m, context->pub.generic.addr, Sockaddr_OVERHEAD));
 
         /*uint8_t buff[256] = {0};
         Assert_true(Hex_encode(buff, 255, m->bytes, context->pub.generic.addr->addrLen));

util/test/Base10_test.c

@@ -34,11 +34,11 @@ int main()
     for (int i = 0; i < 1000; i++) {
         // zero it
         Message_reset(msg);
-        Message_push(msg, NULL, 32, NULL);
+        Er_assert(Message_epush(msg, NULL, 32));
         Message_reset(msg);
 
         long long num = Random_int64(rand);
-        Base10_write(msg, num, NULL);
+        Er_assert(Base10_write(msg, num));
 
         snprintf(buff, 31, "%lld", num);
 

util/test/Map_fuzz_test.c

@@ -33,7 +33,7 @@ void CJDNS_FUZZ_MAIN(void* vctx, struct Message* fuzz)
 {
     struct Allocator* alloc = (struct Allocator*) vctx;
     if (fuzz->length < 4) { return; }
-    uint32_t size = Message_pop16(fuzz, NULL) % 4096;
+    uint32_t size = Er_assert(Message_epop16be(fuzz)) % 4096;
 
     struct Map_OfLongsByInteger* map = Map_OfLongsByInteger_new(alloc);
     size = size % 4096;

util/test/Process_test.c

@@ -57,8 +57,8 @@ static void onConnectionParent(struct PipeServer* p, struct Sockaddr* addr)
     struct Context* c = Identity_check((struct Context*) p->userData);
     struct Allocator* alloc = Allocator_child(c->alloc);
     struct Message* msg = Message_new(0, 256, alloc);
-    Message_push(msg, MESSAGE, CString_strlen(MESSAGE) + 1, NULL);
-    AddrIface_pushAddr(msg, addr, NULL);
+    Er_assert(Message_epush(msg, MESSAGE, CString_strlen(MESSAGE) + 1));
+    Er_assert(AddrIface_pushAddr(msg, addr));
     if (!Defined(win32)) {
         Message_setAssociatedFd(msg, c->fd);
     }
@@ -70,7 +70,7 @@ static void onConnectionParent(struct PipeServer* p, struct Sockaddr* addr)
 static Iface_DEFUN receiveMessageParent(struct Message* msg, struct Iface* iface)
 {
     struct Context* c = Identity_check((struct Context*) iface);
-    AddrIface_popAddr(msg, NULL);
+    Er_assert(AddrIface_popAddr(msg));
     Assert_true(msg->length == (int)CString_strlen(MESSAGEB)+1);
     Assert_true(!Bits_memcmp(msg->bytes, MESSAGEB, CString_strlen(MESSAGEB)+1));
     Allocator_free(c->alloc);
@@ -114,8 +114,8 @@ static Iface_DEFUN receiveMessageChild(struct Message* msg, struct Iface* iface)
         }
     }
 
-    Message_shift(m, -((int)CString_strlen(MESSAGE)), NULL);
-    Message_push(m, MESSAGEB, CString_strlen(MESSAGEB), NULL);
+    Er_assert(Message_eshift(m, -((int)CString_strlen(MESSAGE))));
+    Er_assert(Message_epush(m, MESSAGEB, CString_strlen(MESSAGEB)));
 
     Iface_send(&c->iface, m);
 

util/test/Seccomp_test.c

@@ -57,7 +57,7 @@ static void onConnectionChild(struct Pipe* pipe, int status)
     Assert_true(Seccomp_isWorking());
 
     struct Message* ok = Message_new(0, 512, child->alloc);
-    Message_push(ok, "OK", 3, NULL);
+    Er_assert(Message_epush(ok, "OK", 3));
 
     struct Iface iface = { .send = NULL };
     Iface_plumb(&pipe->iface, &iface);
@@ -98,7 +98,7 @@ static Iface_DEFUN receiveMessageParent(struct Message* msg, struct Iface* iface
 {
     struct Context* ctx = Identity_check((struct Context*) iface);
     // PipeServer pushes a uint32 identifier of the client who sent the message
-    AddrIface_popAddr(msg, NULL);
+    Er_assert(AddrIface_popAddr(msg));
     Assert_true(msg->length == 3);
     Assert_true(!Bits_memcmp(msg->bytes, "OK", 3));
     EventBase_endLoop(ctx->eventBase);

wire/Announce.h

@@ -74,11 +74,11 @@ struct Announce_EncodingScheme
 static inline void Announce_EncodingScheme_push(struct Message* pushTo, String* compressedScheme)
 {
     Assert_true(compressedScheme->len + 2 < 256);
-    Message_push(pushTo, compressedScheme->bytes, compressedScheme->len, NULL);
-    Message_push8(pushTo, Announce_Type_ENCODING_SCHEME, NULL);
-    Message_push8(pushTo, compressedScheme->len + 2, NULL);
+    Er_assert(Message_epush(pushTo, compressedScheme->bytes, compressedScheme->len));
+    Er_assert(Message_epush8(pushTo, Announce_Type_ENCODING_SCHEME));
+    Er_assert(Message_epush8(pushTo, compressedScheme->len + 2));
     while ((uintptr_t)pushTo->bytes % 4) {
-        Message_push8(pushTo, 1, NULL);
+        Er_assert(Message_epush8(pushTo, 1));
     }
 }
 

wire/Message.c

@@ -0,0 +1,85 @@
+/* vim: set expandtab ts=4 sw=4: */
+/*
+ * You may redistribute this program and/or modify it under the terms of
+ * the GNU General Public License as published by the Free Software Foundation,
+ * either version 3 of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+#include "wire/Message.h"
+#include "util/UniqueName.h"
+
+struct Message* Message_new(uint32_t messageLength,
+                                          uint32_t amountOfPadding,
+                                          struct Allocator* alloc)
+{
+    uint8_t* buff = Allocator_malloc(alloc, messageLength + amountOfPadding);
+    struct Message* out = Allocator_calloc(alloc, sizeof(struct Message), 1);
+    out->bytes = &buff[amountOfPadding];
+    out->length = out->capacity = messageLength;
+    out->padding = amountOfPadding;
+    out->alloc = alloc;
+    return out;
+}
+
+void Message_setAssociatedFd(struct Message* msg, int fd)
+{
+    if (fd == -1) {
+        msg->associatedFd = 0;
+    } else if (fd == 0) {
+        msg->associatedFd = -1;
+    } else {
+        msg->associatedFd = fd;
+    }
+}
+
+int Message_getAssociatedFd(struct Message* msg)
+{
+    if (msg->associatedFd == -1) {
+        return 0;
+    } else if (msg->associatedFd == 0) {
+        return -1;
+    } else {
+        return msg->associatedFd;
+    }
+}
+
+struct Message* Message_clone(struct Message* toClone, struct Allocator* alloc)
+{
+    Assert_true(toClone->capacity >= toClone->length);
+    int32_t len = toClone->capacity + toClone->padding;
+    uint8_t* allocation = Allocator_malloc(alloc, len + 8);
+    while (((uintptr_t)allocation % 8) != (((uintptr_t)toClone->bytes - toClone->padding) % 8)) {
+        allocation++;
+    }
+    Bits_memcpy(allocation, toClone->bytes - toClone->padding, len);
+    return Allocator_clone(alloc, (&(struct Message) {
+        .length = toClone->length,
+        .padding = toClone->padding,
+        .bytes = allocation + toClone->padding,
+        .capacity = toClone->capacity,
+        .alloc = alloc
+    }));
+}
+
+void Message_copyOver(struct Message* output,
+                                    struct Message* input,
+                                    struct Allocator* allocator)
+{
+    size_t inTotalLength = input->length + input->padding;
+    size_t outTotalLength = output->length + output->padding;
+    uint8_t* allocation = output->bytes - output->padding;
+    if (inTotalLength > outTotalLength) {
+        allocation = Allocator_realloc(allocator, allocation, inTotalLength);
+    }
+    Bits_memcpy(allocation, input->bytes - input->padding, inTotalLength);
+    output->bytes = allocation + input->padding;
+    output->length = input->length;
+    output->padding = input->padding;
+}

wire/Message.h

@@ -16,11 +16,11 @@
 #define Message_H
 
 #include "exception/Er.h"
-#include "exception/Except.h"
 #include "memory/Allocator.h"
 #include "util/Bits.h"
 #include "util/Endian.h"
-#include "util/UniqueName.h"
+#include "util/Linker.h"
+Linker_require("wire/Message.c");
 
 #include <stdint.h>
 
@@ -54,104 +54,24 @@ struct Message
     struct Allocator* alloc;
 };
 
-#define Message_STACK(name, messageLength, amountOfPadding) \
-    uint8_t UniqueName_get()[messageLength + amountOfPadding]; \
-    name = &(struct Message){                                  \
-        .length = messageLength,                               \
-        .bytes = UniqueName_last() + amountOfPadding,          \
-        .padding = amountOfPadding,                            \
-        .capacity = messageLength                              \
-    }
-
-static inline struct Message* Message_new(uint32_t messageLength,
+struct Message* Message_new(uint32_t messageLength,
                                           uint32_t amountOfPadding,
-                                          struct Allocator* alloc)
-{
-    uint8_t* buff = Allocator_malloc(alloc, messageLength + amountOfPadding);
-    struct Message* out = Allocator_calloc(alloc, sizeof(struct Message), 1);
-    out->bytes = &buff[amountOfPadding];
-    out->length = out->capacity = messageLength;
-    out->padding = amountOfPadding;
-    out->alloc = alloc;
-    return out;
-}
+                                          struct Allocator* alloc);
 
-static inline void Message_setAssociatedFd(struct Message* msg, int fd)
-{
-    if (fd == -1) {
-        msg->associatedFd = 0;
-    } else if (fd == 0) {
-        msg->associatedFd = -1;
-    } else {
-        msg->associatedFd = fd;
-    }
-}
+void Message_setAssociatedFd(struct Message* msg, int fd);
 
-static inline int Message_getAssociatedFd(struct Message* msg)
-{
-    if (msg->associatedFd == -1) {
-        return 0;
-    } else if (msg->associatedFd == 0) {
-        return -1;
-    } else {
-        return msg->associatedFd;
-    }
-}
+int Message_getAssociatedFd(struct Message* msg);
 
-static inline struct Message* Message_clone(struct Message* toClone, struct Allocator* alloc)
-{
-    Assert_true(toClone->capacity >= toClone->length);
-    int32_t len = toClone->capacity + toClone->padding;
-    uint8_t* allocation = Allocator_malloc(alloc, len + 8);
-    while (((uintptr_t)allocation % 8) != (((uintptr_t)toClone->bytes - toClone->padding) % 8)) {
-        allocation++;
-    }
-    Bits_memcpy(allocation, toClone->bytes - toClone->padding, len);
-    return Allocator_clone(alloc, (&(struct Message) {
-        .length = toClone->length,
-        .padding = toClone->padding,
-        .bytes = allocation + toClone->padding,
-        .capacity = toClone->capacity,
-        .alloc = alloc
-    }));
-}
+struct Message* Message_clone(struct Message* toClone, struct Allocator* alloc);
 
-static inline void Message_copyOver(struct Message* output,
+void Message_copyOver(struct Message* output,
                                     struct Message* input,
-                                    struct Allocator* allocator)
-{
-    size_t inTotalLength = input->length + input->padding;
-    size_t outTotalLength = output->length + output->padding;
-    uint8_t* allocation = output->bytes - output->padding;
-    if (inTotalLength > outTotalLength) {
-        allocation = Allocator_realloc(allocator, allocation, inTotalLength);
-    }
-    Bits_memcpy(allocation, input->bytes - input->padding, inTotalLength);
-    output->bytes = allocation + input->padding;
-    output->length = input->length;
-    output->padding = input->padding;
-}
+                                    struct Allocator* allocator);
 
 /**
  * Pretend to shift the content forward by amount.
  * Really it shifts the bytes value backward.
  */
-static inline int Message_shift(struct Message* toShift, int32_t amount, struct Except* eh)
-{
-    if (amount > 0 && toShift->padding < amount) {
-        Except_throw(eh, "buffer overflow adding %d to length %d", amount, toShift->length);
-    } else if (toShift->length < (-amount)) {
-        Except_throw(eh, "buffer underflow");
-    }
-
-    toShift->length += amount;
-    toShift->capacity += amount;
-    toShift->bytes -= amount;
-    toShift->padding -= amount;
-
-    return 1;
-}
-
 static inline Er_DEFUN(void Message_eshift(struct Message* toShift, int32_t amount))
 {
     if (amount > 0 && toShift->padding < amount) {
@@ -173,7 +93,7 @@ static inline void Message_reset(struct Message* toShift)
 {
     Assert_true(toShift->length <= toShift->capacity);
     toShift->length = toShift->capacity;
-    Message_shift(toShift, -toShift->length, NULL);
+    Er_assert(Message_eshift(toShift, -toShift->length));
 }
 
 static inline Er_DEFUN(void Message_epush(struct Message* restrict msg,
@@ -189,30 +109,6 @@ static inline Er_DEFUN(void Message_epush(struct Message* restrict msg,
     Er_ret();
 }
 
-static inline void Message_push(struct Message* restrict msg,
-                                const void* restrict object,
-                                size_t size,
-                                struct Except* eh)
-{
-    Message_shift(msg, (int)size, eh);
-    if (object) {
-        Bits_memcpy(msg->bytes, object, size);
-    } else {
-        Bits_memset(msg->bytes, 0x00, size);
-    }
-}
-
-static inline void Message_pop(struct Message* restrict msg,
-                               void* restrict object,
-                               size_t size,
-                               struct Except* eh)
-{
-    Message_shift(msg, -((int)size), eh);
-    if (object) {
-        Bits_memcpy(object, &msg->bytes[-((int)size)], size);
-    }
-}
-
 static inline Er_DEFUN(void Message_epop(struct Message* restrict msg,
                                          void* restrict object,
                                          size_t size))
@@ -225,11 +121,6 @@ static inline Er_DEFUN(void Message_epop(struct Message* restrict msg,
 }
 
 #define Message_pushH(size) \
-    static inline void Message_push ## size ## h                                          \
-        (struct Message* msg, uint ## size ## _t dat, struct Except* eh)                  \
-    {                                                                                     \
-        Message_push(msg, &dat, (size)/8, eh);                                            \
-    } \
     static inline Er_DEFUN(void Message_epush ## size ## h                                \
         (struct Message* msg, uint ## size ## _t dat))                                    \
     {                                                                                     \
@@ -237,13 +128,6 @@ static inline Er_DEFUN(void Message_epop(struct Message* restrict msg,
         Er_ret(); \
     }
 #define Message_popH(size) \
-    static inline uint ## size ## _t Message_pop ## size ## h \
-        (struct Message* msg, struct Except* eh) \
-    {                                                                                             \
-        uint ## size ## _t out;                                                                   \
-        Message_pop(msg, &out, (size)/8, eh);                                                     \
-        return out;                                                                               \
-    } \
     static inline Er_DEFUN(uint ## size ## _t Message_epop ## size ## h(struct Message* msg))     \
     {                                                                                             \
         uint ## size ## _t out;                                                                   \
@@ -251,35 +135,15 @@ static inline Er_DEFUN(void Message_epop(struct Message* restrict msg,
         Er_ret(out); \
     }
 
-#define Message_pushBE(size) \
-    static inline void Message_push ## size \
-            (struct Message* msg, uint ## size ## _t dat, struct Except* eh)                      \
-    {                                                                                             \
-        Message_push ## size ## h(msg, Endian_hostToBigEndian ## size (dat), eh);                 \
-    }
-#define Message_pushLE(size) \
-    static inline void Message_push ## size ## le \
-            (struct Message* msg, uint ## size ## _t dat, struct Except* eh)                      \
-    {                                                                                             \
-        Message_push ## size ## h(msg, Endian_hostToLittleEndian ## size (dat), eh);              \
-    }
 #define Message_popBE(size) \
-    static inline uint ## size ## _t Message_pop ## size (struct Message* msg, struct Except* eh) \
-    {                                                                                             \
-        return Endian_bigEndianToHost ## size (Message_pop ## size ## h(msg, eh));                \
-    } \
     static inline Er_DEFUN(uint ## size ## _t Message_epop ## size ## be(struct Message* msg)) \
     {                                                                                             \
         uint ## size ## _t out = Er(Message_epop ## size ## h(msg));                              \
         uint ## size ## _t out1 = Endian_bigEndianToHost ## size (out);                           \
         Er_ret(out1);                                                                             \
     }
+
 #define Message_popLE(size) \
-    static inline uint ## size ## _t Message_pop ## size ## le \
-        (struct Message* msg, struct Except* eh) \
-    {                                                                                             \
-        return Endian_littleEndianToHost ## size (Message_pop ## size ## h(msg, eh));             \
-    } \
     static inline Er_DEFUN(uint ## size ## _t Message_epop ## size ## le(struct Message* msg)) \
     {                                                                                             \
         uint ## size ## _t out = Er(Message_epop ## size ## h(msg));                              \
@@ -288,14 +152,10 @@ static inline Er_DEFUN(void Message_epop(struct Message* restrict msg,
     }
 
 #define Message_pushPop(size) \
-    Message_pushH(size) Message_popH(size) \
-    Message_pushBE(size) Message_popBE(size) \
-    Message_pushLE(size) Message_popLE(size)
+    Message_pushH(size) Message_popH(size) Message_popBE(size) Message_popLE(size)
 
 Message_pushH(8)
 Message_popH(8)
-#define Message_push8 Message_push8h
-#define Message_pop8 Message_pop8h
 
 #define Message_epush8 Message_epush8h
 #define Message_epop8 Message_epop8h