Merge branch 'feat/parity-network' into feat/rsync-parity

src/shared/checksum.c

@@ -21,6 +21,20 @@ bool checksum_digest(ChecksumAlgo algo, uint64_t seed, const void* data, size_t
     return true;
   }
 
+  if (algo == CHECKSUM_ALGO_XXH3) {
+    uint64_t digest = XXH3_64bits_withSeed(data, size, seed);
+    memcpy(out, &digest, sizeof(digest));
+    *out_len = sizeof(digest);
+    return true;
+  }
+
+  if (algo == CHECKSUM_ALGO_XXH128) {
+    XXH128_hash_t digest = XXH3_128bits_withSeed(data, size, seed);
+    memcpy(out, &digest, sizeof(digest));
+    *out_len = sizeof(digest);
+    return true;
+  }
+
   if (algo == CHECKSUM_ALGO_MD5) {
     /* md5 takes no seed; the caller's seed is deliberately ignored (documented
      * in RSYNC_COMPAT.md).  OpenSSL's one-shot EVP_Digest needs a non-NULL
@@ -45,6 +59,10 @@ int checksum_algo_from_name(const char* name) {
     return -1;
   if (strcasecmp(name, "xxh64") == 0 || strcasecmp(name, "xxhash") == 0)
     return (int)CHECKSUM_ALGO_XXH64;
+  if (strcasecmp(name, "xxh3") == 0)
+    return (int)CHECKSUM_ALGO_XXH3;
+  if (strcasecmp(name, "xxh128") == 0)
+    return (int)CHECKSUM_ALGO_XXH128;
   if (strcasecmp(name, "md5") == 0)
     return (int)CHECKSUM_ALGO_MD5;
   return -1;
@@ -54,6 +72,10 @@ const char* checksum_algo_name(ChecksumAlgo algo) {
   switch (algo) {
   case CHECKSUM_ALGO_XXH64:
     return "xxh64";
+  case CHECKSUM_ALGO_XXH3:
+    return "xxh3";
+  case CHECKSUM_ALGO_XXH128:
+    return "xxh128";
   case CHECKSUM_ALGO_MD5:
     return "md5";
   }
@@ -61,13 +83,16 @@ const char* checksum_algo_name(ChecksumAlgo algo) {
 }
 
 bool checksum_algo_valid(int algo) {
-  return algo == (int)CHECKSUM_ALGO_XXH64 || algo == (int)CHECKSUM_ALGO_MD5;
+  return algo == (int)CHECKSUM_ALGO_XXH64 || algo == (int)CHECKSUM_ALGO_MD5 ||
+         algo == (int)CHECKSUM_ALGO_XXH3 || algo == (int)CHECKSUM_ALGO_XXH128;
 }
 
 uint8_t checksum_digest_len(ChecksumAlgo algo) {
   switch (algo) {
   case CHECKSUM_ALGO_XXH64:
+  case CHECKSUM_ALGO_XXH3:
     return 8;
+  case CHECKSUM_ALGO_XXH128:
   case CHECKSUM_ALGO_MD5:
     return 16;
   }

src/shared/checksum.h

@@ -9,10 +9,17 @@
  * seeded with --checksum-seed.  The ids are the values actually placed on the
  * wire (config frame), so they must be kept stable and validated on receive.
  * CHECKSUM_ALGO_XXH64 == 0 is the default and is byte-for-byte what FastSync
- * computed before these options existed (xxHash64 with seed 0). */
-typedef enum { CHECKSUM_ALGO_XXH64 = 0, CHECKSUM_ALGO_MD5 = 1 } ChecksumAlgo;
+ * computed before these options existed (xxHash64 with seed 0).  The set mirrors
+ * the algorithms rsync 3.4.1 can be built with; the ones FastSync does not
+ * implement (md4, sha1, none) are rejected by name at parse time. */
+typedef enum {
+  CHECKSUM_ALGO_XXH64 = 0,
+  CHECKSUM_ALGO_MD5 = 1,
+  CHECKSUM_ALGO_XXH3 = 2,
+  CHECKSUM_ALGO_XXH128 = 3
+} ChecksumAlgo;
 
-/* md5 digest is 16 bytes, the longest supported. */
+/* xxh128 digest is 16 bytes, the longest supported. */
 #define CHECKSUM_MAX_DIGEST_LEN 16
 
 /* Compute the whole-file digest of the first `size` bytes of `data`.
@@ -29,8 +36,10 @@ bool checksum_digest(ChecksumAlgo algo, uint64_t seed, const void* data, size_t
                      size_t out_capacity, size_t* out_len);
 
 /* Resolve a --checksum-choice string (case-insensitive) to an algorithm id.
- * Accepts "xxh64" and "xxhash" (both map to CHECKSUM_ALGO_XXH64, rsync's
- * xxhash spelling) and "md5".  Returns -1 for any unsupported name. */
+ * Accepts "xxh64"/"xxhash", "xxh3", "xxh128" and "md5".  "auto", rsync's
+ * default automatic choice, is resolved to the default by the caller (it is not
+ * a distinct algorithm here).  Returns -1 for any name FastSync does not
+ * implement (md4/sha1/none included). */
 int checksum_algo_from_name(const char* name);
 
 /* Canonical name of an algorithm (used in CLI error messages). */
@@ -39,7 +48,7 @@ const char* checksum_algo_name(ChecksumAlgo algo);
 /* True when `algo` is a supported id (used by config receive validation). */
 bool checksum_algo_valid(int algo);
 
-/* Digest length in bytes for an algorithm (xxx64 = 8, md5 = 16). */
+/* Digest length in bytes for an algorithm (xxh64/xxh3 = 8, md5/xxh128 = 16). */
 uint8_t checksum_digest_len(ChecksumAlgo algo);
 
 #endif /* CHECKSUM_H */

src/shared/compression.c

@@ -14,23 +14,54 @@
 #define INITIAL_DECOMPRESS_BUF_SIZE (1024 * 1024)
 #define MAX_DECOMPRESSED_SIZE (100ULL * 1024 * 1024) /* 100 MB hard ceiling */
 
-static char* SKIP_COMPRESSION_EXTENSIONS[] = {".jpg", ".jpeg", ".png", ".gif", ".mp4", ".mkv",
-                                              ".zip", ".gz",   ".xz",  ".zst", NULL};
+/* rsync 3.4.1's built-in skip-compress suffix list (the `--skip-compress`
+ * defaults, in the man page's order).  rsync stores it as space-separated
+ * "*.suffix" globs; FastSync matches the plain suffix after the final dot, so
+ * the leading "*." is omitted here.  A user --skip-compress list replaces this
+ * default entirely (matching rsync). */
+#define DEFAULT_SKIP_COMPRESS_SUFFIXES                                                             \
+  "3g2 3gp 7z aac ace apk avi bz2 deb dmg ear f4v flac flv gpg gz iso jar jpeg jpg lrz lz lz4 "    \
+  "lzma "                                                                                          \
+  "lzo m1a m1v m2a m2ts m2v m4a m4b m4p m4r m4v mka mkv mov mp1 mp2 mp3 mp4 mpa mpeg mpg mpv mts " \
+  "odb odf odg odi odm odp ods odt oga ogg ogm ogv ogx opus otg oth otp ots ott oxt png qt rar "   \
+  "rpm "                                                                                           \
+  "rz rzip spx squashfs sxc sxd sxg sxm sxw sz tbz tbz2 tgz tlz ts txz tzo vob war webm webp xz "  \
+  "z "                                                                                             \
+  "zip zst"
+
+/* Case-insensitive match of a bare suffix (no leading dot) against a
+ * space-separated suffix list. */
+static bool suffix_in_list(const char* name, const char* list) {
+  size_t name_len = strlen(name);
+  while (*list) {
+    while (*list == ' ')
+      list++;
+    const char* start = list;
+    while (*list && *list != ' ')
+      list++;
+    size_t len = (size_t)(list - start);
+    if (len == name_len && strncasecmp(name, start, len) == 0)
+      return true;
+  }
+  return false;
+}
 
 bool compression_should_skip_with_suffixes(const char* path, char* const* suffixes, int count) {
   if (!path)
     return false;
   const char* dot = strrchr(path, '.');
-  if (!dot)
+  if (!dot || dot[1] == '\0')
     return false;
-  if (count < 0) {
-    suffixes = SKIP_COMPRESSION_EXTENSIONS;
-    count = 0;
-    while (SKIP_COMPRESSION_EXTENSIONS[count])
-      count++;
-  }
+  const char* name = dot + 1;
+  /* count < 0 (the user gave no --skip-compress) selects rsync's built-in
+   * default list; a non-negative count is the user's explicit list. */
+  if (count < 0)
+    return suffix_in_list(name, DEFAULT_SKIP_COMPRESS_SUFFIXES);
   for (int i = 0; i < count; i++) {
-    if (strcasecmp(dot, suffixes[i]) == 0)
+    const char* suffix = suffixes[i];
+    if (suffix[0] == '.')
+      suffix++;
+    if (strcasecmp(name, suffix) == 0)
       return true;
   }
   return false;

src/shared/config.c

@@ -45,12 +45,12 @@ static void config_set_defaults(Config* config) {
   config->server_port = 8080;
   config->server_port_set = false;
   config->server_host_set = false;
-  /* 0 means "--timeout not given": the transport keeps its own built-in 30 s
-   * socket timeout (tcp_set_timeouts ignores non-positive values) and the
-   * protocol layer keeps its built-in 60 s per-message deadline.  A positive
-   * value overrides BOTH (see protocol_session_set_io_timeout). */
+  /* rsync defaults: --timeout=0 (I/O timeouts disabled) and --contimeout=60.
+   * A value of 0 disables the deadline on both the socket layer
+   * (tcp_set_timeouts) and the protocol layer
+   * (protocol_session_set_io_timeout); a positive value sets it. */
   config->timeout = 0;
-  config->contimeout = 10;
+  config->contimeout = 60;
   config->quiet = false;
   config->stats = false;
   config->max_depth = 0;
@@ -208,7 +208,7 @@ static bool validate_received_config(const Config* config) {
          config->delta_block_size <= DELTA_BLOCK_SIZE_MAX &&
          config->delta_max_file_size <= DELTA_MAX_FILE_SIZE && config->modify_window >= 0 &&
          config->max_delete >= -1 && config->skip_compress_count >= 0 &&
-         config->skip_compress_count <= MAX_SKIP_COMPRESS_SUFFIXES && config->max_alloc > 0 &&
+         config->skip_compress_count <= MAX_SKIP_COMPRESS_SUFFIXES &&
          (!config->chmod_spec || !*config->chmod_spec ||
           chmod_apply(0, config->chmod_spec, &(mode_t){0})) &&
          config->super_mode >= SUPER_MODE_AUTO && config->super_mode <= SUPER_MODE_OFF;
@@ -780,9 +780,11 @@ void config_delete(Config* config) {
  * ------------------------------------------------------------------------- */
 
 /* --max-alloc: raw 64-bit value, clamped server-side and installed as the
- * session allocation ceiling.  A zero value is rejected. */
+ * session allocation ceiling.  Zero means "no alloc limit" (rsync's
+ * --max-alloc=0) and is passed through; a non-zero value is clamped to the
+ * server's own ceiling. */
 static bool config_receive_max_alloc(int fd, unsigned long long* value) {
-  if (!receive_n_data(fd, value, sizeof(*value)) || *value == 0)
+  if (!receive_n_data(fd, value, sizeof(*value)))
     return false;
   if (*value > MAX_SERVER_ALLOC)
     *value = MAX_SERVER_ALLOC;

src/shared/config.h

@@ -314,12 +314,13 @@ typedef struct Config {
   char* tls_cert;
   char* tls_key;
   char* tls_ca;
-  /* --timeout: per-message I/O deadline in seconds.  0 (the default/unset
-   * sentinel) leaves the transport's built-in 30 s socket timeout and the
-   * protocol's built-in 60 s per-message deadline in place; a positive value
-   * overrides both.  See protocol_session_set_io_timeout. */
+  /* --timeout: per-message I/O deadline in seconds.  0 (rsync's default)
+   * disables the deadline entirely on both the socket layer and the protocol
+   * layer; a positive value sets it.  See protocol_session_set_io_timeout and
+   * tcp_set_timeouts. */
   int timeout;
-  /* --contimeout: connect()/accept timeout, transport layer only. */
+  /* --contimeout: connect()/accept timeout in seconds (rsync's default 60);
+   * 0 disables it.  Transport layer only. */
   int contimeout;
   bool quiet;
   bool stats;

src/shared/file.c

@@ -964,6 +964,19 @@ int file_open_private_dir(const char* dir_path) {
   return fd;
 }
 
+/* Open a --temp-dir scratch directory exactly as rsync does: the directory must
+ * already exist and is used as given (an absolute path is used verbatim, a
+ * relative one was already resolved against the destination root by the
+ * caller).  Unlike file_open_private_dir this neither creates it nor confines
+ * it below the receive root, because rsync accepts any temp dir -- including
+ * one outside the destination tree or on another filesystem.  Returns an
+ * O_DIRECTORY|O_CLOEXEC fd, or -1 on error. */
+int file_open_temp_dir(const char* dir_path) {
+  if (!dir_path)
+    return -1;
+  return open(dir_path, O_RDONLY | O_DIRECTORY | O_CLOEXEC);
+}
+
 /* After the content and mode/times are restored on the just-written file, apply
  * the per-file xattrs (-X/-A) and, for --fake-super, park the source's
  * uid/gid/mode/mtime in the reserved xattr.  All fd-relative (confined to the
@@ -997,6 +1010,10 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
     return false;
   int fd = -1;
   bool ok = false;
+  /* Set when a --temp-dir install fails with EXDEV: rsync then falls back to a
+   * non-atomic write directly in the destination directory (see the tail of
+   * this function). */
+  bool cross_device_fallback = false;
   /* The base mode applied when --perms is off (neither the source mode nor an
    * exec-only change is taken wholesale): a pre-existing destination keeps its
    * own mode (special bits dropped), while a brand-new file uses
@@ -1127,10 +1144,11 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
        file is created in the destination directory, exactly as historically. */
     int scratch_dirfd = -1;
     if (temp_dir) {
-      scratch_dirfd = file_open_private_dir(temp_dir);
+      scratch_dirfd = file_open_temp_dir(temp_dir);
       if (scratch_dirfd < 0) {
         int saved_errno = errno;
-        log_message(LOG_LEVEL_ERROR, "could not open --temp-dir scratch directory '%s': %s",
+        log_message(LOG_LEVEL_ERROR,
+                    "--temp-dir '%s' could not be opened (rsync requires it to already exist): %s",
                     temp_dir, strerror(saved_errno));
         close(dirfd);
         free(leaf);
@@ -1228,17 +1246,16 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
                 errno != ENOENT)
               ok = false;
           } else {
+            /* Cross-device (or otherwise impossible) link: rsync falls back to
+               writing the file directly in the destination directory.  Record
+               it and retry below with no scratch dir. */
             if (scratch_dirfd >= 0 && errno == EXDEV)
-              log_message(LOG_LEVEL_ERROR,
-                          "temp dir is on a different filesystem than the destination; cannot "
-                          "link file into place (EXDEV); no fallback copy is attempted");
+              cross_device_fallback = true;
             ok = false;
           }
         } else if (renameat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, dirfd, leaf) != 0) {
           if (scratch_dirfd >= 0 && errno == EXDEV)
-            log_message(LOG_LEVEL_ERROR,
-                        "temp dir is on a different filesystem than the destination; cannot "
-                        "atomically install file (EXDEV); no fallback copy is attempted");
+            cross_device_fallback = true;
           ok = false;
         }
       }
@@ -1271,6 +1288,17 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
     close(fd);
   close(dirfd);
   free(leaf);
+  if (cross_device_fallback) {
+    /* rsync semantics: a --temp-dir on another filesystem must not abort the
+       write.  Retry once with no scratch dir so the file is written and
+       installed non-atomically in the destination directory. */
+    log_message(LOG_LEVEL_WARNING,
+                "temp dir is on a different filesystem than the destination; falling back to a "
+                "non-atomic copy into the destination directory");
+    return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
+                                    policy, update, no_replace, use_fsync, NULL, xattrs, fake_super,
+                                    keep_partial);
+  }
   return ok;
 }
 
@@ -1350,11 +1378,12 @@ static bool file_to_disk_secure_link_impl(const char* path, const char* basis_pa
 
   int scratch_dirfd = -1;
   if (temp_dir) {
-    scratch_dirfd = file_open_private_dir(temp_dir);
+    scratch_dirfd = file_open_temp_dir(temp_dir);
     if (scratch_dirfd < 0) {
       int saved_errno = errno;
-      log_message(LOG_LEVEL_ERROR, "could not open --temp-dir scratch directory '%s': %s", temp_dir,
-                  strerror(saved_errno));
+      log_message(LOG_LEVEL_ERROR,
+                  "--temp-dir '%s' could not be opened (rsync requires it to already exist): %s",
+                  temp_dir, strerror(saved_errno));
       close(dirfd);
       free(leaf);
       return false;

src/shared/file.h

@@ -95,19 +95,23 @@ bool file_rename_secure(const char* old_path, const char* new_path);
    regular file.  See the .c for the exact success semantics. */
 bool file_remove_tree_secure(const char* path);
 /* Open a private 0700 directory (creating it on demand) that must live below
-   the authorized root.  Used for the --temp-dir scratch directory and the
-   --delay-updates staging directory. */
+   the authorized root.  Used for the --delay-updates staging directory. */
 int file_open_private_dir(const char* dir_path);
 
+/* Open an existing --temp-dir scratch directory as-is (absolute or relative;
+   no creation, no root confinement), matching rsync's --temp-dir handling. */
+int file_open_temp_dir(const char* dir_path);
+
 /* The file_to_disk_secure* variants write a temporary copy in the destination
-   directory and atomically rename it over `path`.  temp_dir is an absolute,
-   root-confined scratch directory (already validated by the caller): when it
-   is non-NULL the temporary copy is instead created there (with a name unique
-   across the whole scratch directory) and atomically renamed into the
-   destination directory once fully written and fsynced.  A rename across
-   filesystems (EXDEV) fails the write with an error; the file is never
-   silently copied into place.  Pass NULL for the historical same-directory
-   behavior.  --inplace writes never use temp_dir. */
+   directory and atomically rename it over `path`.  temp_dir is a scratch
+   directory (an absolute path, or one the caller already resolved against the
+   destination root): when it is non-NULL the temporary copy is instead created
+   there (with a name unique across the whole scratch directory) and atomically
+   renamed into the destination directory once fully written and fsynced.  When
+   that rename/link fails with EXDEV (the scratch dir is on another filesystem)
+   the write falls back to a non-atomic copy directly in the destination
+   directory, matching rsync.  Pass NULL for the same-directory behavior.
+   --inplace writes never use temp_dir. */
 bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                          bool inplace, bool sparse, bool preallocate, const FileMetadata* metadata,
                          FileAttrPolicy policy, const char* temp_dir);

src/shared/file_receive.c

@@ -294,13 +294,26 @@ static FileSaveResult file_save_hardlink_sibling(const char* root_directory, con
     free(destination_path);
     return absent_result;
   }
-  const char* temp_dir = (cfg && cfg->temp_dir) ? cfg->temp_dir : NULL;
+  /* Resolve a relative --temp-dir against the destination root, exactly as the
+   * primary save path does; an absolute one is used verbatim. */
+  char* resolved_temp = NULL;
+  if (cfg->temp_dir) {
+    resolved_temp =
+        cfg->temp_dir[0] == '/' ? str_dup(cfg->temp_dir) : path_cat(root_directory, cfg->temp_dir);
+    if (!resolved_temp) {
+      free(content);
+      free(first_disk);
+      free(destination_path);
+      return FILE_SAVE_ERROR;
+    }
+  }
   FileXattrList* sibling_xattrs =
       cfg->use_xattrs ? xattr_capture_path(first_disk, cfg->preserve_acls) : NULL;
-  bool ok = file_to_disk_secure_link_attrs(destination_path, first_disk, content, content_size,
-                                           preallocate, file->metadata, policy, use_fsync,
-                                           sibling_xattrs, cfg ? cfg->fake_super : false, temp_dir);
+  bool ok = file_to_disk_secure_link_attrs(
+      destination_path, first_disk, content, content_size, preallocate, file->metadata, policy,
+      use_fsync, sibling_xattrs, cfg ? cfg->fake_super : false, resolved_temp);
   xattr_list_free(sibling_xattrs);
+  free(resolved_temp);
   free(content);
   free(first_disk);
   free(destination_path);
@@ -758,14 +771,15 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
     return file_save_hardlink_sibling(root_directory, file, config);
   }
 
-  /* These options arrive from the client.  They are names below the server
-     root, never independent filesystem roots.  --temp-dir is confined exactly
-     like --backup-dir/--partial-dir: an absolute or `..`-escaping scratch
-     directory is rejected outright so nothing is ever created outside the
-     authorized destination root. */
+  /* These options arrive from the client.  --backup-dir and --partial-dir are
+     names below the server root, never independent filesystem roots: an
+     absolute or `..`-escaping value is rejected outright.  --temp-dir is
+     deliberately NOT confined: rsync accepts any temp dir (absolute, or
+     relative to the destination root), including one outside the destination
+     tree or on another filesystem, and falls back to a non-atomic copy when
+     the install rename hits EXDEV. */
   if ((backup_dir && (backup_dir[0] == '/' || has_path_traversal(backup_dir))) ||
-      (partial_dir && (partial_dir[0] == '/' || has_path_traversal(partial_dir))) ||
-      (temp_dir && (temp_dir[0] == '/' || has_path_traversal(temp_dir))))
+      (partial_dir && (partial_dir[0] == '/' || has_path_traversal(partial_dir))))
     return FILE_SAVE_ERROR;
   if (backup_dir && !(confined_backup = path_cat(root_directory, backup_dir)))
     return FILE_SAVE_ERROR;
@@ -890,15 +904,21 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
   }
 
   /* A configured --temp-dir sends the temporary working copy to a scratch
-     directory resolved below the receive root; the engine then atomically
-     renames the completed file into the final destination directory.  The
-     partial-dir flow already keeps its working copy in a separate directory
-     and --inplace writes directly, so neither diverts through the scratch
-     dir (matching rsync, where --inplace/--partial-dir supersede --temp-dir). */
+     directory; the engine then atomically renames the completed file into the
+     final destination directory.  rsync resolves a relative temp dir against
+     the destination directory and uses an absolute one verbatim, requiring
+     that it already exist; the engine falls back to a non-atomic copy on
+     EXDEV.  The partial-dir flow already keeps its working copy in a separate
+     directory and --inplace writes directly, so neither diverts through the
+     scratch dir (matching rsync, where --inplace/--partial-dir supersede
+     --temp-dir). */
   char* confined_temp = NULL;
   bool use_temp_dir = temp_dir != NULL && !inplace && !use_partial_root;
   if (use_temp_dir) {
-    confined_temp = path_cat(root_directory, temp_dir);
+    if (temp_dir[0] == '/')
+      confined_temp = str_dup(temp_dir);
+    else
+      confined_temp = path_cat(root_directory, temp_dir);
     if (!confined_temp)
       goto fail;
     /* A user-supplied trailing slash would leave the scratch path ending in

src/shared/file_send.c

@@ -143,20 +143,28 @@ bool file_send_sendfile_with_skip(File* file, int file_descriptor, bool use_meta
   }
 
   off_t offset = 0;
+  /* A non-positive --timeout disables the deadline: poll blocks until the
+   * socket is writable (rsync's --timeout=0 default). */
+  int io_timeout_sec = protocol_get_io_timeout_sec();
   struct timespec deadline;
-  clock_gettime(CLOCK_MONOTONIC, &deadline);
-  deadline.tv_sec += protocol_get_io_timeout_sec();
+  if (io_timeout_sec > 0) {
+    clock_gettime(CLOCK_MONOTONIC, &deadline);
+    deadline.tv_sec += io_timeout_sec;
+  }
   while ((unsigned long long)offset < file_size) {
-    struct timespec now;
-    clock_gettime(CLOCK_MONOTONIC, &now);
-    long long remaining = (long long)(deadline.tv_sec - now.tv_sec) * 1000LL +
-                          (deadline.tv_nsec - now.tv_nsec) / 1000000LL;
-    if (remaining <= 0) {
-      close(fd);
-      return false;
+    int timeout = -1;
+    if (io_timeout_sec > 0) {
+      struct timespec now;
+      clock_gettime(CLOCK_MONOTONIC, &now);
+      long long remaining = (long long)(deadline.tv_sec - now.tv_sec) * 1000LL +
+                            (deadline.tv_nsec - now.tv_nsec) / 1000000LL;
+      if (remaining <= 0) {
+        close(fd);
+        return false;
+      }
+      timeout = remaining > INT_MAX ? INT_MAX : (int)remaining;
     }
     struct pollfd pfd = {.fd = file_descriptor, .events = POLLOUT};
-    int timeout = remaining > INT_MAX ? INT_MAX : (int)remaining;
     int polled = poll(&pfd, 1, timeout);
     if (polled <= 0 || (pfd.revents & (POLLERR | POLLHUP | POLLNVAL))) {
       close(fd);

src/shared/protocol.c

@@ -12,8 +12,7 @@
 #include <time.h>
 #include <unistd.h>
 
-#define RECEIVE_TIMEOUT_SEC 60 /* 60 second per-message timeout */
-#define SEND_TIMEOUT_SEC 60
+#define RECEIVE_TIMEOUT_SEC 60 /* built-in fallback for explicit -timed calls only */
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
@@ -99,8 +98,10 @@ void protocol_session_set_io_timeout(ProtocolSession* session, int sec) {
 
 int protocol_get_io_timeout_sec(void) {
   const ProtocolSession* session = bound_session ? bound_session : &legacy_io_session;
-  int sec = session->io_timeout_sec;
-  return sec > 0 ? sec : RECEIVE_TIMEOUT_SEC;
+  /* 0 (or negative) means the session timeout is disabled, matching rsync's
+   * --timeout=0 default.  Callers must treat a non-positive result as "wait
+   * without a deadline" instead of substituting a built-in window. */
+  return session->io_timeout_sec > 0 ? session->io_timeout_sec : 0;
 }
 
 void protocol_session_set_max_alloc(ProtocolSession* session, unsigned long long max_alloc) {
@@ -110,7 +111,8 @@ void protocol_session_set_max_alloc(ProtocolSession* session, unsigned long long
 }
 
 static bool allocation_allowed(const ProtocolSession* session, size_t size) {
-  return (unsigned long long)size <= session->max_alloc;
+  /* max_alloc == 0 is rsync's --max-alloc=0 "no limit". */
+  return session->max_alloc == 0 || (unsigned long long)size <= session->max_alloc;
 }
 
 static void* protocol_alloc_for_session(const ProtocolSession* session, size_t size) {
@@ -280,11 +282,15 @@ bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t dat
   log_debug_message(LOG_DEBUG_IO, "    Sending n Data: %zu", data_size);
   if (!session)
     return false;
-  int timeout_sec = session->io_timeout_sec > 0 ? session->io_timeout_sec : SEND_TIMEOUT_SEC;
+  /* A non-positive session timeout disables the deadline entirely (rsync's
+   * --timeout=0 default); poll then blocks until the socket becomes writable. */
+  int timeout_sec = session->io_timeout_sec > 0 ? session->io_timeout_sec : 0;
   int fd = session->write_fd;
   struct timespec deadline;
-  clock_gettime(CLOCK_MONOTONIC, &deadline);
-  deadline.tv_sec += timeout_sec;
+  if (timeout_sec > 0) {
+    clock_gettime(CLOCK_MONOTONIC, &deadline);
+    deadline.tv_sec += timeout_sec;
+  }
   short wait_events = POLLOUT;
   ssize_t total_bytes_send = 0;
   while ((size_t)total_bytes_send < data_size) {
@@ -292,7 +298,7 @@ bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t dat
     if (session->bwlimit > 0 && chunk > 65536)
       chunk = 65536;
     struct pollfd pfd = {.fd = fd, .events = wait_events};
-    int poll_result = poll(&pfd, 1, deadline_remaining_ms(&deadline));
+    int poll_result = poll(&pfd, 1, timeout_sec > 0 ? deadline_remaining_ms(&deadline) : -1);
     if (poll_result == 0 || (poll_result < 0 && errno != EINTR)) {
       log_message(LOG_LEVEL_ERROR, "Send timeout or poll failure");
       return false;
@@ -338,12 +344,21 @@ bool protocol_send_n_data(ProtocolSession* session, const void* data, size_t dat
 
 bool protocol_receive_n_data_timed(ProtocolSession* session, void* data, size_t data_size,
                                    int timeout_sec);
+static bool protocol_receive_n_data_until(ProtocolSession* session, void* data, size_t data_size,
+                                          const struct timespec* deadline);
 
 bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_size) {
-  /* Honor the session's configured deadline; protocol_receive_n_data_timed
-   * re-applies the built-in 60 s default when the value is <= 0. */
-  int timeout_sec = session ? session->io_timeout_sec : 0;
-  return protocol_receive_n_data_timed(session, data, data_size, timeout_sec);
+  /* Honor the session's configured deadline.  A non-positive value disables the
+   * deadline (rsync's --timeout=0 default): wait without a poll timeout.  The
+   * explicit _timed variants keep their own 0 -> built-in-default contract. */
+  if (!session)
+    return false;
+  if (session->io_timeout_sec <= 0)
+    return protocol_receive_n_data_until(session, data, data_size, NULL);
+  struct timespec deadline;
+  clock_gettime(CLOCK_MONOTONIC, &deadline);
+  deadline.tv_sec += session->io_timeout_sec;
+  return protocol_receive_n_data_until(session, data, data_size, &deadline);
 }
 
 /* Read exactly `data_size` bytes from `session` before `deadline` elapses
@@ -353,7 +368,7 @@ bool protocol_receive_n_data(ProtocolSession* session, void* data, size_t data_s
 static bool protocol_receive_n_data_until(ProtocolSession* session, void* data, size_t data_size,
                                           const struct timespec* deadline) {
   log_debug_message(LOG_DEBUG_IO, "    Receiving n Data: %zu", data_size);
-  if (!session || !deadline)
+  if (!session)
     return false;
   int fd = session->read_fd;
 
@@ -362,7 +377,8 @@ static bool protocol_receive_n_data_until(ProtocolSession* session, void* data,
   while (total_bytes_received < data_size) {
     if (!session->ssl || SSL_pending(session->ssl) == 0) {
       struct pollfd pfd = {.fd = fd, .events = wait_events};
-      int poll_result = poll(&pfd, 1, deadline_remaining_ms(deadline));
+      /* A NULL deadline means "wait indefinitely" (timeout disabled). */
+      int poll_result = poll(&pfd, 1, deadline ? deadline_remaining_ms(deadline) : -1);
       if (poll_result == 0) {
         log_message(LOG_LEVEL_ERROR, "Receive timeout");
         return false;
@@ -702,13 +718,16 @@ static bool protocol_capture_error_detail(ProtocolSession* session, Status* stat
 bool protocol_receive_status(ProtocolSession* session, Status* status) {
   if (!session || !status)
     return false;
-  int timeout_sec = session->io_timeout_sec > 0 ? session->io_timeout_sec : RECEIVE_TIMEOUT_SEC;
   struct timespec deadline;
-  clock_gettime(CLOCK_MONOTONIC, &deadline);
-  deadline.tv_sec += timeout_sec;
-  if (!protocol_receive_n_data_until(session, status, sizeof(Status), &deadline))
+  const struct timespec* deadline_ptr = NULL;
+  if (session->io_timeout_sec > 0) {
+    clock_gettime(CLOCK_MONOTONIC, &deadline);
+    deadline.tv_sec += session->io_timeout_sec;
+    deadline_ptr = &deadline;
+  }
+  if (!protocol_receive_n_data_until(session, status, sizeof(Status), deadline_ptr))
     return false;
-  if (!protocol_capture_error_detail(session, status, &deadline, NULL))
+  if (!protocol_capture_error_detail(session, status, deadline_ptr, NULL))
     return false;
   log_debug_message(LOG_DEBUG_PROTO, "Received Status: %s", status_to_string(*status));
   return true;
@@ -747,8 +766,8 @@ static bool protocol_read_status_until(ProtocolSession* session, Status* status,
   short wait_events = POLLIN;
   while (got < sizeof(Status)) {
     if (!session->ssl || SSL_pending(session->ssl) == 0) {
-      int remaining_ms = deadline_remaining_ms(deadline);
-      if (remaining_ms <= 0) {
+      int remaining_ms = deadline ? deadline_remaining_ms(deadline) : -1;
+      if (remaining_ms == 0) {
         log_message(LOG_LEVEL_ERROR, "Receive timeout while reading status");
         return false;
       }

src/shared/stop_condition.c

@@ -44,6 +44,181 @@ static bool parse_two_digits(const char* s, int* out) {
   return true;
 }
 
+/* True when the current character of the cursor is a decimal digit. */
+static bool is_digit(const char* cp) {
+  return *cp >= '0' && *cp <= '9';
+}
+
+/* rsync 3.4.1's flexible --stop-at date parser (ported from
+ * options.c:parse_time).  Returns a time_t, or (time_t)-1 on a malformed value.
+ * Accepted forms include Y-M-DTh:m, Y/M/DTh:m, Y-M-D, M-D, D, h:m, :m and
+ * "T h:m"; a 1- or 2-digit year and omitted fields are resolved to the next
+ * matching point in time in the local timezone.  Seconds are NOT accepted
+ * (rsync rejects them too); FastSync keeps its own HH:MM:SS spelling as an
+ * extension handled by the caller.  `now` is passed in so tests are
+ * deterministic; production passes time(NULL). */
+static time_t parse_time_rsync(const char* value, time_t now) {
+  const char* cp;
+  time_t val;
+  struct tm today;
+  if (!localtime_r(&now, &today))
+    return (time_t)-1;
+  struct tm t;
+  int in_date, old_mday, n;
+
+  memset(&t, 0, sizeof t);
+  t.tm_year = t.tm_mon = t.tm_mday = -1;
+  t.tm_hour = t.tm_min = t.tm_isdst = -1;
+  cp = value;
+  if (*cp == 'T' || *cp == 't' || *cp == ':') {
+    in_date = *cp == ':' ? 0 : -1;
+    cp++;
+  } else
+    in_date = 1;
+  for (;; cp++) {
+    if (!is_digit(cp))
+      return (time_t)-1;
+    n = 0;
+    do {
+      n = n * 10 + *cp++ - '0';
+    } while (is_digit(cp));
+    if (*cp == ':')
+      in_date = 0;
+    if (in_date > 0) {
+      if (t.tm_year != -1)
+        return (time_t)-1;
+      t.tm_year = t.tm_mon;
+      t.tm_mon = t.tm_mday;
+      t.tm_mday = n;
+      if (!*cp)
+        break;
+      if (*cp == 'T' || *cp == 't') {
+        if (!cp[1])
+          break;
+        in_date = -1;
+      } else if (*cp != '-' && *cp != '/')
+        return (time_t)-1;
+      continue;
+    }
+    if (t.tm_hour != -1)
+      return (time_t)-1;
+    t.tm_hour = t.tm_min;
+    t.tm_min = n;
+    if (!*cp) {
+      if (in_date < 0)
+        return (time_t)-1;
+      break;
+    }
+    if (*cp != ':')
+      return (time_t)-1;
+    in_date = 0;
+  }
+
+  in_date = 0;
+  if (t.tm_year < 0) {
+    t.tm_year = today.tm_year;
+    in_date = 1;
+  } else if (t.tm_year < 100) {
+    while (t.tm_year < today.tm_year)
+      t.tm_year += 100;
+  } else
+    t.tm_year -= 1900;
+  if (t.tm_mon < 0) {
+    t.tm_mon = today.tm_mon;
+    in_date = 2;
+  } else
+    t.tm_mon--;
+  if (t.tm_mday < 0) {
+    t.tm_mday = today.tm_mday;
+    in_date = 3;
+  }
+
+  n = 0;
+  if (t.tm_min < 0) {
+    t.tm_hour = t.tm_min = 0;
+  } else if (t.tm_hour < 0) {
+    if (in_date != 3)
+      return (time_t)-1;
+    in_date = 0;
+    t.tm_hour = today.tm_hour;
+    n = 60 * 60;
+  }
+
+  /* mktime() may roll a too-large tm_mday into the following month; undo that
+   * in the "next match" loop below. */
+  old_mday = t.tm_mday;
+  if (t.tm_hour > 23 || t.tm_min > 59 || t.tm_mon < 0 || t.tm_mon >= 12 || t.tm_mday < 1 ||
+      t.tm_mday > 31 || (val = mktime(&t)) == (time_t)-1)
+    return (time_t)-1;
+
+  while (in_date && (val <= now || t.tm_mday < old_mday)) {
+    switch (in_date) {
+    case 3:
+      old_mday = ++t.tm_mday;
+      break;
+    case 2:
+      if (t.tm_mday < old_mday)
+        t.tm_mday = old_mday; /* the month already got bumped forward */
+      else if (++t.tm_mon == 12) {
+        t.tm_mon = 0;
+        t.tm_year++;
+      }
+      break;
+    case 1:
+      if (t.tm_mday < old_mday) {
+        /* mon==1 mday==29 got bumped to mon==2 */
+        if (t.tm_mon != 2 || old_mday != 29)
+          return (time_t)-1;
+        t.tm_mon = 1;
+        t.tm_mday = 29;
+      }
+      t.tm_year++;
+      break;
+    }
+    if ((val = mktime(&t)) == (time_t)-1) {
+      if (in_date != 3 || t.tm_mday <= 28)
+        return (time_t)-1;
+      t.tm_mday = old_mday = 1;
+      in_date = 2;
+    }
+  }
+  if (n) {
+    while (val <= now)
+      val += n;
+  }
+  return val;
+}
+
+/* FastSync's HH:MM or HH:MM:SS spelling on the current local day.  rsync's own
+ * --stop-at accepts only HH:MM, so this is a strict superset extension. */
+static bool parse_clock_time(const char* value, time_t now, time_t* out_deadline) {
+  size_t len = strlen(value);
+  if (len != 5 && len != 8)
+    return false;
+  if (value[2] != ':' || (len == 8 && value[5] != ':'))
+    return false;
+  int hh, mm, ss = 0;
+  if (!parse_two_digits(value, &hh) || !parse_two_digits(value + 3, &mm))
+    return false;
+  if (len == 8 && !parse_two_digits(value + 6, &ss))
+    return false;
+  if (hh > 23 || mm > 59 || ss > 59)
+    return false;
+
+  struct tm today;
+  if (!localtime_r(&now, &today))
+    return false;
+  today.tm_hour = hh;
+  today.tm_min = mm;
+  today.tm_sec = ss;
+  today.tm_isdst = -1;
+  time_t deadline = mktime(&today);
+  if (deadline == (time_t)-1)
+    return false;
+  *out_deadline = deadline;
+  return true;
+}
+
 bool stop_parse_at_time(const char* value, time_t now, time_t* out_deadline) {
   if (!value || !out_deadline)
     return false;
@@ -91,28 +266,13 @@ bool stop_parse_at_time(const char* value, time_t now, time_t* out_deadline) {
     return true;
   }
 
-  /* HH:MM or HH:MM:SS on the current local day. */
-  size_t len = strlen(value);
-  if (len != 5 && len != 8)
-    return false;
-  if (value[2] != ':' || (len == 8 && value[5] != ':'))
-    return false;
-  int hh, mm, ss = 0;
-  if (!parse_two_digits(value, &hh) || !parse_two_digits(value + 3, &mm))
-    return false;
-  if (len == 8 && !parse_two_digits(value + 6, &ss))
-    return false;
-  if (hh > 23 || mm > 59 || ss > 59)
-    return false;
+  /* HH:MM or HH:MM:SS on the current local day (FastSync extension). */
+  if (parse_clock_time(value, now, out_deadline))
+    return true;
 
-  struct tm today;
-  if (!localtime_r(&now, &today))
-    return false;
-  today.tm_hour = hh;
-  today.tm_min = mm;
-  today.tm_sec = ss;
-  today.tm_isdst = -1;
-  time_t deadline = mktime(&today);
+  /* rsync's full/partial date-and-time form (e.g. 2000-12-31T23:59, 12-31,
+   * 14:00, :59, 1, 1-30). */
+  time_t deadline = parse_time_rsync(value, now);
   if (deadline == (time_t)-1)
     return false;
   *out_deadline = deadline;

src/shared/transport_tcp.c

@@ -289,14 +289,14 @@ void server_accept_loop(Server* server, void (*child_fn)(int, void*), void* chil
   accept_loop(server, child_fn, child_ctx, log_fmt);
 }
 
-static int g_timeout_sec = 30;
-static int g_contimeout_sec = 10;
+/* rsync defaults: --timeout=0 (disabled) and --contimeout=60.  A non-positive
+ * value means "no timeout" rather than "leave the built-in value in place". */
+static int g_timeout_sec = 0;
+static int g_contimeout_sec = 60;
 
 void tcp_set_timeouts(int timeout_sec, int contimeout_sec) {
-  if (timeout_sec > 0)
-    g_timeout_sec = timeout_sec;
-  if (contimeout_sec > 0)
-    g_contimeout_sec = contimeout_sec;
+  g_timeout_sec = timeout_sec > 0 ? timeout_sec : 0;
+  g_contimeout_sec = contimeout_sec > 0 ? contimeout_sec : 0;
 }
 
 int tcp_get_contimeout_sec(void) {
@@ -308,6 +308,10 @@ int tcp_get_timeout_sec(void) {
 }
 
 static void tcp_apply_socket_timeout(int fd) {
+  /* timeout 0 means no timeout: leave the socket in its default (blocking)
+   * mode instead of installing a zero SO_RCVTIMEO/SO_SNDTIMEO. */
+  if (g_timeout_sec <= 0)
+    return;
   struct timeval tv;
   tv.tv_sec = g_timeout_sec;
   tv.tv_usec = 0;
@@ -483,11 +487,15 @@ bool tcp_connect_socket_ex(Client* client, const char* host, int port,
       break;
     }
 
-    struct timeval ct;
-    ct.tv_sec = g_contimeout_sec;
-    ct.tv_usec = 0;
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));
+    /* --contimeout=0 disables the connect timeout: skip the pre-connect socket
+     * timeouts entirely. */
+    if (g_contimeout_sec > 0) {
+      struct timeval ct;
+      ct.tv_sec = g_contimeout_sec;
+      ct.tv_usec = 0;
+      setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
+      setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));
+    }
 
     if (bind_addr_family != 0) {
       if (rp->ai_family != bind_addr_family) {