preallocate: --preallocate allocates dest space up front

Receiver allocates the destination file's full size before streaming data
(posix_fallocate preferred, ftruncate fallback on EOPNOTSUPP/ENOSYS) so an
out-of-space transfer fails fast instead of partway. Additive config bool
crossing the wire; PROTOCOL_VERSION 2.10.0 -> 2.11.0. Threaded through all
store paths (atomic, inplace, partial/delay-updates staging, link-dest copy
fallback). Review hardening: explicit lseek(0) before the data write so
correctness does not depend on posix_fallocate leaving the fd offset unchanged.

src/client/client_cli.c

@@ -476,6 +476,7 @@ static const OptionEntry OPTION_TABLE[] = {
     {"--copy-unsafe-links", NULL, OPT_FLAG, offsetof(Config, copy_unsafe_links)},
     {"--sparse", "-S", OPT_FLAG, offsetof(Config, preserve_sparse)},
     {"--inplace", NULL, OPT_FLAG, offsetof(Config, inplace)},
+    {"--preallocate", NULL, OPT_FLAG, offsetof(Config, preallocate)},
     {"--append", NULL, OPT_FLAG, offsetof(Config, append)},
     {"--append-verify", NULL, OPT_FLAG, offsetof(Config, append_verify)},
     {"--fsync", NULL, OPT_FLAG, offsetof(Config, use_fsync)},
@@ -551,6 +552,7 @@ static const NegatableOption NEGATABLE_OPTIONS[] = {
     {"copy-unsafe-links", NULL, offsetof(Config, copy_unsafe_links)},
     {"sparse", "S", offsetof(Config, preserve_sparse)},
     {"inplace", NULL, offsetof(Config, inplace)},
+    {"preallocate", NULL, offsetof(Config, preallocate)},
     {"checksum", NULL, offsetof(Config, checksum)},
     {"from0", NULL, offsetof(Config, from0)},
     {"cvs-exclude", NULL, offsetof(Config, cvs_exclude)},

src/client/usage.c

@@ -169,6 +169,7 @@ void print_usage(void) {
   printf("  --copy-unsafe-links  Only transform unsafe symlinks into referent files\n");
   printf("  -S, --sparse        Handle sparse files efficiently\n");
   printf("  --inplace           Update files in-place (no temp+rename)\n");
+  printf("  --preallocate       Allocate destination file space up front (fail-fast on full disk)\n");
   printf("  --append            Resume a shorter destination by appending only its tail\n");
   printf("                    (prefix is not verified; requires --incremental)\n");
   printf("  --append-verify     Like --append, but verifies the retained prefix checksum\n");

src/shared/config.c

@@ -91,6 +91,7 @@ static void config_set_defaults(Config* config) {
   config->use_fsync = false;
   config->append = false;
   config->append_verify = false;
+  config->preallocate = false;
   config->delete_excluded = false;
   config->delete_after = false;
   config->max_delete = -1;
@@ -168,8 +169,9 @@ static bool validate_received_config(const Config* config) {
          valid_wire_bool(config->existing) && valid_wire_bool(config->update) &&
          valid_wire_bool(config->inplace) && valid_wire_bool(config->append) &&
          valid_wire_bool(config->use_fsync) && valid_wire_bool(config->append_verify) &&
-         valid_wire_bool(config->delete_excluded) && valid_wire_bool(config->force_delete) &&
-         valid_wire_bool(config->delete_missing_args) && valid_wire_bool(config->delete_after) &&
+          valid_wire_bool(config->delete_excluded) && valid_wire_bool(config->force_delete) &&
+          valid_wire_bool(config->delete_missing_args) && valid_wire_bool(config->delete_after) &&
+          valid_wire_bool(config->preallocate) &&
          valid_wire_bool(config->delete_delay) && valid_wire_bool(config->delete_during) &&
          valid_wire_bool(config->relative) && valid_wire_bool(config->prune_empty_dirs) &&
          valid_wire_bool(config->delay_updates) && valid_wire_bool(config->mkpath) &&
@@ -431,6 +433,7 @@ static bool send_selection_options(int fd, const Config* c) {
          send_int(fd, c->use_fsync) && send_int(fd, c->append_verify) &&
          send_int(fd, c->delete_excluded) && send_int(fd, c->force_delete) &&
          send_int(fd, c->delete_missing_args) && send_int(fd, c->delete_after) &&
+         send_int(fd, c->preallocate) &&
          send_n_data(fd, &c->max_delete, sizeof(c->max_delete)) && send_int(fd, c->relative) &&
          send_int(fd, c->prune_empty_dirs) && send_int(fd, c->mkpath) &&
          send_int(fd, c->delete_during) && send_int(fd, c->delete_delay);
@@ -562,7 +565,8 @@ static bool receive_selection_options(int fd, Config* c) {
                    &c->delete_excluded,
                    &c->force_delete,
                    &c->delete_missing_args,
-                   &c->delete_after};
+                   &c->delete_after,
+                   &c->preallocate};
   for (size_t i = 0; i < sizeof(flags) / sizeof(flags[0]); i++) {
     if (!receive_wire_bool(fd, flags[i]))
       return false;

src/shared/config.h

@@ -124,6 +124,11 @@ typedef struct Config {
   bool use_fsync;
   bool append;
   bool append_verify;
+  /* --preallocate: allocates the destination file's full expected space up
+   * front (before any data is written) so a transfer that would overflow disk
+   * fails fast at allocation time and the file is laid out contiguously,
+   * avoiding fragmentation.  Receiver-side, crosses the wire. */
+  bool preallocate;
 
   // Issue #128: Extended delete options
   /* --delete-excluded: also delete destination entries that were excluded on
@@ -257,7 +262,7 @@ typedef struct Config {
   DelayUpdatesContext* delay_context;
 } Config;
 
-#define PROTOCOL_VERSION "2.10.0"
+#define PROTOCOL_VERSION "2.11.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64

src/shared/file.c

@@ -32,6 +32,29 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
   return true;
 }
 
+/* Preallocate `size` bytes on `fd` before any data is written (--preallocate).
+ * posix_fallocate reserves real disk blocks, so an out-of-space condition
+ * (ENOSPC/EDQUOT) surfaces up front instead of partway through a transfer;
+ * unavoidable fragmentation of a streamed file is also reduced.  Some
+ * filesystems (e.g. tmpfs, ZFS) do not support it and return EOPNOTSUPP/ENOSYS,
+ * where we fall back to ftruncate, which still extends the logical size so the
+ * fail-fast/contiguity intent degrades gracefully but never fails.  Genuine
+ * allocation failures are propagated as the error code (caller fails the write).
+ * posix_fallocate leaves the fd's file offset unchanged, so the subsequent
+ * write_all at offset 0 is unaffected.  Returns 0 on success (including the
+ * fallback) or a nonzero error code. */
+static int preallocate_fd(int fd, unsigned long long size) {
+  if (size == 0)
+    return 0;
+  int rc = posix_fallocate(fd, 0, (off_t)size);
+  if (rc == EOPNOTSUPP || rc == ENOSYS) {
+    if (ftruncate(fd, (off_t)size) == 0)
+      return 0;
+    return errno;
+  }
+  return rc;
+}
+
 /* Process-wide counter for scratch temp names.  A --temp-dir scratch directory
    is flat: different destinations that share a basename must never race onto
    the same temp name.  Deriving the trailing number from a global atomic
@@ -510,9 +533,9 @@ int file_open_private_dir(const char* dir_path) {
 
 static bool file_to_disk_secure_impl(const char* path, const void* data,
                                      unsigned long long data_size, bool inplace, bool sparse,
-                                     const FileMetadata* metadata, bool preserve_executability,
-                                     bool update, bool no_replace, bool use_fsync,
-                                     const char* temp_dir) {
+                                     bool preallocate, const FileMetadata* metadata,
+                                     bool preserve_executability, bool update, bool no_replace,
+                                     bool use_fsync, const char* temp_dir) {
   char* leaf = NULL;
   int dirfd = file_open_secure_parent(path, &leaf, true);
   if (dirfd < 0)
@@ -533,27 +556,39 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
       if (newer) {
         ok = true;
       } else {
-        /* In-place overwrites: pre-size sparse targets and always trim the
-           file to the new payload length afterwards so shorter payloads can
-           never leave stale trailing bytes from a previous version. */
-        if (sparse && data_size > 0)
-          ok = ftruncate(fd, (off_t)data_size) == 0;
-        if (ok || !sparse || data_size == 0)
-          ok = write_all(fd, data, data_size);
-        if (ok)
-          ok = ftruncate(fd, (off_t)data_size) == 0;
-        /* Normalize the mode: apply the metadata-derived safe mode when the
-           sender supplied metadata (setuid/setgid/sticky are never honored);
-           otherwise fall back to a safe default so dangerous bits on an
-           existing destination cannot survive an overwrite. */
-        if (ok) {
-          if (metadata)
-            ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
-          else if (fchmod(fd, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) != 0)
-            ok = false;
+        /* Preallocate the expected payload size before writing so an
+           out-of-space condition fails cleanly up front (--preallocate). */
+        int prealloc_rc = 0;
+        if (preallocate && data_size > 0) {
+          prealloc_rc = preallocate_fd(fd, data_size);
+          if (prealloc_rc != 0)
+            log_message(LOG_LEVEL_ERROR,
+                        "preallocate failed for '%s' (%s); transfer aborted",
+                        path, strerror(prealloc_rc));
+        }
+        if (prealloc_rc == 0) {
+          /* posix_fallocate does not guarantee the fd's file offset is left
+             unchanged, so seek back to 0 before the data write. */
+          lseek(fd, 0, SEEK_SET);
+          if (sparse && data_size > 0)
+            ok = ftruncate(fd, (off_t)data_size) == 0;
+          if (ok || !sparse || data_size == 0)
+            ok = write_all(fd, data, data_size);
+          if (ok)
+            ok = ftruncate(fd, (off_t)data_size) == 0;
+          /* Normalize the mode: apply the metadata-derived safe mode when the
+             sender supplied metadata (setuid/setgid/sticky are never honored);
+             otherwise fall back to a safe default so dangerous bits on an
+             existing destination cannot survive an overwrite. */
+          if (ok) {
+            if (metadata)
+              ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
+            else if (fchmod(fd, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) != 0)
+              ok = false;
+          }
+          if (ok && use_fsync)
+            ok = fsync(fd) == 0;
         }
-        if (ok && use_fsync)
-          ok = fsync(fd) == 0;
       }
     }
   } else {
@@ -623,14 +658,24 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
                   O_WRONLY | O_CREAT | O_EXCL | O_CLOEXEC | O_NOFOLLOW, 0600);
       if (fd < 0)
         continue; /* EEXIST (or a transient open error): try a fresh name. */
-      if (sparse && data_size > 0)
-        ok = ftruncate(fd, (off_t)data_size) == 0;
-      if (ok || (!sparse || data_size == 0))
-        ok = write_all(fd, data, data_size);
-      if (ok && metadata)
-        ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
-      if (ok && use_fsync)
-        ok = fsync(fd) == 0;
+      int prealloc_rc = 0;
+      if (preallocate && data_size > 0) {
+        prealloc_rc = preallocate_fd(fd, data_size);
+        if (prealloc_rc != 0)
+          log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted",
+                      path, strerror(prealloc_rc));
+      }
+      if (prealloc_rc == 0) {
+        lseek(fd, 0, SEEK_SET);
+        if (sparse && data_size > 0)
+          ok = ftruncate(fd, (off_t)data_size) == 0;
+        if (ok || (!sparse || data_size == 0))
+          ok = write_all(fd, data, data_size);
+        if (ok && metadata)
+          ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
+        if (ok && use_fsync)
+          ok = fsync(fd) == 0;
+      }
       if (close(fd) != 0)
         ok = false;
       fd = -1;
@@ -678,32 +723,34 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
 }
 
 bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
-                         bool inplace, bool sparse, const FileMetadata* metadata,
+                         bool inplace, bool sparse, bool preallocate, const FileMetadata* metadata,
                          bool preserve_executability, const char* temp_dir) {
-  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, metadata,
+  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, false, false, false, temp_dir);
 }
 
 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
-                                bool inplace, bool sparse, const FileMetadata* metadata,
-                                bool preserve_executability, const char* temp_dir) {
-  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, metadata,
+                                bool inplace, bool sparse, bool preallocate,
+                                const FileMetadata* metadata, bool preserve_executability,
+                                const char* temp_dir) {
+  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, true, false, false, temp_dir);
 }
 
 bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                     unsigned long long data_size, bool inplace, bool sparse,
-                                    const FileMetadata* metadata, bool preserve_executability,
-                                    bool use_fsync, const char* temp_dir) {
-  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, metadata,
+                                    bool preallocate, const FileMetadata* metadata,
+                                    bool preserve_executability, bool use_fsync,
+                                    const char* temp_dir) {
+  return file_to_disk_secure_impl(path, data, data_size, inplace, sparse, preallocate, metadata,
                                   preserve_executability, false, false, use_fsync, temp_dir);
 }
 
 bool file_to_disk_secure_no_replace(const char* path, const void* data,
-                                    unsigned long long data_size, bool sparse,
+                                    unsigned long long data_size, bool sparse, bool preallocate,
                                     const FileMetadata* metadata, bool preserve_executability,
                                     const char* temp_dir) {
-  return file_to_disk_secure_impl(path, data, data_size, false, sparse, metadata,
+  return file_to_disk_secure_impl(path, data, data_size, false, sparse, preallocate, metadata,
                                   preserve_executability, false, true, false, temp_dir);
 }
 
@@ -717,8 +764,9 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
  * (applying metadata through the shared inode would mutate the basis file).
  * Returns false only when both the link and the copy fallback fail. */
 bool file_to_disk_secure_link(const char* path, const char* basis_path, const void* data,
-                              unsigned long long data_size, const FileMetadata* metadata,
-                              bool preserve_executability, bool use_fsync, const char* temp_dir) {
+                              unsigned long long data_size, bool preallocate,
+                              const FileMetadata* metadata, bool preserve_executability,
+                              bool use_fsync, const char* temp_dir) {
   if (!path || !basis_path)
     return false;
   char* leaf = NULL;
@@ -796,8 +844,8 @@ bool file_to_disk_secure_link(const char* path, const char* basis_path, const vo
     free(leaf);
     /* The basis file could not be linked in (missing, cross-device, refused
        by the filesystem).  Write a byte-identical local copy instead. */
-    return file_to_disk_secure_with_fsync(path, data, data_size, false, false, metadata,
-                                          preserve_executability, use_fsync, temp_dir);
+    return file_to_disk_secure_with_fsync(path, data, data_size, false, false, preallocate,
+                                          metadata, preserve_executability, use_fsync, temp_dir);
   }
 
   if (scratch_dirfd >= 0)
@@ -811,5 +859,5 @@ bool file_write_to_disk(const char* path, const void* data, unsigned long long d
                         bool inplace, bool sparse) {
   if (!path || (!data && data_size != 0) || has_path_traversal(path))
     return false;
-  return file_to_disk_secure(path, data, data_size, inplace, sparse, NULL, false, NULL);
+  return file_to_disk_secure(path, data, data_size, inplace, sparse, false, NULL, false, NULL);
 }

src/shared/file.h

@@ -57,28 +57,33 @@ int file_open_private_dir(const char* dir_path);
    silently copied into place.  Pass NULL for the historical same-directory
    behavior.  --inplace writes never use temp_dir. */
 bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
-                         bool inplace, bool sparse, const FileMetadata* metadata,
+                         bool inplace, bool sparse, bool preallocate, const FileMetadata* metadata,
                          bool preserve_executability, const char* temp_dir);
 bool file_to_disk_secure_with_fsync(const char* path, const void* data,
                                     unsigned long long data_size, bool inplace, bool sparse,
-                                    const FileMetadata* metadata, bool preserve_executability,
-                                    bool use_fsync, const char* temp_dir);
+                                    bool preallocate, const FileMetadata* metadata,
+                                    bool preserve_executability, bool use_fsync,
+                                    const char* temp_dir);
 /* With update enabled, an existing newer destination is left untouched.  The
    check is descriptor-based for inplace writes; atomic replacement still has
    an unavoidable final rename race without filesystem locking. */
 bool file_to_disk_secure_update(const char* path, const void* data, unsigned long long data_size,
-                                bool inplace, bool sparse, const FileMetadata* metadata,
-                                bool preserve_executability, const char* temp_dir);
+                                bool inplace, bool sparse, bool preallocate,
+                                const FileMetadata* metadata, bool preserve_executability,
+                                const char* temp_dir);
 bool file_to_disk_secure_no_replace(const char* path, const void* data,
-                                    unsigned long long data_size, bool sparse,
+                                    unsigned long long data_size, bool sparse, bool preallocate,
                                     const FileMetadata* metadata, bool preserve_executability,
                                     const char* temp_dir);
 /* Atomic --link-dest install: replace `path` with a hard link to `basis_path`
    (via a temp name + rename); fall back to a byte-identical local copy from
    `data` when the link is impossible (EXDEV/EPERM/unsupported filesystem).
-   `metadata` is applied only on the copy fallback. */
+   `metadata` is applied only on the copy fallback.  `preallocate` applies to
+   that copy fallback only (a hard-linked file shares the basis inode and is
+   never re-allocated). */
 bool file_to_disk_secure_link(const char* path, const char* basis_path, const void* data,
-                              unsigned long long data_size, const FileMetadata* metadata,
-                              bool preserve_executability, bool use_fsync, const char* temp_dir);
+                              unsigned long long data_size, bool preallocate,
+                              const FileMetadata* metadata, bool preserve_executability,
+                              bool use_fsync, const char* temp_dir);
 
 #endif

src/shared/file_receive.c

@@ -81,11 +81,12 @@ static FileSaveResult file_stage_delayed_update(const char* root_directory,
   bool ok;
   if (file->basis_link) {
     ok = file_to_disk_secure_link(staged_path, file->basis_link, file->data->data, file->data->size,
-                                  metadata, preserve_executability, config->use_fsync, NULL);
+                                  config->preallocate, metadata, preserve_executability,
+                                  config->use_fsync, NULL);
   } else {
     ok = file_to_disk_secure_with_fsync(staged_path, file->data->data, file->data->size, false,
-                                        sparse, metadata, preserve_executability, config->use_fsync,
-                                        NULL);
+                                        sparse, config->preallocate, metadata,
+                                        preserve_executability, config->use_fsync, NULL);
   }
   if (!ok) {
     free(staged_path);
@@ -302,17 +303,20 @@ FileSaveResult file_save_to_disk_full(const char* root_directory, const File* fi
   bool ok;
   if (config && file->basis_link) {
     ok = file_to_disk_secure_link(disk_path, file->basis_link, file->data->data, file->data->size,
-                                  metadata, preserve_executability, config->use_fsync,
-                                  confined_temp);
+                                  config->preallocate, metadata, preserve_executability,
+                                  config->use_fsync, confined_temp);
   } else {
     ok = config && config->ignore_existing
              ? file_to_disk_secure_no_replace(disk_path, file->data->data, file->data->size, sparse,
-                                              metadata, preserve_executability, confined_temp)
+                                              config && config->preallocate, metadata,
+                                              preserve_executability, confined_temp)
          : config && config->update
              ? file_to_disk_secure_update(disk_path, file->data->data, file->data->size, inplace,
-                                          sparse, metadata, preserve_executability, confined_temp)
+                                          sparse, config && config->preallocate, metadata,
+                                          preserve_executability, confined_temp)
              : file_to_disk_secure_with_fsync(disk_path, file->data->data, file->data->size,
-                                              inplace, sparse, metadata, preserve_executability,
+                                              inplace, sparse, config && config->preallocate,
+                                              metadata, preserve_executability,
                                               config && config->use_fsync, confined_temp);
   }
   free(confined_temp);