fix: close remaining PR 208 review gaps

src/shared/file.c

@@ -3,6 +3,7 @@
 #include <fcntl.h>
 #include <libgen.h>
 #include <limits.h>
+#include <poll.h>
 #include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -10,6 +11,7 @@
 #include <sys/sendfile.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#include <time.h>
 
 #include "compression.h"
 #include "delta.h"
@@ -147,6 +149,8 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
 
 static bool to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                            bool inplace, bool sparse, FileMetadata* metadata);
+static int open_secure_parent(const char* path, char** leaf_out);
+static bool rename_secure(const char* old_path, const char* new_path);
 
 static bool path_is_within_root(const char* root, const char* path) {
   size_t n = strlen(root);
@@ -162,7 +166,10 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
   const char* partial_dir = (config && config->partial_dir) ? config->partial_dir : NULL;
   char *confined_backup = NULL, *confined_partial = NULL;
 
-  if (has_path_traversal(file->path)) {
+  if (!file || !file->path || !file->data || has_path_traversal(file->path) ||
+      (backup_enabled &&
+       (!backup_suffix || backup_suffix[0] == '\0' || strchr(backup_suffix, '/') != NULL ||
+        strcmp(backup_suffix, ".") == 0 || strcmp(backup_suffix, "..") == 0))) {
     log_message(LOG_LEVEL_ERROR, "Path traversal detected in file path: %s", file->path);
     return false;
   }
@@ -259,7 +266,14 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
           mkdir_r(bdir);
           free(backup_dir_path);
         }
-        rename(disk_path, backup_path);
+        if (!rename_secure(disk_path, backup_path)) {
+          free(backup_path);
+          free(resolved_root);
+          free(confined_backup);
+          free(confined_partial);
+          free(disk_path);
+          return false;
+        }
         free(backup_path);
       }
     }
@@ -315,24 +329,6 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
   return ok;
 }
 
-static void* old_data_from_path(const char* full_path, unsigned long long old_size) {
-  void* data = malloc((size_t)old_size);
-  if (!data)
-    return NULL;
-  FILE* fp = fopen(full_path, "rb");
-  if (!fp) {
-    free(data);
-    return NULL;
-  }
-  size_t nread = fread(data, 1, (size_t)old_size, fp);
-  fclose(fp);
-  if (nread != (size_t)old_size) {
-    free(data);
-    return NULL;
-  }
-  return data;
-}
-
 static File* receive_delta_file(int fd, const Config* config, const char* check_path,
                                 void* old_data, unsigned long long old_size) {
   if (!old_data)
@@ -518,22 +514,54 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
 
   char* full_path = path_cat(config->receive_root_directory, check_path);
   struct stat st;
-  bool has_old_file = (full_path && lstat(full_path, &st) == 0);
+  bool has_old_file = false;
+  int old_fd = -1;
+  if (full_path) {
+    char* leaf = NULL;
+    int parent_fd = open_secure_parent(full_path, &leaf);
+    if (parent_fd >= 0) {
+      old_fd = openat(parent_fd, leaf, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+      free(leaf);
+      close(parent_fd);
+      has_old_file = old_fd >= 0 && fstat(old_fd, &st) == 0 && S_ISREG(st.st_mode);
+    }
+  }
   unsigned long long old_size = has_old_file ? (unsigned long long)st.st_size : 0;
+  void* old_data = NULL;
+  if (has_old_file && old_size > 0) {
+    old_data = malloc((size_t)old_size);
+    if (old_data) {
+      size_t got = 0;
+      while (got < (size_t)old_size) {
+        ssize_t n = read(old_fd, (char*)old_data + got, (size_t)old_size - got);
+        if (n <= 0) {
+          free(old_data);
+          old_data = NULL;
+          break;
+        }
+        got += (size_t)n;
+      }
+    }
+  }
+  if (old_fd >= 0) {
+    close(old_fd);
+    old_fd = -1;
+  }
 
   bool match = has_old_file && (unsigned long long)st.st_size == check_size;
   if (match && config->checksum) {
-    void* old_data = old_size > 0 ? old_data_from_path(full_path, old_size) : NULL;
     uint64_t old_checksum = old_size == 0 ? delta_xxhash64("", 0) : 0;
     if (old_data)
       old_checksum = delta_xxhash64(old_data, (size_t)old_size);
     match = (old_size == 0 || old_data) && old_checksum == check_checksum;
     free(old_data);
+    old_data = NULL;
   } else if (match) {
     match = (long long)st.st_mtime == check_mtime;
   }
 
   if (match) {
+    free(old_data);
     if (!send_status(fd, STATUS_OK)) {
       free(full_path);
       free(check_path);
@@ -549,13 +577,15 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
                    delta_should_attempt(old_size, check_size, config->delta_max_file_size);
 
   if (try_delta) {
-    void* old_data = old_data_from_path(full_path, old_size);
     File* delta_file = receive_delta_file(fd, config, check_path, old_data, old_size);
+    old_data = NULL; /* receive_delta_file consumes the snapshot on every path */
     if (delta_file) {
       free(full_path);
       free(check_path);
       return delta_file;
     }
+    free(old_data);
+    old_data = NULL;
     try_delta = false;
   }
 
@@ -649,6 +679,21 @@ static int open_secure_parent(const char* path, char** leaf_out) {
   return fd;
 }
 
+static bool rename_secure(const char* old_path, const char* new_path) {
+  char *old_leaf = NULL, *new_leaf = NULL;
+  int old_parent = open_secure_parent(old_path, &old_leaf);
+  int new_parent = open_secure_parent(new_path, &new_leaf);
+  bool ok = old_parent >= 0 && new_parent >= 0 &&
+            renameat(old_parent, old_leaf, new_parent, new_leaf) == 0;
+  if (old_parent >= 0)
+    close(old_parent);
+  if (new_parent >= 0)
+    close(new_parent);
+  free(old_leaf);
+  free(new_leaf);
+  return ok;
+}
+
 static bool write_all(int fd, const void* data, unsigned long long size) {
   const unsigned char* p = data;
   unsigned long long done = 0;
@@ -677,7 +722,7 @@ static bool to_disk_secure(const char* path, const void* data, unsigned long lon
       if (!sparse || data_size == 0 || ftruncate(fd, (off_t)data_size) == 0)
         ok = write_all(fd, data, data_size);
       if (ok && metadata)
-        file_restore_metadata_fd(fd, metadata);
+        ok = file_restore_metadata_fd(fd, metadata);
     }
   } else {
     char tmp[NAME_MAX];
@@ -691,7 +736,7 @@ static bool to_disk_secure(const char* path, const void* data, unsigned long lon
       if (ok || (!sparse || data_size == 0))
         ok = write_all(fd, data, data_size);
       if (ok && metadata)
-        file_restore_metadata_fd(fd, metadata);
+        ok = file_restore_metadata_fd(fd, metadata);
       if (close(fd) != 0)
         ok = false;
       fd = -1;
@@ -838,8 +883,35 @@ bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int
     return false;
   }
 
+  /* sendfile cannot encrypt TLS records.  Keep the framing identical but
+     route encrypted transfers through the deadline-aware IO layer. */
+  if (io_get_ssl() != NULL) {
+    bool loaded = file->data->data != NULL || file_load_data(file);
+    bool ok = loaded && send_n_data(file_descriptor, file->data->data, (size_t)file_size);
+    close(fd);
+    return ok;
+  }
+
   off_t offset = 0;
+  struct timespec deadline;
+  clock_gettime(CLOCK_MONOTONIC, &deadline);
+  deadline.tv_sec += 60;
   while ((unsigned long long)offset < file_size) {
+    struct timespec now;
+    clock_gettime(CLOCK_MONOTONIC, &now);
+    long long remaining = (long long)(deadline.tv_sec - now.tv_sec) * 1000LL +
+                          (deadline.tv_nsec - now.tv_nsec) / 1000000LL;
+    if (remaining <= 0) {
+      close(fd);
+      return false;
+    }
+    struct pollfd pfd = {.fd = file_descriptor, .events = POLLOUT};
+    int timeout = remaining > INT_MAX ? INT_MAX : (int)remaining;
+    int polled = poll(&pfd, 1, timeout);
+    if (polled <= 0 || (pfd.revents & (POLLERR | POLLHUP | POLLNVAL))) {
+      close(fd);
+      return false;
+    }
     ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
     if (sent == -1) {
       if (errno == EAGAIN || errno == EINTR)
@@ -911,6 +983,8 @@ size_t file_content_to_buffer(File* file) {
 }
 
 int receive_manifest(int fd, const Config* config, int* next_status) {
+  int received_status = STATUS_ERROR;
+  int* status_out = next_status ? next_status : &received_status;
   int count;
   if (!receive_int(fd, &count))
     return -1;
@@ -931,18 +1005,18 @@ int receive_manifest(int fd, const Config* config, int* next_status) {
       return -1;
     }
   }
-  if (!receive_status(fd, next_status)) {
+  if (!receive_status(fd, status_out)) {
     array_list_delete(manifest);
     return -1;
   }
   /* Deletion is a commit operation: never perform it until the sender has
      completed the manifest frame successfully. */
-  if (*next_status != STATUS_FINISHED || !config->use_delete) {
+  if (*status_out != STATUS_FINISHED || !config->use_delete) {
     array_list_delete(manifest);
-    return *next_status == STATUS_FINISHED ? 0 : -1;
+    return *status_out == STATUS_FINISHED ? 0 : -1;
   }
   fprintf(stderr, "Deleting files not in manifest...\n");
-  delete_extras(config->receive_root_directory, manifest);
+  bool deletion_ok = delete_extras(config->receive_root_directory, manifest);
   array_list_delete(manifest);
-  return 0;
+  return deletion_ok ? 0 : -1;
 }

src/shared/metadata.c

@@ -188,16 +188,16 @@ void file_restore_metadata(const char* path, FileMetadata* metadata) {
     log_message(LOG_LEVEL_WARNING, "Failed to set timestamps on %s: %s", path, strerror(errno));
 }
 
-void file_restore_metadata_fd(int fd, FileMetadata* metadata) {
+bool file_restore_metadata_fd(int fd, FileMetadata* metadata) {
   if (fd < 0 || metadata == NULL)
-    return;
+    return metadata == NULL;
+  bool ok = true;
   if (fchmod(fd, metadata->mode & 07777 & ~(S_ISUID | S_ISGID)) != 0)
-    log_message(LOG_LEVEL_WARNING, "Failed to fchmod received file: %s", strerror(errno));
-  if (fchown(fd, metadata->uid, metadata->gid) != 0 && errno != EPERM)
-    log_message(LOG_LEVEL_WARNING, "Failed to fchown received file: %s", strerror(errno));
-  struct timespec times[2] = {{.tv_sec = metadata->mtime_sec, .tv_nsec = metadata->mtime_nsec},
+    ok = false;
+  /* Client uid/gid values are deliberately not authoritative. */
+  struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
                               {.tv_sec = metadata->mtime_sec, .tv_nsec = metadata->mtime_nsec}};
   if (futimens(fd, times) != 0)
-    log_message(LOG_LEVEL_WARNING, "Failed to restore received file timestamps: %s",
-                strerror(errno));
+    ok = false;
+  return ok;
 }

src/shared/metadata.h

@@ -30,6 +30,6 @@ FileMetadata* metadata_from_buf(char** buf);
 bool metadata_send(int file_descriptor, FileMetadata* m);
 FileMetadata* metadata_receive(int file_descriptor, int* ok);
 void file_restore_metadata(const char* path, FileMetadata* metadata);
-void file_restore_metadata_fd(int fd, FileMetadata* metadata);
+bool file_restore_metadata_fd(int fd, FileMetadata* metadata);
 
 #endif

src/shared/multiprocessing.c

@@ -239,6 +239,7 @@ int receive_thread(void* pipeline_context) {
                 context->queue, file, &context->mutex, &context->condition_not_empty,
                 &context->condition_not_full, &context->cancelled)) {
           file_destroy(file);
+          receiver_thread_fail(context);
           return thrd_error;
         }
       } else {
@@ -285,6 +286,7 @@ int write_thread(void* pipeline_context) {
       file_destroy(file);
       mtx_lock(&context->mutex);
       atomic_store(&context->cancelled, true);
+      context->receiver_done = true;
       cnd_broadcast(&context->condition_not_full);
       cnd_broadcast(&context->condition_not_empty);
       mtx_unlock(&context->mutex);

src/shared/protocol.c

@@ -33,6 +33,7 @@ void io_set_fds(int read_fd, int write_fd) {
   /* A descriptor switch starts a new transport; never reuse a TLS object
      belonging to a previous connection or test pipe. */
   io_ssl = NULL;
+  total_allocated_bytes = 0;
 }
 
 static void bw_mutex_init(void) {
@@ -247,7 +248,7 @@ char* receive_str(int file_descriptor) {
   if (!receive_n_data(file_descriptor, &size, sizeof(size_t)))
     return NULL;
   if (size > MAX_STRING_SIZE || size > SIZE_MAX - 1 ||
-      total_allocated_bytes > MAX_CONNECTION_MEMORY - (size + 1)) {
+      size + 1 > MAX_CONNECTION_MEMORY - total_allocated_bytes) {
     log_message(LOG_LEVEL_ERROR, "String size %zu exceeds maximum %llu", size,
                 (unsigned long long)MAX_STRING_SIZE);
     return NULL;
@@ -260,6 +261,7 @@ char* receive_str(int file_descriptor) {
     return NULL;
   }
   data[size] = '\0';
+  total_allocated_bytes += size + 1;
   log_message(LOG_LEVEL_DEBUG, "Received String: %s", data);
   return data;
 }
@@ -283,22 +285,28 @@ Data* receive_data(int file_descriptor) {
                 (unsigned long long)MAX_DATA_PAYLOAD_SIZE);
     return NULL;
   }
-  if (total_allocated_bytes + size > MAX_CONNECTION_MEMORY) {
+  size_t allocation_size = size == 0 ? 1 : (size_t)size;
+  if (allocation_size > MAX_CONNECTION_MEMORY - total_allocated_bytes) {
     log_message(LOG_LEVEL_ERROR, "Per-connection memory limit exceeded (%llu + %llu > %llu)",
                 (unsigned long long)total_allocated_bytes, size,
                 (unsigned long long)MAX_CONNECTION_MEMORY);
     return NULL;
   }
-  void* data = malloc((size_t)size);
+  void* data = malloc(allocation_size);
   if (data == NULL)
     return NULL;
   if (!receive_n_data(file_descriptor, data, (size_t)size)) {
     free(data);
     return NULL;
   }
-  total_allocated_bytes += size + 1;
+  total_allocated_bytes += allocation_size;
   log_message(LOG_LEVEL_DEBUG, "Received %lld data", size);
-  return data_create(data, (size_t)size);
+  Data* result = data_create(data, (size_t)size);
+  if (!result) {
+    free(data);
+    total_allocated_bytes -= allocation_size;
+  }
+  return result;
 }
 
 bool send_int(int file_descriptor, int data) {

src/shared/utils.c

@@ -137,16 +137,17 @@ static bool is_dir_in_manifest(const char* rel_path, ArrayList* manifest) {
   return false;
 }
 
-static void delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifest) {
+static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifest) {
   int scanfd = dup(dirfd);
   if (scanfd < 0)
-    return;
+    return false;
   DIR* dir = fdopendir(scanfd);
   if (!dir) {
     close(scanfd);
-    return;
+    return false;
   }
   bool all_removed = true;
+  bool operation_ok = true;
   const struct dirent* entry;
   while ((entry = readdir(dir)) != NULL) {
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
@@ -164,9 +165,15 @@ static void delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
     }
     if (S_ISDIR(st.st_mode)) {
       int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      if (childfd >= 0)
-        delete_extras_fd(childfd, child_rel, manifest);
-      if (unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0 && errno != ENOENT) {
+      bool child_removed = false;
+      if (childfd >= 0) {
+        child_removed = delete_extras_fd(childfd, child_rel, manifest);
+        close(childfd);
+      }
+      if (child_removed && !is_dir_in_manifest(child_rel, manifest) &&
+          unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0 && errno != ENOENT) {
+        operation_ok = false;
+      } else if (!child_removed) {
         all_removed = false;
       }
     } else {
@@ -180,7 +187,7 @@ static void delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
       }
       if (!found) {
         if (unlinkat(dirfd, entry->d_name, 0) != 0 && errno != ENOENT)
-          all_removed = false;
+          operation_ok = false;
         fprintf(stderr, "  Deleted: %s\n", child_rel);
       } else {
         all_removed = false;
@@ -189,20 +196,18 @@ static void delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
     free(child_rel);
   }
   closedir(dir);
-  // Only remove the directory itself if it is not in the manifest
-  // and contained no kept entries.
-  if (all_removed && rel_path[0] != '\0' && !is_dir_in_manifest(rel_path, manifest)) {
-    /* The caller owns the directory fd; removing this name is done by its
-       parent, so recursive callers perform it in their own frame. */
-  }
+  (void)all_removed;
+  return operation_ok;
 }
 
-void delete_extras(const char* dest_root, ArrayList* manifest) {
+bool delete_extras(const char* dest_root, ArrayList* manifest) {
   int rootfd = open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
   if (rootfd < 0)
-    return;
-  delete_extras_fd(rootfd, "", manifest);
-  close(rootfd);
+    return false;
+  bool ok = delete_extras_fd(rootfd, "", manifest);
+  if (close(rootfd) != 0)
+    ok = false;
+  return ok;
 }
 
 bool has_path_traversal(const char* path) {

src/shared/utils.h

@@ -8,7 +8,7 @@ bool mkdir_r(const char* path);
 char* str_dup(const char* string);
 char* path_cat(const char* path1, const char* path2);
 bool glob_match(const char* pattern, const char* str);
-void delete_extras(const char* dest_root, ArrayList* manifest);
+bool delete_extras(const char* dest_root, ArrayList* manifest);
 bool has_path_traversal(const char* path);
 
 #endif