feat(d5-daemon-core): daemon lifecycle, module config, ::dest, PROTOCOL 2.15.0

src/shared/config.c

@@ -1,5 +1,6 @@
 #include "config.h"
 #include "chmod.h"
+#include "daemon_conf.h"
 #include "delay_updates.h"
 #include "delta.h"
 #include "file_list.h"
@@ -36,6 +37,7 @@ static void config_set_defaults(Config* config) {
   config->ssh_port = 22;
   config->transport = TRANSPORT_TCP;
   config->ssh_destination = NULL;
+  config->module = NULL;
   config->fastsync_server_path = NULL;
   config->exclude_patterns = NULL;
   config->exclude_count = 0;
@@ -470,6 +472,120 @@ bool config_is_remote_dest(const char* s) {
   return true;
 }
 
+/* Daemon destination detection: rsync's host::module[/path] marker is a "::"
+ * immediately after the host part (the first ':' is immediately followed by a
+ * second ':'), with no '/' before it.  A single ':' (host:path) stays the SSH
+ * form even when the path itself later contains colons, and a "[::1]"-style
+ * bracketed IPv6 literal is not recognized as a daemon destination this wave
+ * (its first "::" is inside the brackets). */
+bool config_is_daemon_dest(const char* s) {
+  if (s == NULL)
+    return false;
+  const char* colon = strchr(s, ':');
+  if (colon == NULL || colon == s || colon[1] != ':')
+    return false;
+  for (const char* p = s; p < colon; p++) {
+    if (*p == '/')
+      return false;
+  }
+  return true;
+}
+
+/* Log an escaped message with an 8-bit-safe output policy and return -1 (the
+ * caller-visible parse failure code). */
+static int daemon_dest_parse_error(const char* message, const char* detail) {
+  char* escaped = output_escape(detail ? detail : "", false);
+  log_message(LOG_LEVEL_ERROR, "%s: %s", message, escaped ? escaped : "<allocation failed>");
+  free(escaped);
+  return -1;
+}
+
+int config_parse_daemon_dest(Config* config) {
+  if (!config || !config->receive_root_directory)
+    return 0;
+  const char* dest = config->receive_root_directory;
+  if (!config_is_daemon_dest(dest))
+    return 0;
+
+  const char* colon = strchr(dest, ':');
+  /* user@host::module names a daemon auth user, which this daemon version
+   * cannot verify: reject it rather than silently ignoring the user (auth is
+   * Wave B). */
+  if (memchr(dest, '@', (size_t)(colon - dest)) != NULL)
+    return daemon_dest_parse_error("daemon destination user@host::module is not supported: user "
+                                   "authentication is not implemented by this daemon version",
+                                   dest);
+  const char* host_start = dest;
+
+  const char* module_and_path = colon + 2;
+  if (*module_and_path == '\0')
+    return daemon_dest_parse_error("daemon destination is missing its module name", dest);
+  const char* slash = strchr(module_and_path, '/');
+  size_t module_len = slash ? (size_t)(slash - module_and_path) : strlen(module_and_path);
+  char* module = malloc(module_len + 1);
+  if (!module)
+    return daemon_dest_parse_error("out of memory parsing daemon destination", dest);
+  memcpy(module, module_and_path, module_len);
+  module[module_len] = '\0';
+  if (!daemon_module_name_valid(module)) {
+    free(module);
+    return daemon_dest_parse_error(
+        "invalid daemon module name (must be 1-200 chars of [A-Za-z0-9._-])", dest);
+  }
+
+  const char* path = slash ? slash + 1 : "";
+  while (*path == '/')
+    path++; /* normalize "mod//a" to "mod/a"; keeps path module-relative */
+  if (has_path_traversal(path)) {
+    free(module);
+    return daemon_dest_parse_error("daemon destination path must not contain '..'", dest);
+  }
+
+  size_t host_len = (size_t)(colon - host_start);
+  char* host = malloc(host_len + 1);
+  if (!host) {
+    free(module);
+    return daemon_dest_parse_error("out of memory parsing daemon destination", dest);
+  }
+  memcpy(host, host_start, host_len);
+  host[host_len] = '\0';
+  if (*host == '\0') {
+    free(host);
+    free(module);
+    return daemon_dest_parse_error("daemon destination has no host", dest);
+  }
+
+  char* path_dup = str_dup(path);
+  if (!path_dup) {
+    free(host);
+    free(module);
+    return daemon_dest_parse_error("out of memory parsing daemon destination", dest);
+  }
+
+  free(config->server_host);
+  config->server_host = host;
+  free(config->module);
+  config->module = module;
+  free(config->receive_root_directory);
+  config->receive_root_directory = path_dup;
+  config->transport = TRANSPORT_TCP;
+  return 1;
+}
+
+int config_parse_transport_dest(Config* config) {
+  if (!config || !config->receive_root_directory)
+    return 0;
+  /* Daemon (host::module[/path]) first: the single-colon SSH parser would
+   * otherwise mis-split the double colon.  Returns 1 (parsed as daemon), 0
+   * (not daemon syntax -> try SSH below), or -1 (invalid daemon destination,
+   * already logged). */
+  int daemon_ret = config_parse_daemon_dest(config);
+  if (daemon_ret != 0)
+    return daemon_ret;
+  config_parse_ssh_dest(config);
+  return 0;
+}
+
 void config_parse_ssh_dest(Config* config) {
   if (!config_is_remote_dest(config->receive_root_directory))
     return;
@@ -492,6 +608,7 @@ void config_delete(Config* config) {
   free(config->send_directory);
   free(config->receive_root_directory);
   free(config->ssh_destination);
+  free(config->module);
   free(config->fastsync_server_path);
   for (int i = 0; i < config->exclude_count; i++)
     free(config->exclude_patterns[i]);
@@ -940,6 +1057,27 @@ static bool receive_phase4_xattr_options(int fd, Config* c) {
   return true;
 }
 
+/* Daemon module selection (Wave A, protocol 2.15.0).  Trailing string on the
+ * config frame, sent after the Phase-4 xattr block and before the ack.  The
+ * client composes it from a host::module/path destination; an unset module is
+ * serialized as "" and canonicalized back to NULL on receive so the two never
+ * look different to a peer. */
+static bool send_daemon_module(int fd, const Config* c) {
+  return send_str(fd, c->module ? c->module : "");
+}
+
+static bool receive_daemon_module(int fd, Config* c) {
+  char* module = receive_str(fd);
+  if (!module)
+    return false;
+  if (*module != '\0') {
+    c->module = module;
+  } else {
+    free(module);
+  }
+  return true;
+}
+
 bool config_send(int file_descriptor, const Config* config) {
   protocol_session_set_max_alloc(NULL, config->max_alloc);
   if (!send_core_fields(file_descriptor, config) || !send_delta_fields(file_descriptor, config) ||
@@ -951,7 +1089,8 @@ bool config_send(int file_descriptor, const Config* config) {
       !send_identity_options(file_descriptor, config) ||
       !send_metadata_times_options(file_descriptor, config) ||
       !send_symlink_trust_options(file_descriptor, config) ||
-      !send_phase4_xattr_options(file_descriptor, config))
+      !send_phase4_xattr_options(file_descriptor, config) ||
+      !send_daemon_module(file_descriptor, config))
     return false;
   Status status;
   if (!receive_status(file_descriptor, &status))
@@ -963,7 +1102,8 @@ bool config_send(int file_descriptor, const Config* config) {
   return true;
 }
 
-Config* config_receive(int file_descriptor) {
+Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc validate,
+                                     void* context) {
   Config* config = config_create();
   if (!config)
     return NULL;
@@ -990,7 +1130,8 @@ Config* config_receive(int file_descriptor) {
       !receive_identity_options(file_descriptor, config) ||
       !receive_metadata_times_options(file_descriptor, config) ||
       !receive_symlink_trust_options(file_descriptor, config) ||
-      !receive_phase4_xattr_options(file_descriptor, config))
+      !receive_phase4_xattr_options(file_descriptor, config) ||
+      !receive_daemon_module(file_descriptor, config))
     goto error;
   if (config->compress_choice[0] != '\0' && strcmp(config->compress_choice, "zstd") != 0 &&
       strcmp(config->compress_choice, "none") != 0) {
@@ -1006,6 +1147,17 @@ Config* config_receive(int file_descriptor) {
     send_status(file_descriptor, STATUS_ERROR);
     goto error;
   }
+  if (validate) {
+    const char* rejection = validate(config, context);
+    if (rejection != NULL) {
+      /* Daemon module gate (unknown module / read-only module / auth-required
+       * module): refuse BEFORE the STATUS_OK so the client aborts at the
+       * config handshake and no file data is ever exchanged. */
+      fprintf(stderr, "%s\n", rejection);
+      send_status(file_descriptor, STATUS_ERROR);
+      goto error;
+    }
+  }
   if (!send_status(file_descriptor, STATUS_OK))
     goto error;
   return config;
@@ -1014,3 +1166,7 @@ error:
   config_delete(config);
   return NULL;
 }
+
+Config* config_receive(int file_descriptor) {
+  return config_receive_with_validate(file_descriptor, NULL, NULL);
+}

src/shared/config.h

@@ -89,6 +89,12 @@ typedef struct Config {
   int ssh_port;
   TransportType transport;
   char* ssh_destination;
+  /* Daemon module selection (Wave A, protocol 2.15.0).  Client-composed from a
+   * host::module/path destination; NULL or "" means "no module" (the ordinary
+   * standalone-server path).  Crosses the wire as a trailing config-frame
+   * string so the daemon can look the module up in its own config and confine
+   * the connection to the module's root (never a client-chosen root). */
+  char* module;
   char* fastsync_server_path;
   char** exclude_patterns;
   int exclude_count;
@@ -438,7 +444,22 @@ typedef struct Config {
  * fails the version check cleanly up front (rather than the remote server
  * rejecting an unfamiliar forwarded argv at a confusing later point), which is
  * exactly what the lockstep convention of this project requires. */
-#define PROTOCOL_VERSION "2.14.0"
+/* Daemon Wave A: 2.14.0 -> 2.15.0.
+ *
+ * WHY the bump, grounded in the wire: this wave really does add a serialized
+ * field to the binary config frame.  The client sends its requested daemon
+ * module name (Config->module) as a new trailing string on the frame (sent
+ * after the Phase-4 xattr block and before the STATUS_OK/STATUS_ERROR ack, in
+ * config_send/config_receive), and the daemon reads it to select which module
+ * root confines the connection.  Any config-frame layout change must bump the
+ * protocol version because a peer that does not parse the new trailing bytes
+ * would desynchronize on the frame boundary; the strict same-version handshake
+ * (config_receive rejects a mismatched version before parsing anything else)
+ * is what keeps a 2.15 client and a 2.14 server from ever reaching that state.
+ *
+ * NOTE: daemon module-selection bump owned by Wave A (2.15.0); later daemon
+ * waves (auth, motd) must not bump PROTOCOL_VERSION. */
+#define PROTOCOL_VERSION "2.15.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 /* Upper bound on total basis-dir entries (rsync caps --link-dest at 20). */
 #define MAX_BASIS_DIRS 64
@@ -458,6 +479,38 @@ Config* config_receive(int file_descriptor);
 bool config_is_remote_dest(const char* s);
 void config_parse_ssh_dest(Config* config);
 
+/* Server-side config-frame gate (daemon module selection, Wave A).  A server
+ * that needs to make an accept/reject decision about a received Config BEFORE
+ * it sends the STATUS_OK ack (so a rejected connection is refused cleanly with
+ * no data transferred) passes a callback here; it runs after the frame parses
+ * and validates but before the STATUS_OK/STATUS_ERROR ack.  Return NULL to
+ * accept the connection; return a non-NULL message to reject it (the message
+ * is logged server-side and STATUS_ERROR is sent in place of STATUS_OK).  The
+ * callback runs in the connection's own process, so it may set up per-module
+ * process state (e.g. the authorized root).  context is an opaque caller
+ * pointer. */
+typedef const char* (*ConfigValidateFunc)(const Config* config, void* context);
+Config* config_receive_with_validate(int file_descriptor, ConfigValidateFunc validate,
+                                     void* context);
+
+/* Daemon-destination (host::module[/path]) helpers, Wave A.  config_is_remote_dest
+ * recognizes the ordinary rsync-style single-colon host:path form used by the
+ * SSH transport; config_is_daemon_dest recognizes the double-colon form that
+ * selects a daemon module over TCP.  config_parse_transport_dest is the single
+ * entry point main() uses: it parses a :: destination as a daemon TCP
+ * destination (host -> server_host, module -> config->module, path ->
+ * receive_root_directory) and otherwise falls back to the existing SSH
+ * host:path handling. */
+bool config_is_daemon_dest(const char* s);
+/* Returns 1 when the destination was daemon syntax and was parsed, 0 when it
+ * is not daemon syntax (nothing changed), -1 on an invalid daemon destination
+ * (a message is logged and config is left untouched). */
+int config_parse_daemon_dest(Config* config);
+/* Returns 1/0/-1 mirroring config_parse_daemon_dest when the destination is
+ * daemon syntax; otherwise runs the existing SSH host:path parse and returns
+ * 0. */
+int config_parse_transport_dest(Config* config);
+
 /* True when the negotiated delete timing performs the extra-file deletion
  * BEFORE the transfer data (--delete-before / --delete-during).  The flag is
  * a pure function of the config and is used identically on the sender (to pick

src/shared/daemon_conf.c

@@ -0,0 +1,442 @@
+#include "daemon_conf.h"
+#include "utils.h"
+#include <ctype.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+
+/* ------------------------------------------------------------------ */
+/* helpers                                                             */
+/* ------------------------------------------------------------------ */
+
+static void set_error(char* err, size_t err_size, const char* fmt, ...) {
+  if (!err || err_size == 0)
+    return;
+  va_list args;
+  va_start(args, fmt);
+  vsnprintf(err, err_size, fmt, args);
+  va_end(args);
+}
+
+/* Trim leading and trailing ASCII space/tab in place; returns the new start. */
+static char* trim_ws(char* s) {
+  while (*s == ' ' || *s == '\t')
+    s++;
+  size_t len = strlen(s);
+  while (len > 0 && (s[len - 1] == ' ' || s[len - 1] == '\t'))
+    s[--len] = '\0';
+  return s;
+}
+
+/* Case-insensitive equality of a parsed key against a canonical key name. */
+static bool key_equals(const char* key, const char* canonical) {
+  return strcasecmp(key, canonical) == 0;
+}
+
+static bool parse_bool_value(const char* value, bool* out) {
+  if (strcasecmp(value, "yes") == 0 || strcasecmp(value, "true") == 0 || strcmp(value, "1") == 0) {
+    *out = true;
+    return true;
+  }
+  if (strcasecmp(value, "no") == 0 || strcasecmp(value, "false") == 0 || strcmp(value, "0") == 0) {
+    *out = false;
+    return true;
+  }
+  return false;
+}
+
+bool daemon_module_name_valid(const char* name) {
+  if (!name || *name == '\0')
+    return false;
+  size_t len = strlen(name);
+  if (len > DAEMON_MAX_MODULE_NAME)
+    return false;
+  for (size_t i = 0; i < len; i++) {
+    unsigned char c = (unsigned char)name[i];
+    bool alnum = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9');
+    if (!alnum && c != '.' && c != '_' && c != '-')
+      return false;
+  }
+  return true;
+}
+
+DaemonConf* daemon_conf_create(void) {
+  DaemonConf* conf = calloc(1, sizeof(DaemonConf));
+  if (!conf)
+    return NULL;
+  conf->global.port = DAEMON_CONF_DEFAULT_PORT;
+  return conf;
+}
+
+void daemon_conf_free(DaemonConf* conf) {
+  if (!conf)
+    return;
+  free(conf->global.motd_file);
+  free(conf->global.address);
+  for (int i = 0; i < conf->module_count; i++) {
+    DaemonModule* m = &conf->modules[i];
+    free(m->name);
+    free(m->path);
+    for (int j = 0; j < m->auth_user_count; j++)
+      free(m->auth_users[j]);
+    free(m->auth_users);
+  }
+  free(conf->modules);
+  free(conf);
+}
+
+const DaemonModule* daemon_conf_find_module(const DaemonConf* conf, const char* name) {
+  if (!conf || !name)
+    return NULL;
+  for (int i = 0; i < conf->module_count; i++) {
+    if (strcmp(conf->modules[i].name, name) == 0)
+      return &conf->modules[i];
+  }
+  return NULL;
+}
+
+/* Replace *slot with a str_dup of value; returns false on allocation failure. */
+static bool store_string(char** slot, const char* value) {
+  char* dup = str_dup(value);
+  if (!dup)
+    return false;
+  free(*slot);
+  *slot = dup;
+  return true;
+}
+
+static bool store_port(int* slot, const char* value, char* err, size_t err_size) {
+  char* end;
+  errno = 0;
+  long p = strtol(value, &end, 10);
+  if (errno != 0 || *end != '\0' || *value == '\0' || p <= 0 || p > 65535) {
+    set_error(err, err_size, "invalid port '%s' (must be 1-65535)", value);
+    return false;
+  }
+  *slot = (int)p;
+  return true;
+}
+
+/* Apply a global scalar key/value.  Keys are case-insensitive.  Returns false
+ * (err filled) on an unknown key or an invalid value. */
+static bool apply_global_key(DaemonConf* conf, char* key, char* value, char* err, size_t err_size) {
+  if (key_equals(key, "port"))
+    return store_port(&conf->global.port, value, err, err_size);
+  if (key_equals(key, "motd file")) {
+    if (!store_string(&conf->global.motd_file, value)) {
+      set_error(err, err_size, "out of memory parsing 'motd file'");
+      return false;
+    }
+    return true;
+  }
+  if (key_equals(key, "address")) {
+    if (!store_string(&conf->global.address, value)) {
+      set_error(err, err_size, "out of memory parsing 'address'");
+      return false;
+    }
+    return true;
+  }
+  set_error(err, err_size, "unknown global key '%s'", key);
+  return false;
+}
+
+/* Apply a module key/value to the currently-open module.  Returns false (err
+ * filled) on an unknown module key or an invalid value. */
+static bool apply_module_key(DaemonModule* module, char* key, char* value, char* err,
+                             size_t err_size) {
+  if (key_equals(key, "path")) {
+    if (*value == '\0') {
+      set_error(err, err_size, "module '%s': 'path' must not be empty", module->name);
+      return false;
+    }
+    if (!store_string(&module->path, value)) {
+      set_error(err, err_size, "out of memory parsing 'path' for module '%s'", module->name);
+      return false;
+    }
+    return true;
+  }
+  if (key_equals(key, "read only")) {
+    bool parsed;
+    if (!parse_bool_value(value, &parsed)) {
+      set_error(err, err_size,
+                "module '%s': 'read only' must be yes/no (or true/false/1/0), got '%s'",
+                module->name, value);
+      return false;
+    }
+    module->read_only = parsed;
+    return true;
+  }
+  if (key_equals(key, "auth users")) {
+    char* list = str_dup(value);
+    if (!list) {
+      set_error(err, err_size, "out of memory parsing 'auth users' for module '%s'", module->name);
+      return false;
+    }
+    char* save = NULL;
+    for (char* token = strtok_r(list, ",", &save); token; token = strtok_r(NULL, ",", &save)) {
+      char* user = trim_ws(token);
+      if (*user == '\0')
+        continue;
+      char** grown =
+          realloc(module->auth_users, (size_t)(module->auth_user_count + 1) * sizeof(char*));
+      if (!grown) {
+        free(list);
+        set_error(err, err_size, "out of memory parsing 'auth users' for module '%s'",
+                  module->name);
+        return false;
+      }
+      module->auth_users = grown;
+      char* dup = str_dup(user);
+      if (!dup) {
+        free(list);
+        set_error(err, err_size, "out of memory parsing 'auth users' for module '%s'",
+                  module->name);
+        return false;
+      }
+      module->auth_users[module->auth_user_count++] = dup;
+    }
+    free(list);
+    return true;
+  }
+  set_error(err, err_size, "unknown key '%s' in module '%s'", key, module->name);
+  return false;
+}
+
+static bool module_open_valid(const DaemonModule* module, char* err, size_t err_size) {
+  if (module->path == NULL) {
+    set_error(err, err_size, "module '%s' has no 'path'", module->name);
+    return false;
+  }
+  return true;
+}
+
+/* Validate a [section] header line body (text between the brackets) and set
+ * *name to the module name.  Returns false on a malformed header. */
+static bool parse_section_name(char* body, const char** name_out, char* err, size_t err_size) {
+  char* name = trim_ws(body);
+  if (!daemon_module_name_valid(name)) {
+    set_error(err, err_size, "invalid module name '%s' (must be 1-%d chars of [A-Za-z0-9._-])",
+              name, DAEMON_MAX_MODULE_NAME);
+    return false;
+  }
+  *name_out = name;
+  return true;
+}
+
+/* Open (or switch to) a module section.  Closes any previously open module
+ * (validating it has a path) and appends the new one. */
+static int open_module(DaemonConf* conf, int* current_module, const char* name, char* err,
+                       size_t err_size) {
+  if (*current_module >= 0) {
+    if (!module_open_valid(&conf->modules[*current_module], err, err_size))
+      return -1;
+  }
+  if (daemon_conf_find_module(conf, name)) {
+    set_error(err, err_size, "duplicate module '%s'", name);
+    return -1;
+  }
+  DaemonModule* grown =
+      realloc(conf->modules, (size_t)(conf->module_count + 1) * sizeof(DaemonModule));
+  if (!grown) {
+    set_error(err, err_size, "out of memory adding module '%s'", name);
+    return -1;
+  }
+  conf->modules = grown;
+  memset(&conf->modules[conf->module_count], 0, sizeof(DaemonModule));
+  conf->modules[conf->module_count].name = str_dup(name);
+  if (!conf->modules[conf->module_count].name) {
+    set_error(err, err_size, "out of memory adding module '%s'", name);
+    return -1;
+  }
+  conf->module_count++;
+  *current_module = conf->module_count - 1;
+  return 0;
+}
+
+/* Split a "key = value" line (value pointer returned in *value, pointing into
+ * line).  Returns false when there is no '='. */
+static bool split_key_value(char* line, char** key, char** value) {
+  char* eq = strchr(line, '=');
+  if (!eq)
+    return false;
+  *eq = '\0';
+  *key = trim_ws(line);
+  *value = trim_ws(eq + 1);
+  return true;
+}
+
+/* Strip one layer of surrounding double quotes from a trimmed value.  A value
+ * that starts with '"' but does not end with '"' is an error. */
+static bool unquote_value(char* value, char* err, size_t err_size) {
+  size_t len = strlen(value);
+  if (len == 0 || value[0] != '"')
+    return true;
+  if (len < 2 || value[len - 1] != '"') {
+    set_error(err, err_size, "unterminated quoted value");
+    return false;
+  }
+  memmove(value, value + 1, len - 2);
+  value[len - 2] = '\0';
+  return true;
+}
+
+DaemonConf* daemon_conf_load(const char* path, char* err, size_t err_size) {
+  if (err && err_size)
+    err[0] = '\0';
+  if (!path) {
+    set_error(err, err_size, "no daemon config path");
+    return NULL;
+  }
+  FILE* fp = fopen(path, "r");
+  if (!fp) {
+    set_error(err, err_size, "cannot open daemon config '%s': %s", path, strerror(errno));
+    return NULL;
+  }
+
+  DaemonConf* conf = daemon_conf_create();
+  if (!conf) {
+    fclose(fp);
+    set_error(err, err_size, "out of memory allocating daemon config");
+    return NULL;
+  }
+
+  int current_module = -1;
+  int line_no = 0;
+  char line[DAEMON_CONF_MAX_LINE + 2];
+  bool ok = true;
+
+  while (ok && fgets(line, sizeof(line), fp)) {
+    line_no++;
+    size_t len = strlen(line);
+    if (len == DAEMON_CONF_MAX_LINE + 1 && line[len - 1] != '\n') {
+      /* The read stopped at the buffer edge without a newline and there is
+       * more file to come: the line exceeds the bound. */
+      if (!feof(fp)) {
+        set_error(err, err_size, "line %d exceeds the %d-byte limit", line_no,
+                  DAEMON_CONF_MAX_LINE);
+        ok = false;
+        break;
+      }
+    }
+    if (len > 0 && line[len - 1] == '\n')
+      line[--len] = '\0';
+    if (len > 0 && line[len - 1] == '\r')
+      line[--len] = '\0';
+
+    char* cursor = line;
+    while (*cursor == ' ' || *cursor == '\t')
+      cursor++;
+    if (*cursor == '\0' || *cursor == '#' || *cursor == ';')
+      continue; /* blank or comment line */
+
+    if (*cursor == '[') {
+      char* close = strchr(cursor, ']');
+      if (!close) {
+        set_error(err, err_size, "line %d: unterminated module header", line_no);
+        ok = false;
+        break;
+      }
+      *close = '\0';
+      char* trailing = close + 1;
+      char* rest = trim_ws(trailing);
+      if (*rest != '\0') {
+        set_error(err, err_size, "line %d: unexpected text after module header", line_no);
+        ok = false;
+        break;
+      }
+      const char* name = NULL;
+      if (!parse_section_name(cursor + 1, &name, err, err_size)) {
+        ok = false;
+        break;
+      }
+      if (open_module(conf, &current_module, name, err, err_size) != 0) {
+        ok = false;
+        break;
+      }
+      continue;
+    }
+
+    char* key;
+    char* value;
+    if (!split_key_value(cursor, &key, &value)) {
+      set_error(err, err_size, "line %d: expected 'key = value'", line_no);
+      ok = false;
+      break;
+    }
+    if (*key == '\0') {
+      set_error(err, err_size, "line %d: empty key", line_no);
+      ok = false;
+      break;
+    }
+    if (!unquote_value(value, err, err_size)) {
+      ok = false;
+      break;
+    }
+    if (current_module >= 0) {
+      if (!apply_module_key(&conf->modules[current_module], key, value, err, err_size)) {
+        ok = false;
+        break;
+      }
+    } else {
+      if (!apply_global_key(conf, key, value, err, err_size)) {
+        ok = false;
+        break;
+      }
+    }
+  }
+
+  if (ok && ferror(fp)) {
+    set_error(err, err_size, "error reading daemon config '%s': %s", path, strerror(errno));
+    ok = false;
+  }
+  fclose(fp);
+
+  if (ok && current_module >= 0 &&
+      !module_open_valid(&conf->modules[current_module], err, err_size)) {
+    ok = false;
+  }
+  if (!ok) {
+    daemon_conf_free(conf);
+    return NULL;
+  }
+  return conf;
+}
+
+int daemon_conf_apply_dparam(DaemonConf* conf, const char* assignment, char* err, size_t err_size) {
+  if (err && err_size)
+    err[0] = '\0';
+  if (!conf || !assignment || *assignment == '\0') {
+    set_error(err, err_size, "--dparam requires a KEY=VALUE override");
+    return -1;
+  }
+  char* copy = str_dup(assignment);
+  if (!copy) {
+    set_error(err, err_size, "out of memory parsing --dparam");
+    return -1;
+  }
+  char* eq = strchr(copy, '=');
+  if (!eq) {
+    free(copy);
+    set_error(err, err_size, "--dparam '%s' has no '=' (expected KEY=VALUE)", assignment);
+    return -1;
+  }
+  *eq = '\0';
+  char* key = trim_ws(copy);
+  char* value = trim_ws(eq + 1);
+  if (*key == '\0') {
+    free(copy);
+    set_error(err, err_size, "--dparam '%s' has an empty key", assignment);
+    return -1;
+  }
+  if (*value == '\0') {
+    free(copy);
+    set_error(err, err_size, "--dparam '%s' has an empty value", assignment);
+    return -1;
+  }
+  bool ok = apply_global_key(conf, key, value, err, err_size);
+  free(copy);
+  return ok ? 0 : -1;
+}

src/shared/daemon_conf.h

@@ -0,0 +1,92 @@
+#ifndef DAEMON_CONF_H
+#define DAEMON_CONF_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+/* FastSync-native daemon configuration (a FastSync analog of rsyncd.conf).
+ *
+ * This is the config the fastsync-server --daemon listener consumes.  It is
+ * line-based with an implicit global section followed by zero or more
+ * [module] sections.  The full grammar is documented in RSYNC_COMPAT.md
+ * ("Daemon Mode") and summarized below; the parser lives entirely in
+ * daemon_conf.c so it can be unit tested without any socket code.
+ *
+ * The parser is STRICT: an unknown key, a malformed line, a value that does
+ * not parse, a module without a `path`, or a line longer than
+ * DAEMON_CONF_MAX_LINE all fail the whole load with a clear, line-numbered
+ * error instead of being silently ignored.  This keeps a typo from silently
+ * changing what a module serves.
+ */
+
+/* A daemon module's configured root is used exactly like the standalone
+ * server's --destination-root: the daemon confines every connection that
+ * selects this module to this path (file_open_secure_parent /
+ * has_path_traversal / path_is_within all keep the existing confinement, just
+ * per-module).  There is never any client-chosen root and no --super /
+ * --copy-as: a module path always stays confined.
+ *
+ * `auth_users` is parsed and stored now (Wave A) for Wave B to honor, but the
+ * presence of auth users is already enforced with a SAFE default this wave:
+ * because FastSync cannot yet authenticate a claimed user, a module that
+ * declares auth users refuses every connection (see server.c).  Auth is never
+ * bypassed by ignoring the list. */
+typedef struct DaemonModule {
+  char* name;        /* module name, as the client requests it */
+  char* path;        /* module root (daemon-side authorized root) */
+  bool read_only;    /* `read only = yes/no`; default no */
+  char** auth_users; /* `auth users = a,b`; Wave B credential list */
+  int auth_user_count;
+} DaemonModule;
+
+/* Global (pre-module) scalar keys.  `motd file` is parsed and stored but has
+ * no wire effect yet (MOTD display is Wave C). */
+typedef struct DaemonConfGlobals {
+  int port;        /* `port`, default DAEMON_CONF_DEFAULT_PORT (873) */
+  char* motd_file; /* `motd file`, may be NULL */
+  char* address;   /* `address` (optional bind address), may be NULL */
+} DaemonConfGlobals;
+
+typedef struct DaemonConf {
+  DaemonConfGlobals global;
+  DaemonModule* modules;
+  int module_count;
+} DaemonConf;
+
+#define DAEMON_CONF_DEFAULT_PORT 873
+/* Longest accepted config line (excluding the trailing newline).  Longer lines
+ * are rejected rather than buffered unboundedly. */
+#define DAEMON_CONF_MAX_LINE 4096
+/* Upper bound on a module name.  Kept far below MAX_STRING_SIZE so a wire
+ * module name can never exhaust anything by being long. */
+#define DAEMON_MAX_MODULE_NAME 200
+
+/* Allocate an empty daemon config with defaulted globals (port 873, no
+ * modules, no motd/address).  Never fails for an allocation failure; callers
+ * must still NULL-check. */
+DaemonConf* daemon_conf_create(void);
+
+/* Parse `path` into a freshly allocated DaemonConf.  Returns NULL on any error
+ * and fills `err` (err_size bytes) with a clear, line-numbered message.  The
+ * returned object is heap-owned; free it with daemon_conf_free. */
+DaemonConf* daemon_conf_load(const char* path, char* err, size_t err_size);
+
+void daemon_conf_free(DaemonConf* conf);
+
+/* Case-sensitive exact module lookup by name.  Returns the module or NULL.
+ * Module names are matched exactly (rsync semantics). */
+const DaemonModule* daemon_conf_find_module(const DaemonConf* conf, const char* name);
+
+/* Module-name syntax check: non-empty, at most DAEMON_MAX_MODULE_NAME chars,
+ * and only [A-Za-z0-9._-].  Used by the config parser, the client's
+ * host::module/path destination parser, and (implicitly) by the daemon lookup
+ * (a name that fails this can never match a parsed module). */
+bool daemon_module_name_valid(const char* name);
+
+/* Parse one --dparam=KEY=VALUE (or "--dparam KEY=VALUE") override string and
+ * apply it to the global scalars only.  Keys are case-insensitive and limited
+ * to the global scalar keys defined by the grammar (port, motd file, address).
+ * Returns 0 on success, -1 on error (err filled). */
+int daemon_conf_apply_dparam(DaemonConf* conf, const char* assignment, char* err, size_t err_size);
+
+#endif