Merge branch 'quality/g322' into quality/refactor

src/shared/identity.c

@@ -276,7 +276,7 @@ static bool identity_wire_map_valid(const IdentityMap* map) {
   }
   if (map->to < IDENTITY_CURRENT)
     return false;
-  if (map->to_name && strlen(map->to_name) > 255)
+  if (map->to_name && strlen(map->to_name) > IDENTITY_MAX_NAME_LEN)
     return false;
   return true;
 }

src/shared/identity.h

@@ -6,6 +6,11 @@
 #include <stdint.h>
 #include <sys/types.h>
 
+/* Maximum length of a receiver-resolved identity name in a FROM:TO map's TO
+ * field.  Bounded so a malicious/huge name can never cross the wire (see
+ * identity_wire_map_valid). */
+#define IDENTITY_MAX_NAME_LEN 255
+
 /*
  * Identity mapping: --numeric-ids / --usermap / --groupmap / --chown / --copy-as.
  *

src/shared/transport_tcp.c

@@ -134,7 +134,7 @@ Server* server_create_ex(int port, const ServerBindOptions* bind_opts) {
 
   server->file_descriptor = file_descriptor;
   server->ssl_ctx = NULL;
-  server->max_connections = 100;
+  server->max_connections = SERVER_DEFAULT_MAX_CONNECTIONS;
   server->active_connections = 0;
   server->limit_registry = NULL;
 

src/shared/transport_tcp.h

@@ -11,6 +11,10 @@
  * stored here so the transport layer does not depend on daemon config. */
 struct DaemonLimitRegistry;
 
+/* Connection cap applied by server_create_ex() until the daemon's configured
+ * `max connections` overrides it via server_set_max_connections(). */
+#define SERVER_DEFAULT_MAX_CONNECTIONS 100
+
 typedef struct Server {
   struct sockaddr_storage address;
   unsigned int address_length;