feat(daemon): host ACL, configurable max connections, peer audit, auth-failure delay

src/shared/daemon_conf.h

@@ -52,14 +52,32 @@ typedef struct DaemonModule {
                         activities.  Without it the daemon refuses all of them. */
   char** auth_users; /* `auth users = a,b`; Wave B credential list */
   int auth_user_count;
+  /* `max connections = N` (optional per-module cap).  0 means "not set"
+   * (inherit the global cap).  Parsed, stored, and validated, but NOT enforced
+   * per-module: connections are counted in the accept-loop parent before the
+   * client's module is known, so only the global cap is enforced (see
+   * transport_tcp.c and the Daemon Mode notes in RSYNC_COMPAT.md). */
+  int max_connections;
+  char** hosts_allow; /* `hosts allow = a,b`; host access allow patterns */
+  int hosts_allow_count;
+  char** hosts_deny; /* `hosts deny = a,b`; host access deny patterns */
+  int hosts_deny_count;
 } DaemonModule;
 
 /* Global (pre-module) scalar keys.  `motd file` is parsed and stored but has
  * no wire effect yet (MOTD display is Wave C). */
 typedef struct DaemonConfGlobals {
-  int port;        /* `port`, default DAEMON_CONF_DEFAULT_PORT (873) */
-  char* motd_file; /* `motd file`, may be NULL */
-  char* address;   /* `address` (optional bind address), may be NULL */
+  int port;                  /* `port`, default DAEMON_CONF_DEFAULT_PORT (873) */
+  char* motd_file;           /* `motd file`, may be NULL */
+  char* address;             /* `address` (optional bind address), may be NULL */
+  int max_connections;       /* `max connections`, default
+                                DAEMON_CONF_DEFAULT_MAX_CONNECTIONS (100) */
+  int auth_failure_delay_ms; /* `auth failure delay`, milliseconds; default
+                                DAEMON_CONF_DEFAULT_AUTH_FAILURE_DELAY_MS */
+  char** hosts_allow;        /* `hosts allow`; global host access allow patterns */
+  int hosts_allow_count;
+  char** hosts_deny; /* `hosts deny`; global host access deny patterns */
+  int hosts_deny_count;
 } DaemonConfGlobals;
 
 typedef struct DaemonConf {
@@ -69,6 +87,14 @@ typedef struct DaemonConf {
 } DaemonConf;
 
 #define DAEMON_CONF_DEFAULT_PORT 873
+/* Default global connection cap when `max connections` is absent.  Matches the
+ * historical hardcoded listener value. */
+#define DAEMON_CONF_DEFAULT_MAX_CONNECTIONS 100
+/* Default `auth failure delay` in milliseconds (0 disables the throttle). */
+#define DAEMON_CONF_DEFAULT_AUTH_FAILURE_DELAY_MS 500
+/* Largest accepted `auth failure delay`, so a typo cannot pin a connection
+ * child in nanosleep for an absurd time. */
+#define DAEMON_CONF_MAX_AUTH_FAILURE_DELAY_MS 60000
 /* Longest accepted config line (excluding the trailing newline).  Longer lines
  * are rejected rather than buffered unboundedly. */
 #define DAEMON_CONF_MAX_LINE 4096
@@ -99,9 +125,30 @@ const DaemonModule* daemon_conf_find_module(const DaemonConf* conf, const char*
 bool daemon_module_name_valid(const char* name);
 
 /* Parse one --dparam=KEY=VALUE (or "--dparam KEY=VALUE") override string and
- * apply it to the global scalars only.  Keys are case-insensitive and limited
- * to the global scalar keys defined by the grammar (port, motd file, address).
- * Returns 0 on success, -1 on error (err filled). */
+ * apply it to the global keys only.  Keys are case-insensitive and limited to
+ * the global keys defined by the grammar (port, motd file, address,
+ * max connections, auth failure delay, hosts allow, hosts deny).  Returns 0 on
+ * success, -1 on error (err filled). */
 int daemon_conf_apply_dparam(DaemonConf* conf, const char* assignment, char* err, size_t err_size);
 
+/* Host access-control matching (pure; no I/O).  `daemon_host_pattern_match`
+ * matches one configured pattern against a numeric peer IP string.  Supported
+ * patterns: `*` (match anything), an IPv4/IPv6 literal, an IPv4/IPv6 CIDR
+ * (`10.0.0.0/8`, `2001:db8::/32`), or a glob (`*.example.com`) evaluated with
+ * the same matcher as file globs; a glob only matches a peer string of the
+ * same shape, so a numeric peer never matches a hostname glob. */
+bool daemon_host_pattern_match(const char* pattern, const char* peer_ip);
+
+/* rsync-like combined decision over a deny list and an allow list: a matching
+ * deny rejects (deny takes precedence); otherwise, when any allow entries
+ * exist, a peer that matches none is rejected; with no allow entries every
+ * peer not denied is accepted.  An empty/unset pair returns true. */
+bool daemon_hosts_allowed(const char* peer_ip, char* const* allow, int allow_count,
+                          char* const* deny, int deny_count);
+
+/* True when at least one allow or deny pattern is configured (i.e. an
+ * unprovable peer must fail closed rather than being treated as unrestricted). */
+bool daemon_hosts_restricted(char* const* allow, int allow_count, char* const* deny,
+                             int deny_count);
+
 #endif