chore: remove build-asan from tracking, add to .gitignore

# Conflicts:
#	src/client/client_send.c
#	src/shared/config.c
#	src/shared/file.c
#	src/shared/file.h
#	src/shared/protocol.h

.clang-format

@@ -0,0 +1,10 @@
+BasedOnStyle: LLVM
+IndentWidth: 2
+ColumnLimit: 100
+PointerAlignment: Left
+AllowShortFunctionsOnASingleLine: None
+SortIncludes: false
+AllowShortIfStatementsOnASingleLine: false
+AllowShortLoopsOnASingleLine: false
+BinPackArguments: true
+BinPackParameters: true

.gitea/workflows/ci.yaml

@@ -0,0 +1,57 @@
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: clang-format check
+        run: find src/ tests/ -name '*.c' -o -name '*.h' | xargs clang-format --dry-run --Werror
+
+      - name: cppcheck
+        run: cppcheck --enable=warning,style,performance,portability --suppress=missingIncludeSystem --error-exitcode=1 --inline-suppr src/ tests/
+
+  build-and-test:
+    runs-on: ubuntu-latest
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    needs: lint
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: cmake -B build -S . -DSTRICT_WARNINGS=ON
+
+      - name: Build
+        run: cmake --build build -j$(nproc)
+
+      - name: Unit Tests
+        run: ./build/tests
+
+      - name: Integration Tests
+        run: python3 -m pytest tests/ -v --tb=short
+
+  sanitizers:
+    runs-on: ubuntu-latest
+    container: gitea.tap-tap.win/taptap/fastsync-ci:v7
+    needs: lint
+    strategy:
+      matrix:
+        sanitizer: [address]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure
+        run: cmake -B build-${{ matrix.sanitizer }} -S . -DSANITIZER=${{ matrix.sanitizer }}
+
+      - name: Build
+        run: cmake --build build-${{ matrix.sanitizer }} -j$(nproc)
+
+      - name: Unit Tests
+        run: ./build-${{ matrix.sanitizer }}/tests

.gitignore

@@ -2,3 +2,4 @@ build
 data_copied
 test_data/
 __pycache__/
+build-asan

.opencode/agents/architect.md

@@ -0,0 +1,112 @@
+---
+description: Designs system architecture, module interactions, data flow, and makes high-level design decisions for FastSync.
+mode: subagent
+---
+
+You are a system architect for the FastSync project — a high-performance file synchronization system written in C11.
+
+## Your Role
+
+Make high-level design decisions. Evaluate trade-offs, plan module interactions, design data flow, and ensure architectural coherence across the codebase.
+
+## Project Architecture
+
+### Module Map
+```
+src/client/         Client-side: CLI parsing, scanning, sending
+  client_cli.c      Entry point, argument parsing, config setup
+  client_send.c     Transfer orchestration, pipeline management
+  scanner.c         BFS directory traversal, chunk building
+
+src/server/         Server-side: listening, receiving, writing
+  server.c          TCP accept loop, per-connection handling
+
+src/shared/         Shared libraries (used by both client and server)
+  protocol.c/h      Wire protocol: status codes, send/receive primitives
+  compression.c/h   zstd streaming compression/decompression
+  chunk.c/h         File grouping and batch serialization
+  queue.c/h         Thread-safe bounded queue (producer-consumer)
+  config.c/h        Runtime configuration, serialization, parsing
+  data.c/h          Generic buffer type (Data)
+  metadata.c/h      File metadata (mode, uid, gid, mtime)
+  file.c/h          File representation
+  array_list.c/h    Dynamic array
+  transport_tcp.c/h TCP client/server with sendfile() zero-copy
+  transport_ssh.c/h SSH transport with ControlMaster
+  transport_tls.c/h TLS encryption via OpenSSL
+  multiprocessing.c/h Fork-based concurrency
+  log.c/h           Logging utilities
+  utils.c/h         Shared utilities
+```
+
+### Data Flow — Client Transfer Pipeline
+```
+CLI args → Config
+  → DirectoryScanner (BFS, exclude/include patterns)
+    → Queue[Scanner → Loader]
+      → ChunkBuilder (groups files into ~10MB chunks)
+        → Queue[Loader → Sender]
+          → [Optional: Compression (zstd streaming)]
+            → [Optional: Chunk Serialization]
+              → Network (TCP sendfile / SSH pipe)
+                → Protocol framing (status codes + data)
+```
+
+### Data Flow — Server Receive
+```
+TCP accept / SSH stdio
+  → Config receive
+    → Per-connection handler (fork)
+      → [Optional: Decompression]
+        → [Optional: Chunk deserialization]
+          → File write / metadata restore
+            → [Optional: Delete processing via manifest]
+```
+
+### Threading Model
+- Client uses producer-consumer with C11 threads (`thrd_t`)
+- Bounded queues with `mtx_t` + `cnd_t` for backpressure
+- Scanner → Loader → Sender pipeline
+- Server uses `fork()` per connection, optional thread pool
+
+### Transport Abstraction
+- `io_set_fds(read_fd, write_fd)` — set active file descriptors
+- `io_set_ssl(SSL*)` — transparent TLS wrapping
+- `io_set_bwlimit(bytes_per_sec)` — token-bucket throttling
+- All protocol functions use the active IO layer transparently
+
+## Design Principles
+
+1. **Performance first** — zero-copy where possible, streaming compression, multithreading
+2. **Simplicity** — status-code-driven protocol, no complex state machines
+3. **Composability** — features enabled via flags (-c, -m, -s, -f, -M)
+4. **Backward compatibility** — version field in config for negotiation
+5. **Unix philosophy** — do one thing well, compose via CLI flags
+
+## When Making Design Decisions
+
+### Evaluate
+1. **Performance impact** — Will this slow down the hot path?
+2. **Complexity cost** — Does this add state, protocol changes, or new failure modes?
+3. **Backward compatibility** — Can old clients/servers handle this?
+4. **Testability** — Can this be unit tested independently?
+5. **Composability** — Does this compose with existing flags/features?
+
+### Output Format
+
+When proposing architecture changes:
+1. **Problem** — what needs to be solved or improved
+2. **Current behavior** — how it works now
+3. **Proposed design** — new architecture with data flow diagrams
+4. **Trade-offs** — what's gained vs what's lost
+5. **Migration path** — how to get from current to proposed
+6. **Affected modules** — which files need changes
+7. **Testing strategy** — how to verify the change works
+
+### Anti-patterns to Watch For
+- God functions (>200 lines, doing too many things)
+- Circular dependencies between modules
+- Leaking transport details into application logic
+- Hardcoded constants that should be configurable
+- Missing error propagation (silent failures)
+- Thread safety violations when adding new shared state

.opencode/agents/c-reviewer.md

@@ -52,6 +52,18 @@ Review C source files for correctness, safety, and style. You have deep knowledg
 - No deadlock potential — consistent lock ordering.
 - `done` flags checked properly in consumer loops.
 
+### Security
+- No `strcpy`/`strcat`/`sprintf` — use `snprintf` with bounds.
+- `malloc` size calculations don't overflow (`count * sizeof(...)` checked).
+- Path traversal prevention: no `..` in received filenames.
+- No fixed-size stack buffers for unbounded network input.
+- TLS error codes checked after `SSL_read`/`SSL_write`.
+- No hardcoded certificates, keys, or credentials.
+- Private key file permissions checked.
+- Received file permissions validated (no SUID/SGID injection).
+- Symlink attack prevention in destination directory.
+- Denial of service: bounded memory allocation, malformed messages handled gracefully.
+
 ### Protocol Safety
 - `send_n_data` / `receive_n_data` return values checked.
 - Status codes validated before use.
@@ -69,7 +81,7 @@ Review C source files for correctness, safety, and style. You have deep knowledg
 For each issue found, report:
 1. **File and line** — exact location
 2. **Severity** — critical / warning / style
-3. **Category** — memory / thread / protocol / style
+3. **Category** — memory / thread / protocol / security / style
 4. **Description** — what's wrong and how to fix it
 
 If the code is clean, say so explicitly. Be concise — don't pad with fluff.

.opencode/agents/cmake-expert.md

@@ -80,6 +80,67 @@ tests/         — test sources (globbed as TEST_SRCS)
 6. For sanitizer builds, use the commented-out `-fsanitize=address` lines as reference.
 7. Always verify the build compiles after changes.
 
+## Sanitizer Configurations
+
+### AddressSanitizer (memory errors)
+```bash
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake --build build -j$(nproc)
+```
+
+### ThreadSanitizer (race conditions)
+```bash
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=thread -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread"
+cmake --build build -j$(nproc)
+```
+
+### UndefinedBehaviorSanitizer
+```bash
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=undefined -fno-omit-frame-pointer -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=undefined"
+cmake --build build -j$(nproc)
+```
+
+### Combined Sanitizers
+```bash
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=address,undefined -fno-omit-frame-pointer -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address,undefined"
+cmake --build build -j$(nproc)
+```
+
+### Using ccache (faster rebuilds)
+```bash
+cmake -B build -S . -DCMAKE_C_COMPILER_LAUNCHER=ccache
+cmake --build build -j$(nproc)
+```
+
+### Cross-Compilation
+```bash
+# ARM cross-compile example
+cmake -B build-arm -S . \
+  -DCMAKE_SYSTEM_NAME=Linux \
+  -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
+  -DCMAKE_C_COMPILER=aarch64-linux-gnu-gcc
+```
+
+### Release vs Debug Builds
+```bash
+# Release (optimized)
+cmake -B build -S . -DCMAKE_BUILD_TYPE=Release
+
+# Debug (with symbols, no optimization)
+cmake -B build -S . -DCMAKE_BUILD_TYPE=Debug
+
+# RelWithDebInfo (optimized + debug symbols)
+cmake -B build -S . -DCMAKE_BUILD_TYPE=RelWithDebInfo
+```
+
 ## Build Commands
 
 ```bash
@@ -89,3 +150,32 @@ cmake --build build -j$(nproc)
 ./build/client
 ./build/tests
 ```
+
+## When Adding Sanitizer Support to CMakeLists.txt
+
+Use CMake options for cleaner integration:
+```cmake
+option(ENABLE_ASAN "Enable AddressSanitizer" OFF)
+option(ENABLE_TSAN "Enable ThreadSanitizer" OFF)
+option(ENABLE_UBSAN "Enable UndefinedBehaviorSanitizer" OFF)
+
+if(ENABLE_ASAN)
+  add_compile_options(-fsanitize=address -fno-omit-frame-pointer)
+  add_link_options(-fsanitize=address)
+endif()
+
+if(ENABLE_TSAN)
+  add_compile_options(-fsanitize=thread)
+  add_link_options(-fsanitize=thread)
+endif()
+
+if(ENABLE_UBSAN)
+  add_compile_options(-fsanitize=undefined)
+  add_link_options(-fsanitize=undefined)
+endif()
+```
+
+Then build with:
+```bash
+cmake -B build -S . -DENABLE_ASAN=ON
+```

.opencode/agents/code-explainer.md

@@ -0,0 +1,133 @@
+---
+description: Explains FastSync code, architecture, and design decisions to developers new to the codebase.
+mode: subagent
+---
+
+You are a code explainer for the FastSync project — a high-performance file synchronization system written in C11.
+
+## Your Role
+
+Make the codebase understandable. Explain code sections, architecture decisions, data flow, and how components interact. Help developers new to the project get productive quickly.
+
+## Project Quick-Start
+
+### What FastSync Does
+FastSync is a file synchronization tool (like rsync, but faster). It transfers files from a source to a destination over TCP or SSH, with optional compression, multithreading, and metadata preservation.
+
+### Key Concepts
+1. **Chunks** — files are grouped into chunks (~10MB) for batch transfer
+2. **Pipeline** — three stages: scan → load → send, connected by thread-safe queues
+3. **Protocol** — status-code-driven exchange over TCP/SSH
+4. **Transport** — pluggable: TCP (with optional TLS), SSH (via subprocess)
+5. **Incremental sync** — skip files unchanged since last transfer (size + mtime)
+
+### Running the Project
+```bash
+# Build
+cmake -B build -S . && cmake --build build -j$(nproc)
+
+# Server (TCP mode)
+./build/server
+
+# Client (TCP mode)
+./build/client --source-dir /path/to/send --dest-dir /path/to/receive --save-to-disk
+
+# Client (SSH mode, rsync-style)
+./build/client /path/to/send user@host:/path/to/receive
+
+# Run tests
+./build/tests          # unit tests
+python3 test.py        # integration tests
+```
+
+## Code Walkthrough
+
+### Client Entry Point (`src/client/client_cli.c`)
+- Parses CLI arguments using `getopt_long`
+- Creates `Config` struct with all options
+- Detects SSH destinations (contains `:`)
+- Calls into `client_send.c` for the actual transfer
+
+### Transfer Pipeline (`src/client/client_send.c`)
+The client transfer is a three-stage pipeline:
+
+```
+Stage 1: Scanner (main thread)
+  - BFS traversal of source directory
+  - Builds chunks of files up to chunk_size
+  - Pushes chunks into queue_1
+
+Stage 2: Loader (worker threads)
+  - Pops chunks from queue_1
+  - Reads file contents into memory
+  - Pushes loaded chunks into queue_2
+
+Stage 3: Sender (main thread)
+  - Pops loaded chunks from queue_2
+  - Optionally compresses (zstd)
+  - Optionally serializes chunk
+  - Sends over TCP or SSH
+```
+
+### Scanner (`src/client/scanner.c`)
+- Recursive BFS directory traversal
+- Respects `--exclude` and `--include` glob patterns
+- Groups files into chunks based on `chunk_size`
+- Handles `--max-size` and `--min-size` filtering
+
+### Protocol (`src/shared/protocol.c`)
+Wire protocol for client-server communication:
+1. Client sends `Config` (serialized)
+2. For each file/chunk: status code + data
+3. If `--delete`: client sends manifest, server removes extras
+4. Client sends `STATUS_FINISHED`, server responds `STATUS_OK`
+
+Status codes: `OK`, `ERROR`, `FINISHED`, `NEXT`, `CHUNK`, `MANIFEST`, `CHECK`
+
+### Data Types
+
+#### `Data` (`src/shared/data.h`)
+Generic buffer: `{ void *data; size_t size; }`. Always create with `data_create()` and free with `data_destroy()`.
+
+#### `Queue` (`src/shared/queue.h`)
+Thread-safe bounded queue. Supports both single-threaded (`queue_enqueue`/`queue_dequeue`) and multi-threaded (`queue_enqueue_multithreaded`/`queue_dequeue_multithreaded`) access.
+
+#### `Config` (`src/shared/config.h`)
+All runtime parameters. Serialized and sent over wire at transfer start. Fields include transport type, compression settings, chunk size, TLS config, exclude/include patterns.
+
+#### `Chunk` (`src/shared/chunk.h`)
+Collection of files for batch transfer. Serialized with file count, then per-file: path, content, optional metadata.
+
+### Server (`src/server/server.c`)
+- TCP mode: listens on port (default 8080), forks per connection
+- SSH mode: `--stdio` flag, runs once then exits
+- Receives config, processes files, handles `--delete` manifests
+
+## Common Questions
+
+### "How does compression work?"
+zstd streaming compression via `ZSTD_compressStream2`/`ZSTD_decompressStream`. Compression happens per-chunk in the sender stage. Level 1-22 (default 5). Streaming means memory usage stays bounded regardless of file size.
+
+### "How does sendfile() work?"
+On Linux, `sendfile()` copies data directly from kernel file buffer to socket, bypassing userspace. ~2x faster for large files. Enabled with `-f` flag. Only works with TCP (not SSH, not compression).
+
+### "How does incremental sync work?"
+Client sends file metadata (path, size, mtime) to server. Server checks if destination file has same size+mtime. If match, server responds `STATUS_OK` (skip). If mismatch, server responds `STATUS_NEXT` (send).
+
+### "How does --delete work?"
+After all files are sent, client sends a manifest of all transferred paths. Server walks destination tree and removes any file/directory not in the manifest.
+
+### "How does SSH transport work?"
+Client creates a `socketpair()`, `fork()`s, child `execvp("ssh", ...)` with the server binary. Uses SSH ControlMaster for connection reuse. Data flows through the socketpair.
+
+### "How does TLS work?"
+OpenSSL TLS 1.2+ wraps the TCP connection. `SSL_read`/`SSL_write` transparently replace `read`/`write` via `io_set_ssl()`. Certificate verification optional with `--ca`.
+
+## Explanation Guidelines
+
+When explaining code:
+1. **Start with context** — what module, what it does in the bigger picture
+2. **Show the data flow** — what goes in, what comes out
+3. **Highlight non-obvious parts** — why this design, not that
+4. **Reference the source** — `file:line` for key functions
+5. **Connect to the protocol** — how this piece talks to other pieces

.opencode/agents/debugger.md

@@ -0,0 +1,157 @@
+---
+description: Debugs crashes, memory errors, and logic bugs in FastSync using valgrind, ASan, gdb, and structured root cause analysis.
+mode: subagent
+---
+
+You are a debugger for the FastSync project — a high-performance file synchronization system written in C11.
+
+## Your Role
+
+Diagnose crashes, memory errors, hangs, and logic bugs. You use structured debugging methodology: reproduce → isolate → diagnose → fix → verify.
+
+## Debugging Toolkit
+
+### Memory Errors
+```bash
+# AddressSanitizer (fast, recommended first)
+cmake -B build -S . -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake --build build -j$(nproc)
+./build/client  # or ./build/server
+
+# Valgrind (slower, more thorough)
+valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes \
+  ./build/client --source-dir /tmp/src --dest-dir /tmp/dst --save-to-disk
+
+# Valgrind with race detection
+valgrind --tool=helgrind ./build/client ...
+
+# Valgrind with DRD (alternative race detector)
+valgrind --tool=drd ./build/client ...
+```
+
+### Thread Sanitizer
+```bash
+cmake -B build -S . -DCMAKE_C_FLAGS="-fsanitize=thread" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread"
+cmake --build build -j$(nproc)
+./build/tests
+```
+
+### GDB
+```bash
+# Build with debug info
+cmake -B build -S . -DCMAKE_BUILD_TYPE=Debug
+cmake --build build -j$(nproc)
+
+# Run under gdb
+gdb --args ./build/client --source-dir /tmp/src --dest-dir /tmp/dst
+
+# Useful gdb commands
+(gdb) run
+(gdb) bt                    # full backtrace on crash
+(gdb) bt full               # backtrace with local variables
+(gdb) info threads          # list all threads
+(gdb) thread apply all bt   # backtrace of all threads
+(gdb) print variable_name   # inspect variable
+(gdb) watch *ptr            # watch for changes to pointer
+(gdb) info locals           # all local variables
+```
+
+### Strace / Ltrace
+```bash
+# Trace system calls
+strace -f -e trace=network,write,read ./build/client ...
+
+# Trace library calls
+ltrace ./build/client ...
+```
+
+### Performance Profiling
+```bash
+# perf record + report
+perf record -g ./build/client ...
+perf report
+
+# perf stat (hardware counters)
+perf stat ./build/client ...
+
+# gprof
+gcc -pg -o client ...
+./build/client
+gprof ./build/client gmon.out
+```
+
+## Common Bug Patterns in This Codebase
+
+### 1. Memory Leaks
+- `data_create()` without matching `data_destroy()`
+- `queue_create()` without `queue_destroy()`
+- `config_create()` without `config_delete()`
+- `malloc()` in error paths that return without `free()`
+- `receive_str()` return value not freed
+
+### 2. Use-After-Free
+- Accessing `queue` after `queue_destroy()`
+- Using `Data*` after `data_destroy()`
+- Dereferencing freed config fields
+
+### 3. Thread Safety
+- Queue operations without mutex when threads are active
+- Condition variable signals outside critical section
+- `done` flag not checked atomically in consumer loops
+- Shared `Config` fields modified during transfer
+
+### 4. Protocol Errors
+- `send_n_data` / `receive_n_data` return value not checked
+- Status code received but not validated
+- Partial reads (short reads on sockets)
+- Config deserialization mismatch between client/server
+
+### 5. Buffer Overflows
+- `strcpy` without bounds checking (use `snprintf`)
+- Off-by-one in string operations (`strlen + 1` for null terminator)
+- Fixed-size buffers for paths (`PATH_MAX` consideration)
+
+### 6. Signal Handling
+- `SIGPIPE` on broken TCP connections
+- `SIGCHLD` from forked server children
+- Interrupted system calls (`EINTR`)
+
+## Debugging Workflow
+
+### Step 1: Reproduce
+- Get exact command line that triggers the bug
+- Determine if it's deterministic or intermittent
+- Note the environment (OS, compiler, libraries)
+
+### Step 2: Isolate
+- Binary search the code: comment out half the pipeline
+- Add `fprintf(stderr, "DEBUG: reached %s:%d\n", __FILE__, __LINE__)` markers
+- Reduce test case to minimum reproducible example
+
+### Step 3: Diagnose
+- Run with ASan/valgrind for memory errors
+- Run with TSan for thread issues
+- Get backtrace under gdb
+- Check return values of all syscalls
+
+### Step 4: Fix
+- Apply minimal fix (don't refactor while debugging)
+- Verify fix doesn't break existing tests
+- Add regression test if possible
+
+### Step 5: Verify
+- Run `./build/tests` (unit tests)
+- Run `python3 test.py` (integration tests)
+- Run under valgrind again to confirm clean
+- Test under ASan again
+
+## Output Format
+
+For each bug found:
+1. **Symptom** — what the user sees (crash, hang, wrong output)
+2. **Root cause** — exact file:line and what's happening
+3. **Reproduction** — exact command to trigger
+4. **Fix** — the minimal code change needed
+5. **Verification** — how to confirm the fix works

.opencode/agents/integrator.md

@@ -0,0 +1,150 @@
+---
+description: Designs and verifies integration tests, end-to-end workflows, and CI/CD pipeline configurations for FastSync.
+mode: subagent
+---
+
+You are an integration specialist for the FastSync project — a high-performance file synchronization system written in C11.
+
+## Your Role
+
+Design integration tests that verify the full transfer pipeline works end-to-end. Bridge the gap between unit tests (component-level) and production use (full system).
+
+## Test Layers
+
+### 1. Unit Tests (existing — `tests/`)
+- Component-level: queue, data, compression, config, chunk, scanner, protocol
+- Custom framework in `tests/test_utils.h`
+- Run: `./build/tests`
+
+### 2. Integration Tests (existing — `test.py`)
+- Full transfer pipeline: client → server → verify
+- Multiple configurations (TCP, SSH, TLS, compression, multithreading)
+- Network shaping (LAN, WAN profiles)
+- Feature tests (dry run, archive, exclude, delete, incremental, bandwidth limit)
+- Run: `python3 test.py`
+
+### 3. New: Focused Integration Tests
+When adding new features or fixing bugs, write targeted integration tests.
+
+## Integration Test Patterns
+
+### Pattern 1: Transfer Round-Trip
+```bash
+# Setup
+mkdir -p /tmp/fastsync_test/src
+echo "test content" > /tmp/fastsync_test/src/file.txt
+
+# Start server
+./build/server &
+SERVER_PID=$!
+sleep 0.5
+
+# Run client
+./build/client --source-dir /tmp/fastsync_test/src \
+  --dest-dir /tmp/fastsync_test/dst \
+  --save-to-disk
+
+# Verify
+diff /tmp/fastsync_test/src/file.txt /tmp/fastsync_test/dst/tmp/fastsync_test/src/file.txt
+
+# Cleanup
+kill $SERVER_PID
+rm -rf /tmp/fastsync_test
+```
+
+### Pattern 2: SSH Transfer
+```bash
+# Prerequisites: fastsync-server in PATH on localhost
+./build/client /tmp/fastsync_test/src localhost:/tmp/fastsync_test/dst \
+  --save-to-disk
+```
+
+### Pattern 3: TLS Transfer
+```bash
+# Generate test certs (if not already available)
+openssl req -x509 -newkey rsa:2048 -keyout /tmp/key.pem -out /tmp/cert.pem \
+  -days 1 -nodes -subj '/CN=localhost'
+
+# Server with TLS
+./build/server --tls --cert /tmp/cert.pem --key /tmp/key.pem &
+
+# Client with TLS
+./build/client --tls --cert /tmp/cert.pem --key /tmp/key.pem \
+  --source-dir /tmp/src --dest-dir /tmp/dst --save-to-disk
+```
+
+### Pattern 4: Incremental Sync
+```bash
+# First sync
+./build/client --source-dir /tmp/src --dest-dir /tmp/dst --save-to-disk -M
+
+# Modify source
+echo "updated" >> /tmp/src/file.txt
+
+# Second sync — should only transfer changed files
+./build/client --source-dir /tmp/src --dest-dir /tmp/dst \
+  --save-to-disk --incremental
+```
+
+### Pattern 5: Delete Verification
+```bash
+# Initial sync
+./build/client --source-dir /tmp/src --dest-dir /tmp/dst --save-to-disk -M
+
+# Add extra file to dest
+echo "extra" > /tmp/dst/.../extra.txt
+
+# Sync with --delete
+./build/client --source-dir /tmp/src --dest-dir /tmp/dst \
+  --save-to-disk --delete -M
+
+# Verify extra.txt is gone
+test ! -f /tmp/dst/.../extra.txt
+```
+
+## CI/CD Integration
+
+### Gitea Workflow Structure (`.gitea/workflows/ci.yaml`)
+The project uses Gitea Actions. Key jobs:
+1. **Build** — compile on push/PR
+2. **Unit tests** — run `./build/tests`
+3. **Integration tests** — run `python3 test.py` (light mode)
+4. **Sanitizer builds** — ASan, TSan variants
+
+### Adding a New CI Job
+```yaml
+jobs:
+  sanitizer:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: sudo apt-get update && sudo apt-get install -y libzstd-dev libssl-dev
+      - name: Build with ASan
+        run: |
+          cmake -B build -S . \
+            -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+            -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+          cmake --build build -j$(nproc)
+      - name: Run tests
+        run: ./build/tests
+```
+
+## Verification Checklist
+
+After any code change:
+- [ ] Unit tests pass: `./build/tests`
+- [ ] Integration tests pass: `python3 test.py` (light mode at minimum)
+- [ ] Build clean: no warnings with `-Wall`
+- [ ] No memory errors: ASan clean
+- [ ] No thread errors: TSan clean (if threading involved)
+
+## Output Format
+
+When designing integration tests:
+1. **Test scenario** — what's being tested
+2. **Setup** — prerequisites and test data
+3. **Commands** — exact commands to run
+4. **Verification** — how to check success
+5. **Cleanup** — how to remove test artifacts
+6. **CI integration** — how to add to the workflow

.opencode/agents/perf-analyst.md

@@ -71,4 +71,53 @@ For each bottleneck found:
 5. **Suggested optimization** — concrete code change or approach
 6. **Expected impact** — estimated speedup or resource savings
 
-Also provide profiling guidance when asked (e.g., `perf`, `valgrind`, `gprof` commands).
+## Profiling Commands
+
+### perf (Linux, recommended)
+```bash
+# Record call graph
+perf record -g ./build/client [args...]
+perf report
+
+# Hardware counters (cache misses, branch mispredictions, etc.)
+perf stat ./build/client [args...]
+
+# Specific events
+perf stat -e cache-misses,cache-references,instructions,cycles ./build/client [args...]
+
+# Flame graph
+perf record -g -F 99 ./build/client [args...]
+perf script | stackcollapse-perf.pl | flamegraph.pl > flame.svg
+```
+
+### valgrind (memory profiling)
+```bash
+# Callgrind (CPU profiling)
+valgrind --tool=callgrind ./build/client [args...]
+callgrind_annotate callgrind.out.*
+
+# Cachegrind (cache simulation)
+valgrind --tool=cachegrind ./build/client [args...]
+cg_annotate cachegrind.out.*
+
+# Massif (heap profiling)
+valgrind --tool=massif ./build/client [args...]
+ms_print massif.out.*
+```
+
+### gprof
+```bash
+cmake -B build -S . -DCMAKE_C_FLAGS="-pg" -DCMAKE_EXE_LINKER_FLAGS="-pg"
+cmake --build build -j$(nproc)
+./build/client [args...]
+gprof ./build/client gmon.out > analysis.txt
+```
+
+### Time Measurement
+```bash
+# Quick timing
+time ./build/client [args...]
+
+# High precision
+perf stat -e task-clock ./build/client [args...]
+```

.opencode/agents/refactorer.md

@@ -0,0 +1,155 @@
+---
+description: Refactors FastSync code for structural improvements — DRY, separation of concerns, API simplification, and code quality.
+mode: subagent
+---
+
+You are a refactoring specialist for the FastSync project — a high-performance file synchronization system written in C11.
+
+## Your Role
+
+Improve code structure without changing behavior. You find duplication, tangled concerns, overly complex functions, and API inconsistencies, then propose and implement clean refactors.
+
+## Refactoring Principles
+
+1. **Preserve behavior** — refactors must not change observable behavior
+2. **Small steps** — each refactor should be one logical change
+3. **Test after** — run `./build/tests` after every refactor
+4. **Don't fix bugs while refactoring** — separate concerns
+5. **Follow existing conventions** — match the codebase's style
+
+## Codebase Conventions to Follow
+
+- Header guards: `#ifndef FILENAME_H` / `#define FILENAME_H` / `#endif`
+- Function naming: `snake_case`, prefixed by module (`queue_create`, `data_compress`)
+- `static` for file-local functions
+- Pointer style: `Type *name` (space before asterisk)
+- Memory: `malloc`/`calloc`/`realloc` + `free`, destroy functions for complex types
+- Threading: C11 `<threads.h>` (`thrd_t`, `mtx_t`, `cnd_t`)
+- Error handling: return `false`/`NULL` on failure
+
+## Refactoring Patterns
+
+### 1. Extract Function
+When a function does two things, split it:
+```c
+// BEFORE: scan_and_compress does two things
+Data *scan_and_compress(const char *path, int level) {
+    // scanning logic...
+    // compression logic...
+}
+
+// AFTER: two focused functions
+static Data *scan_file(const char *path) { ... }
+Data *compress_file(Data *data, int level) { ... }
+```
+
+### 2. Eliminate Duplication
+When similar code appears in multiple places:
+```c
+// BEFORE: repeated in client_send.c and server.c
+if (!send_n_data(fd, &status, sizeof(Status))) {
+    fprintf(stderr, "Failed to send status\n");
+    close(fd);
+    return false;
+}
+
+// AFTER: extract helper
+static bool send_status_or_close(int fd, Status status) {
+    if (!send_n_data(fd, &status, sizeof(Status))) {
+        fprintf(stderr, "Failed to send status\n");
+        close(fd);
+        return false;
+    }
+    return true;
+}
+```
+
+### 3. Simplify Conditionals
+Replace nested if-else with early returns:
+```c
+// BEFORE
+if (config != NULL) {
+    if (config->use_compression) {
+        if (config->compression_level > 0) {
+            // do work
+        }
+    }
+}
+
+// AFTER
+if (!config) return;
+if (!config->use_compression) return;
+if (config->compression_level <= 0) return;
+// do work
+```
+
+### 4. Improve Naming
+Make function/variable names self-documenting:
+```c
+// BEFORE
+void proc(Queue *q, int n);
+
+// AFTER
+void process_chunk_queue(Queue *chunk_queue, int max_workers);
+```
+
+### 5. Reduce Function Parameters
+When a function has too many parameters, group them into a struct:
+```c
+// BEFORE
+Client *client_connect_transfer(char *host, int port, bool use_tls,
+    char *cert, char *key, char *ca, bool use_compression,
+    int compression_level, bool use_multithreading, ...);
+
+// AFTER — use Config struct (already partially done in this codebase)
+Client *client_connect_transfer(Config *config);
+```
+
+### 6. Move Code to Correct Module
+When code lives in the wrong module:
+```c
+// BEFORE: protocol parsing in client_send.c
+// AFTER: move to protocol.c where it belongs
+```
+
+### 7. Consolidate Error Handling
+When error handling is duplicated:
+```c
+// BEFORE: same cleanup in 5 error paths
+if (err1) { free(a); free(b); free(c); return NULL; }
+if (err2) { free(a); free(b); free(c); return NULL; }
+if (err3) { free(a); free(b); free(c); return NULL; }
+
+// AFTER: goto-based cleanup
+if (err1 || err2 || err3) goto cleanup;
+// ...
+cleanup:
+    free(a); free(b); free(c);
+    return NULL;
+```
+
+## Refactoring Workflow
+
+1. **Identify** — find the code to refactor (duplication, complexity, wrong abstraction)
+2. **Verify baseline** — run `./build/tests` to confirm tests pass before changes
+3. **Plan** — describe the refactor, what changes, what stays the same
+4. **Implement** — make the change, one logical step at a time
+5. **Build** — `cmake -B build -S . && cmake --build build -j$(nproc)`
+6. **Test** — `./build/tests` must pass
+7. **Commit** — one commit per logical refactor
+
+## Metrics to Track
+
+Before and after each refactor, note:
+- Number of lines (should stay roughly the same or decrease)
+- Number of functions (may increase with extraction)
+- Cyclomatic complexity (should decrease)
+- Test coverage (should stay same or improve)
+
+## Anti-patterns to Avoid
+
+- **Premature abstraction** — don't abstract until you see 3+ occurrences
+- **Over-engineering** — simple C code is better than clever C code
+- **Breaking the API** — public headers are contracts; change them carefully
+- **Rewriting** — refactor incrementally, don't rewrite from scratch
+- **Ignoring tests** — if tests don't exist for the code you're refactoring, write them first

.opencode/agents/security-auditor.md

@@ -0,0 +1,141 @@
+---
+description: Audits FastSync for security vulnerabilities — TLS config, input validation, buffer overflows, crypto hygiene, and network attack surface.
+mode: subagent
+---
+
+You are a security auditor for the FastSync project — a high-performance file synchronization system written in C11 with TCP, SSH, and TLS transport.
+
+## Your Role
+
+Audit the codebase for security vulnerabilities. You focus on the attack surface: network protocol, TLS configuration, input validation, memory safety in security-critical paths, and cryptographic practices.
+
+## Attack Surface
+
+### Network Input Points
+1. **TCP server** (`src/server/server.c`) — accepts connections from any client
+2. **SSH transport** (`src/shared/transport_ssh.c`) — receives data via stdio pipe
+3. **Protocol parsing** (`src/shared/protocol.c`) — deserializes all incoming data
+4. **Config deserialization** (`src/shared/config.c`) — receives remote config
+5. **Chunk deserialization** (`src/shared/chunk.c`) — receives file batches
+
+### TLS Configuration
+- OpenSSL TLS 1.2+ via `src/shared/transport_tls.c`
+- Certificate/key loading, CA verification
+- SSL context setup, cipher suite selection
+
+## Security Audit Checklist
+
+### 1. Input Validation
+- [ ] All `receive_*` return values checked before use
+- [ ] Received size fields validated against reasonable bounds
+- [ ] Path traversal prevention (no `../` in received filenames)
+- [ ] Null bytes in filenames handled
+- [ ] Chunk count and file count validated before allocation
+- [ ] Config field lengths bounded
+
+### 2. Buffer Safety
+- [ ] No `strcpy` — use `snprintf` or `strncpy` with null termination
+- [ ] `malloc` size calculations don't overflow (e.g., `count * sizeof(...)`)
+- [ ] No fixed-size stack buffers for unbounded input
+- [ ] `receive_n_data` always checks return value
+- [ ] Off-by-one in path concatenation
+
+### 3. Memory Safety in Error Paths
+- [ ] All error paths free allocated resources
+- [ ] No use-after-free on error paths
+- [ ] No double-free on error paths
+- [ ] Partial reads handled (don't use incomplete data)
+
+### 4. TLS/SSL Security
+- [ ] TLS 1.2 minimum enforced (no SSLv3, TLS 1.0, TLS 1.1)
+- [ ] Certificate verification enabled when CA provided
+- [ ] Certificate verification disabled only with explicit warning
+- [ ] Private key file permissions checked
+- [ ] No hardcoded certificates or keys
+- [ ] Cipher suites restricted to strong algorithms
+- [ ] SSL error codes checked after `SSL_read`/`SSL_write`
+
+### 5. Authentication & Authorization
+- [ ] SSH transport relies on SSH authentication (not custom auth)
+- [ ] No password/credential storage in plaintext
+- [ ] Server doesn't trust client-supplied paths blindly
+- [ ] Destination directory validated before writing
+
+### 6. Denial of Service
+- [ ] Bounded memory allocation (can't OOM server with huge chunk)
+- [ ] Timeout on connections (no indefinite blocking)
+- [ ] Maximum connection limit or rate limiting
+- [ ] Malformed protocol messages handled gracefully (no crash)
+
+### 7. Cryptographic Practices
+- [ ] No custom crypto — uses OpenSSL only
+- [ ] No hardcoded keys, IVs, or salts
+- [ ] Random data from `/dev/urandom` or OpenSSL `RAND_bytes`
+
+### 8. File System Security
+- [ ] Received file permissions validated (no SUID/SGID injection)
+- [ ] Symlink attack prevention (don't follow symlinks in destination)
+- [ ] Race conditions in file creation (TOCTOU)
+- [ ] Temporary file security (if any)
+
+## Common Vulnerability Patterns
+
+### Format String Bugs
+```c
+// VULNERABLE
+printf(user_data);
+
+// SAFE
+printf("%s", user_data);
+```
+
+### Integer Overflow in Allocation
+```c
+// VULNERABLE — count * size can overflow
+void *buf = malloc(count * sizeof(Entry));
+
+// SAFE
+if (count > SIZE_MAX / sizeof(Entry)) return NULL;
+void *buf = malloc(count * sizeof(Entry));
+```
+
+### Path Traversal
+```c
+// VULNERABLE — client sends "../../../etc/passwd"
+char path[PATH_MAX];
+snprintf(path, PATH_MAX, "%s/%s", dest_dir, received_filename);
+
+// SAFE — reject paths containing ".."
+if (strstr(received_filename, "..")) { /* reject */ }
+```
+
+### Unchecked Return Values
+```c
+// VULNERABLE — short read leaves buffer partially filled
+receive_n_data(fd, buffer, expected_size);
+
+// SAFE
+if (!receive_n_data(fd, buffer, expected_size)) { /* handle error */ }
+```
+
+## Output Format
+
+For each vulnerability found:
+1. **Location** — file:line
+2. **Severity** — critical / high / medium / low / informational
+3. **Category** — input-validation / buffer / memory / tls / auth / dos / crypto / fs
+4. **Description** — what the vulnerability is
+5. **Exploit scenario** — how it could be triggered
+6. **Fix** — concrete code change
+7. **CVSS estimate** — rough severity score if exploitable
+
+Also provide a summary:
+```
+=== SECURITY AUDIT SUMMARY ===
+Files audited: <count>
+Critical: <count>
+High: <count>
+Medium: <count>
+Low: <count>
+Informational: <count>
+```

.opencode/agents/test-writer.md

@@ -115,6 +115,98 @@ RUN_TEST(test_<module>);
 cmake -B build -S . && cmake --build build -j$(nproc) && ./build/tests
 ```
 
+## Fuzzing Targets
+
+When writing fuzzing harnesses, use `AFL++` or `libFuzzer`:
+
+### libFuzzer Harness Example
+```c
+// tests/fuzz_chunk_deserialize.c
+#include "chunk.h"
+#include <stdint.h>
+#include <stdlib.h>
+
+int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+    // Create a Data wrapper and try to deserialize
+    Data *input = data_create((void *)data, size);
+    // Exercise the deserialization path
+    // (depends on what function you're fuzzing)
+    data_destroy(input);
+    return 0;
+}
+```
+
+Build for fuzzing:
+```bash
+cmake -B build-fuzz -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=fuzzer,address,undefined -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=fuzzer,address,undefined"
+cmake --build build-fuzz -j$(nproc)
+./build-fuzz/tests/fuzz_chunk_deserialize corpus/ -max_len=1048576
+```
+
+### AFL++ Harness
+```c
+// AFL++ uses stdin by default
+#include "protocol.h"
+#include <stdint.h>
+#include <unistd.h>
+
+int main() {
+    uint8_t buf[65536];
+    ssize_t n = read(STDIN_FILENO, buf, sizeof(buf));
+    if (n <= 0) return 0;
+    // Exercise parsing with the input
+    Data *input = data_create(buf, n);
+    data_destroy(input);
+    return 0;
+}
+```
+
+## Integration Test Patterns
+
+When writing integration tests (Python-based), follow the pattern in `test.py`:
+
+### Minimal Integration Test
+```python
+def test_basic_transfer():
+    # Setup
+    source = create_test_files()
+    dest = tempfile.mkdtemp()
+    
+    # Start server
+    server = subprocess.Popen(["./build/server"], ...)
+    time.sleep(0.5)
+    
+    # Run client
+    result = subprocess.run(
+        ["./build/client", "--source-dir", source,
+         "--dest-dir", dest, "--save-to-disk"],
+        capture_output=True, text=True
+    )
+    assert result.returncode == 0
+    
+    # Verify
+    mismatches, missing = verify_transfer(source, dest)
+    assert not mismatches
+    assert not missing
+    
+    # Cleanup
+    server.terminate()
+```
+
+### Edge Case Tests to Write
+- Empty directory sync
+- Single file sync
+- Very large file (> chunk size)
+- Many small files (1000+)
+- Path with spaces/special characters
+- Symlinks in source
+- Permission-restricted files
+- Network interruption mid-transfer
+- Server crash during transfer
+- Concurrent clients (if supported)
+
 ## Output
 
 When asked to write tests, produce:
@@ -122,3 +214,4 @@ When asked to write tests, produce:
 2. The test source file content
 3. The runner.c modification needed
 4. Verify with a build and test run
+5. Suggest fuzzing targets if relevant

.opencode/skills/benchmark/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: benchmark
+description: Runs performance benchmarks on FastSync, collects metrics, compares configurations, and reports throughput. Use when the user says "benchmark", "measure performance", "profile", or wants to compare transfer speeds.
+---
+
+# Benchmark Skill
+
+Runs performance benchmarks and collects metrics. This skill CAN edit files for benchmark scripts and run builds/tests.
+
+## Workflow
+
+### Step 1: Build Optimized
+
+```bash
+rm -rf build
+cmake -B build -S . -DCMAKE_BUILD_TYPE=Release
+cmake --build build -j$(nproc)
+```
+
+### Step 2: Generate Test Data
+
+```bash
+mkdir -p /tmp/fastsync_bench/src
+# Small files
+for i in $(seq 1 100); do
+  dd if=/dev/urandom of=/tmp/fastsync_bench/src/small_$i.bin bs=1K count=10 2>/dev/null
+done
+# Medium files
+for i in $(seq 1 20); do
+  dd if=/dev/urandom of=/tmp/fastsync_bench/src/med_$i.bin bs=1M count=1 2>/dev/null
+done
+# Large files
+dd if=/dev/urandom of=/tmp/fastsync_bench/src/large.bin bs=1M count=10 2>/dev/null
+```
+
+### Step 3: Run Benchmarks
+
+Test each configuration 3 times, record median:
+
+```bash
+CONFIGS=(
+  "Standard|"
+  "Compression|-c"
+  "Multithreading|-m"
+  "MT+Compression|-m -c"
+  "Chunk Serialization|-s"
+  "MT+Compression+Chunk|-m -c -s"
+  "Sendfile|-f"
+)
+
+for config in "${CONFIGS[@]}"; do
+  IFS='|' read -r name flags <<< "$config"
+  echo "=== $name ==="
+  for run in 1 2 3; do
+    rm -rf /tmp/fastsync_bench/dst
+    mkdir -p /tmp/fastsync_bench/dst
+    
+    ./build/server &
+    SERVER_PID=$!
+    sleep 0.5
+    
+    START=$(date +%s%N)
+    ./build/client --source-dir /tmp/fastsync_bench/src \
+      --dest-dir /tmp/fastsync_bench/dst \
+      --save-to-disk $flags
+    END=$(date +%s%N)
+    
+    ELAPSED=$(( (END - START) / 1000000 ))
+    echo "  Run $run: ${ELAPSED}ms"
+    
+    kill $SERVER_PID 2>/dev/null
+    wait $SERVER_PID 2>/dev/null
+  done
+done
+```
+
+### Step 4: Full Integration Benchmark (Optional)
+
+For comprehensive benchmarking with network shaping:
+```bash
+python3 test.py --full
+```
+
+This tests LAN/WAN profiles, SSH, TLS, and compares against rsync.
+
+### Step 5: Report Results
+
+```
+=== BENCHMARK RESULTS ===
+Test data: <size> MB (<file count> files)
+Platform: <OS, CPU, network>
+
+Configuration          | Run 1   | Run 2   | Run 3   | Median
+-----------------------|---------|---------|---------|--------
+Standard               | 0.12s   | 0.11s   | 0.12s   | 0.12s
+Compression (-c)       | 0.09s   | 0.08s   | 0.09s   | 0.09s
+Multithreading (-m)    | 0.07s   | 0.07s   | 0.08s   | 0.07s
+MT+Compression (-m -c) | 0.05s   | 0.05s   | 0.06s   | 0.05s
+Sendfile (-f)          | 0.04s   | 0.04s   | 0.04s   | 0.04s
+
+Best configuration: MT+Compression (-m -c)
+Throughput: <X> MB/s
+```
+
+### Step 6: Profiling (If Requested)
+
+For detailed profiling:
+```bash
+# perf
+perf record -g ./build/client [args...]
+perf report
+
+# gprof
+gcc -pg -o build/client_profile [sources]
+./build/client_profile [args]
+gprof build/client_profile gmon.out
+```
+
+## Rules
+- DO build with Release mode for benchmarks
+- DO run each config multiple times (at least 3)
+- DO clean destination between runs
+- DO report median, not just one run
+- DON'T run benchmarks during active development (noisy results)
+- ALWAYS clean up test data after benchmarking

.opencode/skills/debug-workflow/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: debug-workflow
+description: Debugs crashes, memory errors, hangs, and logic bugs in FastSync using structured methodology. Use when the user says "debug X", "fix crash", "investigate failure", "there's a bug", or needs help diagnosing issues.
+---
+
+# Debug Workflow Skill
+
+Structured debugging for FastSync: reproduce → isolate → diagnose → fix → verify. This skill CAN edit files, build, and run tests.
+
+## Workflow
+
+### Step 1: Understand the Problem
+
+Ask or gather:
+- What's the symptom? (crash, hang, wrong output, valgrind error)
+- What command triggers it?
+- Is it deterministic or intermittent?
+- What's the environment? (OS, compiler, network conditions)
+
+### Step 2: Reproduce
+
+Build with debug info:
+```bash
+rm -rf build
+cmake -B build -S . -DCMAKE_BUILD_TYPE=Debug
+cmake --build build -j$(nproc)
+```
+
+Try to reproduce the issue with the exact command the user provides.
+
+### Step 3: Isolate with Sanitizers
+
+**Memory errors (first priority):**
+```bash
+rm -rf build
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake --build build -j$(nproc)
+./build/tests
+# or run the failing command
+```
+
+**Thread errors:**
+```bash
+rm -rf build
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=thread -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread"
+cmake --build build -j$(nproc)
+./build/tests
+```
+
+**Valgrind (if ASan doesn't find it):**
+```bash
+valgrind --leak-check=full --show-leak-kinds=all --track-origins=yes \
+  ./build/client --source-dir /tmp/src --dest-dir /tmp/dst --save-to-disk
+```
+
+### Step 4: GDB Analysis
+
+If the issue is a crash or hang:
+```bash
+gdb --args ./build/client [args...]
+(gdb) run
+# when it crashes:
+(gdb) bt full
+(gdb) info locals
+(gdb) print variable_name
+```
+
+For hangs:
+```bash
+# In another terminal:
+kill -SIGABRT <pid>  # generates core dump
+gdb ./build/client core
+(gdb) thread apply all bt
+```
+
+### Step 5: Read the Code
+
+Read the relevant source files around the crash/failure point. Look for:
+- Unchecked return values
+- Null pointer dereferences
+- Buffer overflows
+- Use-after-free
+- Race conditions
+- Incorrect protocol handling
+
+### Step 6: Diagnose Root Cause
+
+Identify the exact file:line and what's wrong. Common patterns:
+- `send_n_data` / `receive_n_data` return value not checked
+- `data_destroy()` called but pointer still used
+- Queue operation without mutex in threaded code
+- Partial read/write not handled
+- Integer overflow in size calculations
+
+### Step 7: Fix
+
+Apply the minimal fix. Don't refactor while debugging — one change at a time.
+
+### Step 8: Verify
+
+```bash
+# Rebuild and test
+cmake -B build -S . && cmake --build build -j$(nproc)
+./build/tests
+
+# If integration test needed
+python3 test.py
+
+# Re-run under sanitizer to confirm fix
+rm -rf build
+cmake -B build -S . -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake --build build -j$(nproc)
+# reproduce the original failing command
+```
+
+### Step 9: Report
+
+Print a summary:
+```
+=== DEBUG SUMMARY ===
+Symptom: <what was happening>
+Root cause: <file:line — what's wrong>
+Fix: <what was changed>
+Verification: <how it was confirmed fixed>
+```
+
+## Rules
+- DO edit source files to fix issues
+- DO rebuild and test after fixes
+- DON'T refactor while debugging — minimal changes only
+- DON'T change behavior beyond fixing the bug
+- PRESERVE existing code style
+- ALWAYS verify with `./build/tests` after changes

.opencode/skills/pr-build/SKILL.md

@@ -32,6 +32,28 @@ cmake --build build -j$(nproc) 2>&1
 
 Capture both stdout and stderr.
 
+### Step 2b: Sanitizer build (if issues suspected)
+
+If the PR touches threading, memory management, or network code, also build with sanitizers:
+
+```bash
+# AddressSanitizer
+rm -rf build-asan
+cmake -B build-asan -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake --build build-asan -j$(nproc)
+./build-asan/tests
+
+# ThreadSanitizer (if threading changes)
+rm -rf build-tsan
+cmake -B build-tsan -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=thread -g" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=thread"
+cmake --build build-tsan -j$(nproc)
+./build-tsan/tests
+```
+
 ### Step 3: Handle build failures
 
 If the build fails, read the error output carefully. Common issues:
@@ -92,6 +114,8 @@ Print a summary:
 Branch: <branch-name>
 Build: [PASS/FAIL]
 Unit tests: [PASS/FAIL] (<passed>/<total>)
+ASan: [CLEAN/ERRORS]
+TSan: [CLEAN/ERRORS/SKIPPED]
 Integration tests: [PASS/FAIL/SKIPPED]
 
 Fixes applied: <count>

.opencode/skills/pr-review/SKILL.md

@@ -69,12 +69,29 @@ For each changed file, review for:
 - Functions return appropriate error values
 - Error messages are useful
 
+**Security**
+- No `strcpy`/`strcat`/`sprintf` — use `snprintf` with bounds
+- `malloc` size calculations don't overflow
+- Path traversal prevention (`..` in filenames)
+- No fixed-size stack buffers for unbounded input
+- TLS error codes checked after `SSL_read`/`SSL_write`
+- No hardcoded certificates, keys, or credentials
+- Received file permissions validated (no SUID/SGID injection)
+- Denial of service: bounded memory, malformed messages handled
+
+**Performance Impact**
+- Unnecessary memory copies in hot paths
+- Excessive malloc/free in tight loops
+- Missing `sendfile()` opportunity for large files
+- Compression level appropriate for use case
+- Queue sizing appropriate for workload
+
 ### Step 5: Categorize findings
 
 For each issue:
 1. **File:line** — exact location
 2. **Severity** — critical / warning / style
-3. **Category** — memory / thread / protocol / logic / error
+3. **Category** — memory / thread / protocol / security / performance / logic / error
 4. **Description** — what's wrong and how to fix it
 
 ### Step 6: Output report

.opencode/skills/refactor/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: refactor
+description: Refactors FastSync code for structural improvements — DRY, separation of concerns, API simplification. Use when the user says "refactor X", "clean up code", "improve structure", or wants to reduce duplication.
+---
+
+# Refactor Skill
+
+Read-only analysis + code edits for structural improvements. This skill CAN edit files but MUST verify tests pass.
+
+## Workflow
+
+### Step 1: Identify Refactoring Target
+
+Ask or determine:
+- What code needs refactoring?
+- What's the problem? (duplication, complexity, wrong abstraction, naming)
+- What's the scope? (single function, module, cross-module)
+
+### Step 2: Read and Understand
+
+Read the relevant source files completely. Understand:
+- What the code does
+- How it fits in the larger system
+- What depends on it
+- What it depends on
+
+### Step 3: Verify Baseline
+
+Before any changes, confirm tests pass:
+```bash
+cmake -B build -S . && cmake --build build -j$(nproc)
+./build/tests
+```
+
+### Step 4: Plan the Refactor
+
+Document the plan:
+1. What changes will be made
+2. What behavior is preserved
+3. What risks exist
+4. How to verify correctness
+
+### Step 5: Implement
+
+Make the changes, one logical step at a time. Follow existing code conventions:
+- Header guards: `#ifndef FILENAME_H`
+- Naming: `snake_case` with module prefix
+- `static` for file-local functions
+- Pointer style: `Type *name`
+- Error handling: return `false`/`NULL` on failure
+
+### Step 6: Build and Test
+
+```bash
+cmake -B build -S . && cmake --build build -j$(nproc)
+./build/tests
+```
+
+ALL tests must pass. If a test fails, investigate and fix.
+
+### Step 7: Report
+
+Print a summary:
+```
+=== REFACTOR SUMMARY ===
+Target: <what was refactored>
+Changes:
+  - <list of changes>
+Tests: <passed/total>
+Behavior preserved: yes
+```
+
+## Rules
+- DO edit source files
+- DO run tests after changes
+- DO follow existing code conventions
+- DON'T change observable behavior
+- DON'T fix bugs while refactoring (separate concern)
+- DON'T add new features during refactoring
+- DON'T rewrite from scratch — incremental changes
+- ALWAYS verify tests pass before AND after

.opencode/skills/release/SKILL.md

@@ -0,0 +1,110 @@
+---
+name: release
+description: Prepares a FastSync release — version bump, changelog, build verification, and git tagging. Use when the user says "prepare release", "bump version", "tag release", or wants to cut a new version.
+---
+
+# Release Skill
+
+Prepares a new release of FastSync. This skill CAN edit files, commit, and tag.
+
+## Workflow
+
+### Step 1: Determine Version
+
+Ask the user or determine from context:
+- **Major** (X.0.0) — breaking protocol changes, incompatible CLI changes
+- **Minor** (x.Y.0) — new features, backward compatible
+- **Patch** (x.y.Z) — bug fixes, no protocol changes
+
+Current version: `PROTOCOL_VERSION "1.1.0"` in `src/shared/config.h`
+
+### Step 2: Check Protocol Version
+
+If the wire protocol changed, bump `PROTOCOL_VERSION` in `src/shared/config.h`:
+```c
+#define PROTOCOL_VERSION "1.2.0"  // or "2.0.0" for breaking
+```
+
+Protocol version changes require:
+- Both client and server to be updated together
+- Backward compatibility considerations documented
+- Migration path clear
+
+### Step 3: Verify Build and Tests
+
+```bash
+rm -rf build
+cmake -B build -S .
+cmake --build build -j$(nproc)
+./build/tests
+python3 test.py
+```
+
+ALL tests must pass before release.
+
+### Step 4: Run Sanitizer Checks
+
+```bash
+# ASan
+rm -rf build
+cmake -B build -S . \
+  -DCMAKE_C_FLAGS="-fsanitize=address -fno-omit-frame-pointer" \
+  -DCMAKE_EXE_LINKER_FLAGS="-fsanitize=address"
+cmake --build build -j$(nproc)
+./build/tests
+```
+
+### Step 5: Update README (If Needed)
+
+Check if README needs updates:
+- New features documented
+- New CLI flags documented
+- Benchmark results updated
+- Build instructions current
+
+### Step 6: Create Release Commit
+
+```bash
+git add -A
+git commit -m "Release vX.Y.Z
+
+- <list of changes>
+- Protocol version: X.Y.Z
+- Tested: unit tests, integration tests, ASan"
+```
+
+### Step 7: Tag the Release
+
+```bash
+git tag -a vX.Y.Z -m "Release vX.Y.Z"
+```
+
+### Step 8: Push
+
+```bash
+git push origin main --tags
+```
+
+### Step 9: Report
+
+```
+=== RELEASE SUMMARY ===
+Version: vX.Y.Z
+Protocol: X.Y.Z
+Commit: <hash>
+Tag: vX.Y.Z
+Changes:
+  - <list of changes in this release>
+Build: PASS
+Tests: PASS (<passed>/<total>)
+ASan: CLEAN
+```
+
+## Rules
+- DO verify all tests pass before release
+- DO run sanitizer checks before release
+- DO update README if features changed
+- DO tag releases with annotated tags
+- DON'T release if tests fail
+- DON'T skip sanitizer checks
+- DON'T change code during release (only version bump + docs)

.opencode/skills/security-audit/SKILL.md

@@ -0,0 +1,115 @@
+---
+name: security-audit
+description: Performs a security audit of FastSync — checks TLS config, input validation, buffer safety, crypto hygiene, and network attack surface. Use when the user says "security audit", "check security", "harden", or wants a security review.
+---
+
+# Security Audit Skill
+
+Read-only security review of the FastSync codebase or specific modules. Produces a report — does NOT edit files.
+
+## Workflow
+
+### Step 1: Scope the Audit
+
+Determine what to audit:
+- Full codebase audit
+- Specific module (e.g., `transport_tls.c`, `protocol.c`)
+- Specific vulnerability class (e.g., buffer overflows, TLS misconfig)
+
+### Step 2: Identify Attack Surface
+
+Network input points:
+```
+src/server/server.c          — TCP accept, per-connection handling
+src/shared/protocol.c        — all wire protocol parsing
+src/shared/config.c          — config deserialization
+src/shared/chunk.c           — chunk deserialization
+src/shared/transport_tls.c   — TLS handshake and data
+src/shared/transport_ssh.c   — SSH data via stdio
+```
+
+### Step 3: Read All Relevant Files
+
+Read every file in scope completely. Focus on:
+- All `receive_*` calls and their validation
+- All `malloc`/`calloc` calls and their size calculations
+- All string operations (`strcpy`, `sprintf`, `snprintf`)
+- All path operations (filename handling, directory creation)
+- All TLS/SSL operations and error handling
+
+### Step 4: Apply Security Checklist
+
+#### Input Validation
+- [ ] All `receive_*` return values checked
+- [ ] Received size fields validated against bounds
+- [ ] Path traversal prevention (`..` in filenames)
+- [ ] Null bytes in filenames handled
+- [ ] Chunk/file counts validated before allocation
+
+#### Buffer Safety
+- [ ] No `strcpy` — use `snprintf`
+- [ ] `malloc` size calculations don't overflow
+- [ ] No fixed-size stack buffers for unbounded input
+- [ ] Off-by-one in path concatenation
+
+#### TLS/SSL
+- [ ] TLS 1.2 minimum enforced
+- [ ] Certificate verification when CA provided
+- [ ] SSL error codes checked after `SSL_read`/`SSL_write`
+- [ ] No hardcoded certificates/keys
+- [ ] Strong cipher suites only
+
+#### Memory Safety in Error Paths
+- [ ] All error paths free allocated resources
+- [ ] No use-after-free on error paths
+- [ ] Partial reads handled
+
+#### Denial of Service
+- [ ] Bounded memory allocation
+- [ ] Timeout on connections
+- [ ] Malformed messages handled gracefully
+
+### Step 5: Check for Common Vulnerabilities
+
+```bash
+# Grep for dangerous patterns
+grep -rn "strcpy\|strcat\|sprintf" src/
+grep -rn "malloc.*\*" src/  # potential integer overflow in size calc
+grep -rn "receive_n_data" src/  # check all return values
+grep -rn "NULL" src/ | grep -v "//"  # check null handling
+```
+
+### Step 6: Output Report
+
+```
+=== SECURITY AUDIT SUMMARY ===
+Scope: <what was audited>
+Files reviewed: <count>
+
+Critical: <count>
+High: <count>
+Medium: <count>
+Low: <count>
+Informational: <count>
+
+=== FINDINGS ===
+
+[1] <file:line> — CRITICAL (<category>)
+    Description: <what's wrong>
+    Exploit scenario: <how it could be triggered>
+    Fix: <concrete code change>
+
+...
+
+=== VERDICT ===
+[PASS] No critical/high issues found
+  — or —
+[FAIL] <N> critical/high issues must be fixed
+```
+
+## Rules
+- Do NOT edit any source files
+- Do NOT run builds or tests
+- Report ALL issues — don't filter or minimize
+- Be specific about line numbers and fix suggestions
+- Consider both remote and local attack vectors

CMakeLists.txt

@@ -1,4 +1,4 @@
-cmake_minimum_required(VERSION 4.1)
+cmake_minimum_required(VERSION 3.22)
 
 project(FastFileTransfer)
 
@@ -7,9 +7,35 @@ set(CMAKE_C_STANDARD 11)
 set(CMAKE_C_STANDARD_REQUIRED ON)
 
 add_compile_options(-Wall -g -O3)
-# add_compile_options(-Wall -g -O1 -fsanitize=address)
 
-# add_link_options(-fsanitize=address)
+# --- Sanitizer option ---
+set(SANITIZER "none" CACHE STRING "Sanitizer to enable (address, thread, none)")
+set_property(CACHE SANITIZER PROPERTY STRINGS address thread none)
+
+if(SANITIZER STREQUAL "address")
+	add_compile_options(-fsanitize=address -fno-omit-frame-pointer -g)
+	add_link_options(-fsanitize=address)
+elseif(SANITIZER STREQUAL "thread")
+	add_compile_options(-fsanitize=thread -fno-omit-frame-pointer -g)
+	add_link_options(-fsanitize=thread)
+elseif(NOT SANITIZER STREQUAL "none")
+	message(FATAL_ERROR "Unknown sanitizer: ${SANITIZER}. Supported values: address, thread, none")
+endif()
+
+# --- Strict warnings option ---
+option(STRICT_WARNINGS "Enable strict warnings (Wextra, Wpedantic, Werror)" OFF)
+if(STRICT_WARNINGS)
+	add_compile_options(-Wextra -Wpedantic -Werror)
+endif()
+
+include(FetchContent)
+FetchContent_Declare(
+  xxhash
+  GIT_REPOSITORY https://github.com/Cyan4973/xxHash
+  GIT_TAG v0.8.3
+  SOURCE_SUBDIR cmake_unofficial
+)
+FetchContent_MakeAvailable(xxhash)
 
 set(THREADS_PREFER_PTHREAD_FLAG ON)
 find_package(Threads REQUIRED)
@@ -19,6 +45,8 @@ if(NOT ZSTD_LIBRARY)
 	message(FATAL_ERROR "zstd library not found. Ensure it is in your nix-shell!")
 endif()
 
+find_package(OpenSSL REQUIRED)
+
 file(GLOB SHARED_SRCS "src/shared/*.c")
 file(GLOB SERVER_SRCS "src/server/*.c")
 file(GLOB CLIENT_SRCS "src/client/*.c")
@@ -26,13 +54,13 @@ file(GLOB TEST_SRCS "tests/*.c")
 
 add_executable(server ${SERVER_SRCS} ${SHARED_SRCS})
 target_include_directories(server PRIVATE src/shared src/server src/client)
-target_link_libraries(server PRIVATE Threads::Threads ${ZSTD_LIBRARY})
+target_link_libraries(server PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto xxhash)
 
 add_executable(client ${CLIENT_SRCS} ${SHARED_SRCS})
 target_include_directories(client PRIVATE src/shared src/server src/client)
-target_link_libraries(client PRIVATE Threads::Threads ${ZSTD_LIBRARY})
+target_link_libraries(client PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto xxhash)
 
 add_executable(tests ${TEST_SRCS} ${SHARED_SRCS} src/client/scanner.c)
 target_include_directories(tests PRIVATE tests src/shared src/server src/client)
-target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY})
+target_link_libraries(tests PRIVATE Threads::Threads ${ZSTD_LIBRARY} OpenSSL::SSL OpenSSL::Crypto xxhash)
 

Dockerfile

@@ -0,0 +1,8 @@
+FROM ubuntu:24.04
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc g++ make libc6-dev cmake libzstd-dev libssl-dev git ca-certificates curl cppcheck clang-format \
+    python3 python3-pip python3-venv openssl openssh-client && \
+    pip3 install --break-system-packages pytest && \
+    curl -fsSL https://deb.nodesource.com/setup_20.x | bash - && \
+    apt-get install -y --no-install-recommends nodejs && \
+    rm -rf /var/lib/apt/lists/*

README.md

@@ -1,35 +1,43 @@
 # FastSync
 
-A high-performance file synchronization system with SSH and TCP transport, streaming zstd compression, multithreaded transfer, metadata preservation, and rsync-compatible CLI flags.
+A high-performance file synchronization system with SSH and TCP transport, TLS encryption, streaming zstd compression, multithreaded transfer, incremental sync, metadata preservation, and rsync-compatible CLI flags.
 
 ## Technical Overview
 
 1. **Dual transport**: custom TCP client-server or SSH subprocess (rsync-style `user@host:/path`)
-2. **Chunked file transfer**: files grouped into configurable-size chunks (default ~10 MB)
+2. **TLS encryption**: OpenSSL-based TLS 1.2+ for encrypted TCP connections
-3. **Streaming zstd compression** (levels 1–22) using `ZSTD_compressStream2`
+3. **Chunked file transfer**: files grouped into configurable-size chunks (default ~10 MB)
-4. **Multithreading**: producer-consumer pipeline with thread-safe queues (scanner → loader → sender)
+4. **Streaming zstd compression** (levels 1–22) using `ZSTD_compressStream2`
-5. **Metadata preservation**: `mode`, `uid`, `gid`, `mtime` restored on disk when enabled
+5. **Multithreading**: producer-consumer pipeline with thread-safe queues (scanner → loader → sender)
-6. **`sendfile()` zero-copy** on TCP (~2× faster on loopback)
+6. **Incremental sync**: skip files unchanged since last transfer (compares size + mtime)
-7. **SSH ControlMaster** for connection reuse across repeated invocations
+7. **Metadata preservation**: `mode`, `uid`, `gid`, `mtime` restored on disk when enabled
-8. **`--delete`**: receiver removes files not present in sender manifest
+8. **`sendfile()` zero-copy** on TCP (~2× faster on loopback)
-9. **`--exclude`**: glob-pattern filename filtering (`*`, `?`, no `/` crossing)
+9. **SSH ControlMaster** for connection reuse across repeated invocations
+10. **Bandwidth limiting**: token-bucket throttling (`--bwlimit`)
+11. **`--delete`**: receiver removes files not present in sender manifest
+12. **`--exclude` / `--include`**: glob-pattern filename filtering
 
 ## System Architecture
 
 ### Client
-- Recursively scans source directories (BFS), supports exclude patterns
+- Recursively scans source directories (BFS), supports exclude and include patterns
 - Groups files into chunks (configurable size)
 - Streaming zstd compression with configurable level
 - Chunk serialization (compact binary format) or per-file transfer
+- Incremental transfer: sends file metadata to server, skips unchanged files
 - Manifests all sent paths when `--delete` is active
 - Sends via TCP `sendfile()` or SSH pipe
 - Optional progress display with throughput
+- Bandwidth limiting via token-bucket algorithm
 
 ### Server
-- TCP mode: listens on port 8080; SSH mode: runs via `--stdio`
+- TCP mode: listens on configurable port (default 8080); SSH mode: runs via `--stdio`
+- TLS mode: wraps TCP connections with OpenSSL
 - Receives and reassembles files
 - Decompresses (streaming zstd), deserializes, restores metadata
+- Handles incremental checks: compares size + mtime against destination files
 - Processes `STATUS_MANIFEST` for `--delete`: walks destination tree, removes extras
+- Per-connection concurrency via `fork()`
 - Thread pool for parallel processing
 
 ## Protocol Details
@@ -43,6 +51,7 @@ A high-performance file synchronization system with SSH and TCP transport, strea
 | `STATUS_NEXT` | Ready for next file (per-file mode) |
 | `STATUS_CHUNK` | Following data is a serialized chunk |
 | `STATUS_MANIFEST` | Following data is a file manifest (for `--delete`) |
+| `STATUS_CHECK` | Incremental check: client sends file path + size + mtime, server responds with OK (skip) or NEXT (send) |
 
 ### Wire Format — Metadata
 
@@ -50,11 +59,17 @@ When `use_metadata` is enabled (`-M`), each file entry carries a 4-byte `present
 
 ### Transfer Flow
 ```
-Config → (STATUS_NEXT | STATUS_CHUNK)* → [STATUS_MANIFEST] → STATUS_FINISHED → STATUS_OK
+Config → (STATUS_NEXT | STATUS_CHUNK | STATUS_CHECK)* → [STATUS_MANIFEST] → STATUS_FINISHED → STATUS_OK
 ```
 
+### Protocol Version
+
+`1.1.0` — server and client must match. Mismatch results in `STATUS_ERROR`.
+
 ## Command-Line Arguments
 
+### Client
+
 | Argument | Description |
 |----------|-------------|
 | Positional | `<source> <dest>` — automatic SSH detection if dest contains `:` |
@@ -63,20 +78,42 @@ Config → (STATUS_NEXT | STATUS_CHUNK)* → [STATUS_MANIFEST] → STATUS_FINISH
 | `-a, --archive` | Archive mode: enables `-c -m -M` (no `-s`) |
 | `-m` | Multithreading mode |
 | `-s` | Chunk serialization (batch all files per chunk) |
-| `-f` | Sendfile zero-copy. Incompatible with `-c` / `-s`. TCP only. |
+| `-f, --sendfile` | Sendfile zero-copy. Incompatible with `-c` / `-s`. TCP only. |
 | `-M, --preserve` | Preserve file metadata (mode, uid, gid, mtime) |
 | `-n, --dry-run` | Scan and print what would be transferred |
 | `-p <port>` | SSH port (default: 22) |
+| `-v, --verbose` | Enable debug logging |
 | `--progress` | Show real-time transfer speed |
 | `--delete` | Delete files on receiver not present in source |
 | `--exclude <pattern>` | Exclude files matching glob pattern (repeatable) |
+| `--include <pattern>` | Only transfer files matching glob pattern (repeatable, whitelist) |
+| `--max-size <n>` | Skip files larger than n bytes |
+| `--min-size <n>` | Skip files smaller than n bytes |
+| `--incremental` | Skip files unchanged since last transfer (size + mtime). Auto-enables `--preserve`. Incompatible with `-s`. |
+| `--bwlimit <KB/s>` | Bandwidth limit in kilobytes per second |
 | `--chunk-size <n>` | Chunk size in bytes (default: 10485760) |
 | `--source-dir <path>` | Source directory (overrides `FASTSYNC_SOURCE_DIR`) |
 | `--dest-dir <path>` | Server destination directory (overrides `FASTSYNC_DEST_DIR`) |
 | `--save-to-disk` | Write received files to disk |
 | `--server-host <ip>` | Server IP address (default: `127.0.0.1`) |
 | `--server-port <n>` | Server port (default: `8080`) |
+| `--tls` | Enable TLS encryption |
+| `--cert <path>` | TLS certificate file (PEM) |
+| `--key <path>` | TLS private key file (PEM) |
+| `--ca <path>` | TLS CA certificate file for verification (PEM) |
+
+### Server
+
+| Argument | Description |
+|----------|-------------|
+| `--stdio` | Run in stdio mode (for SSH transport; single connection then exits) |
+| `-p <port>` | TCP listen port (default: 8080, range: 1–65535) |
+| `--tls` | Enable TLS encryption |
+| `--cert <path>` | TLS certificate file (PEM) |
+| `--key <path>` | TLS private key file (PEM) |
+| `--ca <path>` | TLS CA certificate file for verification (PEM) |
 | `-v, --verbose` | Enable debug logging |
+| `--help` | Show help |
 
 ## Environment Variables
 
@@ -92,26 +129,42 @@ Config → (STATUS_NEXT | STATUS_CHUNK)* → [STATUS_MANIFEST] → STATUS_FINISH
 1. **Chunk** — collection of files (~10 MB total by default)
 2. **File** — path, content (`Data`), optional `FileMetadata` pointer
 3. **FileMetadata** — `mode`, `uid`, `gid`, `mtime_sec`, `mtime_nsec`
-4. **Config** — runtime parameters (transported over wire)
+4. **Config** — runtime parameters (transported over wire, TLS settings excluded)
 5. **Queue** — thread-safe bounded queue with condition variables
-6. **DirectoryScanner** — recursive BFS traversal with exclude pattern support
+6. **DirectoryScanner** — recursive BFS traversal with exclude and include pattern support
 
 ### Key Algorithms
-1. **File scanning** — BFS directory traversal; each entry matched against exclude patterns
+1. **File scanning** — BFS directory traversal; entries matched against exclude and include patterns
 2. **Chunking** — files accumulated until `chunk_size` threshold, then flushed
 3. **Compression** — streaming zstd via `ZSTD_compressStream2` / `ZSTD_decompressStream`
 4. **Network protocol** — status-code-driven exchange with metadata packing
-5. **Metadata restoration** — `chmod()`, `chown()`, `utimensat()` on the receiving side
+5. **Incremental check** — client sends `STATUS_CHECK` + path + size + mtime; server compares against destination
-6. **`--delete`** — sender tracks all sent paths; receiver walks destination tree and removes unlisted files/directories
+6. **Bandwidth limiting** — token-bucket algorithm with `nanosleep` throttling on 64 KB write chunks
-7. **SSH transport** — `socketpair()` + `fork()` + `execvp("ssh", ...)` with `ControlMaster` and port support
+7. **Metadata restoration** — `chmod()`, `chown()`, `utimensat()` on the receiving side
+8. **`--delete`** — sender tracks all sent paths; receiver walks destination tree and removes unlisted files/directories
+9. **SSH transport** — `socketpair()` + `fork()` + `execvp("ssh", ...)` with `ControlMaster` and port support
+10. **TLS transport** — OpenSSL `SSL_CTX` with TLS 1.2 minimum, optional CA verification, transparent `SSL_read`/`SSL_write` via `io_set_ssl()`
 
 ## Build Requirements
 
 - C11 compiler
-- CMake 4.1+
+- CMake >= 3.22
-- zstd library (≥ 1.4.0 for streaming API)
+- zstd library
+- OpenSSL (development headers and libraries)
 - pthreads
-- SSH client (for SSH transport)
+- SSH client (for SSH transport mode only)
+
+### Installing Dependencies
+
+**Ubuntu/Debian:**
+```bash
+sudo apt install cmake build-essential libzstd-dev libssl-dev openssh-client
+```
+
+**Nix:**
+```bash
+nix-shell  # provides zstd, openssl, cmake, gcc
+```
 
 ## Building
 
@@ -126,6 +179,14 @@ cmake -B build -S . && cmake --build build -j$(nproc)
 ./build/server
 ```
 
+### Server with TLS
+```bash
+./build/server --tls --cert server.pem --key server-key.pem
+```
+
+### Server via SSH
+Place the `fastsync-server` binary in the remote `$PATH`. The client runs `ssh user@host fastsync-server --stdio` automatically when an SSH-style destination is given.
+
 ### Client — SSH (rsync-style)
 ```bash
 ./build/client /path/to/send user@host:/path/to/receive
@@ -136,6 +197,12 @@ cmake -B build -S . && cmake --build build -j$(nproc)
 ./build/client --source-dir /path/to/send --dest-dir /path/to/receive --save-to-disk
 ```
 
+### Client — TCP with TLS
+```bash
+./build/client --tls --cert client.pem --key client-key.pem --ca ca.pem \
+  --source-dir /path/to/send --dest-dir /path/to/receive --save-to-disk
+```
+
 ### Common Options
 ```bash
 # Archive mode (compression + multithreading + metadata)
@@ -150,13 +217,16 @@ cmake -B build -S . && cmake --build build -j$(nproc)
 # Exclude temporary files + delete extras on receiver
 ./build/client --exclude "*.tmp" --exclude "*.o" --delete /src user@host:/dst
 
+# Incremental sync (skip unchanged files)
+./build/client --incremental /src user@host:/dst
+
+# Bandwidth limit to 1 MB/s
+./build/client --bwlimit 1024 /src user@host:/dst
+
 # All features
 ./build/client -a --progress --chunk-size 5242880 --exclude "*.log" --delete /src /dst
 ```
 
-### Server via SSH
-Place the `fastsync-server` binary in the remote `$PATH`. The client runs `ssh user@host fastsync-server --stdio` automatically when an SSH-style destination is given.
-
 ## Testing
 
 ```bash
@@ -178,6 +248,8 @@ The benchmark prints throughput metrics, best configuration, and speedup vs rsyn
 5. Metadata transfer adds negligible overhead (~24 bytes per file when enabled)
 6. SSH socketpair buffer set to 1 MB for improved pipe throughput
 7. SSH ControlMaster reuses connections across repeated invocations
+8. Incremental sync eliminates redundant transfers entirely
+9. Bandwidth limiting uses token-bucket with nanosleep for accurate throttling
 
 ## Benchmark Results
 

benchmark/bench.py

@@ -0,0 +1,519 @@
+#!/usr/bin/env python3
+"""Standalone benchmark tool for FastSync.
+
+Compares FastSync configs against rsync (no compression) and rsync+zstd.
+Data is ~75% random/incompressible and ~25% structured/compressible by default,
+controllable via --random-ratio.
+
+Usage:
+    python3 benchmark/bench.py
+    python3 benchmark/bench.py --runs 5 --profiles lan wan
+    python3 benchmark/bench.py --random-ratio 0.5 --size-mb 50
+    python3 benchmark/bench.py --delay 50ms --jitter 10ms --throughput 100mbit
+    python3 benchmark/bench.py --output json
+"""
+import argparse
+import json
+import os
+import random
+import shutil
+import socket
+import statistics
+import subprocess
+import sys
+import tempfile
+import time
+
+PROJECT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+BUILD_DIR = os.path.join(PROJECT_ROOT, "build")
+SERVER_CMD = [os.path.join(BUILD_DIR, "server")]
+CLIENT_CMD = [os.path.join(BUILD_DIR, "client")]
+BENCH_DIR = os.path.join(PROJECT_ROOT, "bench_data")
+
+NETWORK_PROFILES = {
+    "unlimited": {},
+    "lan": {
+        "rate": "1000mbit", "delay": "20ms", "jitter": "1ms", "loss": "0.1%",
+        "rate_bps": 1_000_000_000 / 8,
+    },
+    "wan": {
+        "rate": "100mbit", "delay": "50ms", "jitter": "10ms", "loss": "1%",
+        "rate_bps": 100_000_000 / 8,
+    },
+}
+
+FASTSYNC_CONFIGS = [
+    {"name": "fastsync",           "flags": [],                     "tool": "fastsync"},
+    {"name": "fastsync -c",        "flags": ["-c"],                 "tool": "fastsync"},
+    {"name": "fastsync -m",        "flags": ["-m"],                 "tool": "fastsync"},
+    {"name": "fastsync -m -c",     "flags": ["-m", "-c"],           "tool": "fastsync"},
+    {"name": "fastsync -m -c -s",  "flags": ["-m", "-c", "-s"],     "tool": "fastsync"},
+]
+
+RSYNC_CONFIGS = [
+    {"name": "rsync",              "flags": [],                     "tool": "rsync"},
+    {"name": "rsync -z",           "flags": ["-z"],                 "tool": "rsync"},
+    {"name": "rsync -z --zstd",    "flags": ["-z", "--zc", "zstd"],"tool": "rsync"},
+]
+
+class RsyncDaemon:
+    """Manages an rsync daemon for network-fair benchmarking."""
+
+    def __init__(self):
+        self._proc = None
+        self._port = None
+        self._conf_dir = None
+        self._module_path = None
+
+    def start(self, source_dir):
+        self._port = find_free_port()
+        self._conf_dir = tempfile.mkdtemp(prefix="rsyncd_")
+        self._module_path = source_dir
+
+        conf_path = os.path.join(self._conf_dir, "rsyncd.conf")
+        log_path = os.path.join(self._conf_dir, "rsyncd.log")
+
+        with open(conf_path, "w") as f:
+            f.write(f"uid = 0\ngid = 0\nuse chroot = no\nlog file = {log_path}\n")
+            f.write(f"[bench]\n\tpath = {source_dir}\n\tread only = yes\n")
+
+        self._proc = subprocess.Popen(
+            ["rsync", "--daemon", "--no-detach",
+             "--port", str(self._port),
+             "--config", conf_path],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+        wait_for_port(self._port, timeout=5)
+
+    def stop(self):
+        if self._proc:
+            self._proc.terminate()
+            try:
+                self._proc.wait(timeout=3)
+            except subprocess.TimeoutExpired:
+                self._proc.kill()
+                self._proc.wait()
+            self._proc = None
+        if self._conf_dir:
+            shutil.rmtree(self._conf_dir, ignore_errors=True)
+            self._conf_dir = None
+
+    @property
+    def source_url(self):
+        return f"rsync://127.0.0.1:{self._port}/bench/"
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        self.stop()
+
+
+STRUCTURED_FILES = {
+    "small.txt": b"hello world\n",
+    "medium.txt": b"the quick brown fox jumps over the lazy dog\n" * 5000,
+    "binary.bin": bytes(range(256)) * 1000,
+    "nested/subdir/deep.txt": b"deeply nested file\n",
+    "nested/another.txt": b"another nested file\n" * 50,
+}
+
+
+class Progress:
+    """Simple progress bar with ETA."""
+
+    def __init__(self, total, label="Progress"):
+        self.total = total
+        self.current = 0
+        self.label = label
+        self.start_time = time.monotonic()
+        self._print()
+
+    def tick(self, detail=""):
+        self.current += 1
+        self._print(detail)
+
+    def _print(self, detail=""):
+        elapsed = time.monotonic() - self.start_time
+        if self.current > 0:
+            eta = elapsed / self.current * (self.total - self.current)
+            eta_str = f"ETA {eta:.0f}s"
+        else:
+            eta_str = "ETA ..."
+        pct = self.current / self.total * 100 if self.total else 0
+        bar_len = 30
+        filled = int(bar_len * self.current / self.total) if self.total else 0
+        bar = "#" * filled + "-" * (bar_len - filled)
+        detail_str = f"  {detail}" if detail else ""
+        sys.stderr.write(f"\r  [{bar}] {pct:5.1f}%  {self.current}/{self.total}  {eta_str}{detail_str}  ")
+        sys.stderr.flush()
+        if self.current >= self.total:
+            sys.stderr.write(f"\r  [{'#' * bar_len}] 100.0%  {self.total}/{self.total}  done in {elapsed:.1f}s" + " " * 30 + "\n")
+            sys.stderr.flush()
+
+
+def generate_bench_data(source_dir, size_mb=25, random_ratio=0.75):
+    """Generate test data. ~random_ratio is incompressible, rest is structured."""
+    if os.path.exists(source_dir):
+        shutil.rmtree(source_dir)
+    os.makedirs(source_dir)
+
+    target = size_mb * 1024 * 1024
+    structured_budget = int(target * (1 - random_ratio))
+    written = 0
+
+    for rel_path, content in STRUCTURED_FILES.items():
+        if written >= structured_budget:
+            break
+        full_path = os.path.join(source_dir, rel_path)
+        os.makedirs(os.path.dirname(full_path), exist_ok=True)
+        with open(full_path, "wb") as f:
+            f.write(content)
+        written += len(content)
+
+    os.makedirs(os.path.join(source_dir, "bulk"), exist_ok=True)
+    i = 0
+    while written < target:
+        chunk_size = min(5 * 1024 * 1024, target - written)
+        with open(os.path.join(source_dir, f"bulk/file_{i}.dat"), "wb") as f:
+            f.write(random.randbytes(chunk_size))
+        written += chunk_size
+        i += 1
+
+    return written
+
+
+def find_free_port():
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("", 0))
+        return s.getsockname()[1]
+
+
+def wait_for_port(port, timeout=5):
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        try:
+            with socket.create_connection(("127.0.0.1", port), timeout=0.3):
+                return
+        except (ConnectionRefusedError, OSError):
+            time.sleep(0.05)
+    raise RuntimeError(f"Port {port} not ready")
+
+
+def wait_proc(proc, timeout=5):
+    try:
+        proc.wait(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait()
+
+
+def netem_apply(delay=None, jitter=None, throughput=None, loss=None):
+    """Apply tc/netem rules to loopback. Pass None to skip a parameter."""
+    netem_reset()
+    cmd = ["sudo", "tc", "qdisc", "add", "dev", "lo", "root", "netem"]
+    if throughput:
+        cmd += ["rate", throughput]
+    if delay:
+        cmd += ["delay", delay, jitter or "0ms"]
+    if loss:
+        cmd += ["loss", loss]
+    if len(cmd) > 6:
+        subprocess.run(cmd, check=True, capture_output=True)
+
+
+def netem_apply_profile(profile_name):
+    params = NETWORK_PROFILES.get(profile_name, {})
+    if not params:
+        netem_reset()
+        return
+    netem_apply(
+        delay=params.get("delay"),
+        jitter=params.get("jitter"),
+        throughput=params.get("rate"),
+        loss=params.get("loss"),
+    )
+
+
+def netem_reset():
+    subprocess.run("sudo tc qdisc del dev lo root".split(), capture_output=True)
+
+
+def run_fastsync(source_dir, dest_dir, flags, port):
+    """Run FastSync client. Returns duration or None."""
+    cmd = CLIENT_CMD + [
+        "--source-dir", source_dir,
+        "--dest-dir", dest_dir,
+        "--server-port", str(port),
+        "--save-to-disk",
+    ] + flags
+    try:
+        start = time.monotonic()
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
+        duration = time.monotonic() - start
+        if result.returncode == 0:
+            return duration
+    except subprocess.TimeoutExpired:
+        pass
+    return None
+
+
+def run_rsync(source_dir, dest_dir, flags, rsync_daemon=None):
+    """Run rsync. Returns duration or None."""
+    src = source_dir.rstrip("/") + "/"
+    if rsync_daemon:
+        src = rsync_daemon.source_url
+    cmd = ["rsync", "-a", "--delete"] + flags + [src, dest_dir + "/"]
+    try:
+        start = time.monotonic()
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
+        duration = time.monotonic() - start
+        if result.returncode == 0:
+            return duration
+    except subprocess.TimeoutExpired:
+        pass
+    return None
+
+
+def run_transfer(config, source_dir, dest_dir, port=None, rsync_daemon=None):
+    """Route to the right tool. Returns duration or None."""
+    if config["tool"] == "rsync":
+        return run_rsync(source_dir, dest_dir, config["flags"], rsync_daemon)
+    else:
+        return run_fastsync(source_dir, dest_dir, config["flags"], port)
+
+
+def run_benchmark(source_dir, dest_dir, configs, runs, profile_name, progress=None):
+    """Run benchmark for all configs, returns list of results."""
+    is_limited = profile_name != "unlimited"
+    has_rsync = any(c["tool"] == "rsync" for c in configs)
+    if is_limited:
+        netem_apply_profile(profile_name)
+
+    rsync_daemon = None
+    try:
+        if is_limited and has_rsync:
+            rsync_daemon = RsyncDaemon()
+            rsync_daemon.start(source_dir)
+
+        results = []
+        for config in configs:
+            times = []
+            for run_idx in range(runs):
+                if os.path.exists(dest_dir):
+                    shutil.rmtree(dest_dir)
+                os.makedirs(dest_dir, exist_ok=True)
+
+                port = find_free_port()
+                server = None
+                try:
+                    if config["tool"] == "fastsync":
+                        server = subprocess.Popen(
+                            SERVER_CMD + ["-p", str(port)],
+                            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                        )
+                        wait_for_port(port)
+
+                    t = run_transfer(config, source_dir, dest_dir, port, rsync_daemon)
+                    if t is not None:
+                        times.append(t)
+                finally:
+                    if server:
+                        wait_proc(server)
+
+                if progress:
+                    progress.tick(f"{config['name']} (run {run_idx+1}/{runs})")
+
+            entry = {
+                "config": config["name"],
+                "tool": config["tool"],
+                "profile": profile_name,
+                "runs": len(times),
+                "times": [round(t, 4) for t in times],
+            }
+            if times:
+                entry["p50"] = round(statistics.median(times), 4)
+                entry["p95"] = round(sorted(times)[int(len(times) * 0.95)], 4) if len(times) > 1 else entry["p50"]
+                entry["min"] = round(min(times), 4)
+                entry["max"] = round(max(times), 4)
+                entry["stdev"] = round(statistics.stdev(times), 4) if len(times) > 1 else 0.0
+            results.append(entry)
+        return results
+    finally:
+        if rsync_daemon:
+            rsync_daemon.stop()
+        if is_limited:
+            netem_reset()
+
+
+def print_table(results, total_bytes, random_ratio):
+    """Print results as a human-readable table grouped by profile."""
+    profiles = {}
+    for r in results:
+        profiles.setdefault(r["profile"], []).append(r)
+
+    for profile, entries in profiles.items():
+        params = NETWORK_PROFILES.get(profile, {})
+        print(f"\n{'=' * 85}")
+        print(f" Profile: {profile.upper()}")
+        if params.get("rate"):
+            print(f" Network: {params['rate']}, {params['delay']} +/- {params['jitter']}, loss {params['loss']}")
+        else:
+            print(f" Network: unlimited")
+        print(f" Data: {total_bytes / (1024*1024):.1f} MB  ({random_ratio*100:.0f}% random, {(1-random_ratio)*100:.0f}% compressible)")
+        print(f"{'=' * 85}")
+
+        fs_entries = [e for e in entries if e.get("tool") == "fastsync"]
+        rsync_entries = [e for e in entries if e.get("tool") == "rsync"]
+
+        if fs_entries:
+            print(f"\n FastSync:")
+            print(f" {'Config':<25} {'p50':>8} {'p95':>8} {'min':>8} {'max':>8} {'stdev':>8} {'runs':>5}")
+            print(f" {'-' * 25} {'-' * 8} {'-' * 8} {'-' * 8} {'-' * 8} {'-' * 8} {'-' * 5}")
+            for e in sorted(fs_entries, key=lambda x: x.get("p50", 999)):
+                _print_entry(e)
+
+        if rsync_entries:
+            print(f"\n rsync:")
+            print(f" {'Config':<25} {'p50':>8} {'p95':>8} {'min':>8} {'max':>8} {'stdev':>8} {'runs':>5}")
+            print(f" {'-' * 25} {'-' * 8} {'-' * 8} {'-' * 8} {'-' * 8} {'-' * 8} {'-' * 5}")
+            for e in sorted(rsync_entries, key=lambda x: x.get("p50", 999)):
+                _print_entry(e)
+
+        if params.get("rate_bps") and fs_entries and rsync_entries:
+            fs_best = min((e["p50"] for e in fs_entries if "p50" in e), default=None)
+            rsync_best = min((e["p50"] for e in rsync_entries if "p50" in e), default=None)
+            theoretical = total_bytes / params["rate_bps"]
+            if fs_best and rsync_best:
+                print(f"\n Theoretical max (line rate): {theoretical:.4f}s")
+                print(f" FastSync best:   {fs_best:.4f}s  ({theoretical/fs_best:.2f}x vs line rate)")
+                print(f" rsync best:      {rsync_best:.4f}s  ({theoretical/rsync_best:.2f}x vs line rate)")
+                print(f" FastSync vs rsync: {rsync_best/fs_best:.2f}x faster")
+
+
+def _print_entry(e):
+    if "p50" in e:
+        print(f" {e['config']:<25} {e['p50']:>7.4f}s {e['p95']:>7.4f}s "
+              f"{e['min']:>7.4f}s {e['max']:>7.4f}s {e['stdev']:>7.4f} {e['runs']:>5}")
+    else:
+        print(f" {e['config']:<25} {'N/A':>8} {'N/A':>8} {'N/A':>8} {'N/A':>8} {'N/A':>8} {e['runs']:>5}")
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="FastSync benchmark tool — compares FastSync vs rsync",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""\
+Network profiles (predefined):
+  unlimited   No artificial limits
+  lan         1 Gbit, 20ms delay, 1ms jitter, 0.1%% loss
+  wan         100 Mbit, 50ms delay, 10ms jitter, 1%% loss
+
+Custom network limits (--delay/--jitter/--throughput) override profiles.
+
+Data mix:
+  Default is ~75%% random/incompressible + ~25%% structured/compressible,
+  reflecting typical real-world file sets.
+
+Examples:
+  %(prog)s --profiles wan --runs 5
+  %(prog)s --throughput 50mbit --delay 30ms --jitter 5ms
+  %(prog)s --random-ratio 0.5 --size-mb 100
+""")
+    parser.add_argument("--runs", type=int, default=3,
+                        help="Number of runs per config (default: 3)")
+    parser.add_argument("--profiles", nargs="+", default=None,
+                        choices=list(NETWORK_PROFILES.keys()),
+                        help="Predefined network profiles (default: unlimited)")
+    parser.add_argument("--configs", nargs="+", default=None,
+                        help="Custom FastSync config flags")
+    parser.add_argument("--size-mb", type=int, default=25,
+                        help="Test data size in MB (default: 25)")
+    parser.add_argument("--random-ratio", type=float, default=0.75,
+                        help="Fraction of data that is random/incompressible (default: 0.75)")
+    parser.add_argument("--delay", default=None,
+                        help="Custom network delay (e.g. 50ms)")
+    parser.add_argument("--jitter", default=None,
+                        help="Custom network jitter (e.g. 10ms)")
+    parser.add_argument("--throughput", default=None,
+                        help="Custom throughput limit (e.g. 100mbit)")
+    parser.add_argument("--loss", default=None,
+                        help="Custom packet loss (e.g. 1%%)")
+    parser.add_argument("--no-rsync", action="store_true",
+                        help="Skip rsync comparison")
+    parser.add_argument("--progress", action="store_true",
+                        help="Show progress bar with ETA")
+    parser.add_argument("--output", choices=["table", "json"], default="table",
+                        help="Output format")
+    parser.add_argument("--keep-data", action="store_true",
+                        help="Don't clean up test data")
+    args = parser.parse_args()
+
+    # Build
+    print("Building...")
+    if os.system(f"cmake -B {BUILD_DIR} -S {PROJECT_ROOT} > /dev/null 2>&1") != 0:
+        print("CMake configure failed"); sys.exit(1)
+    if os.system(f"cmake --build {BUILD_DIR} -j$(nproc) > /dev/null 2>&1") != 0:
+        print("Build failed"); sys.exit(1)
+
+    # Determine active profile for display
+    has_custom_net = args.delay or args.jitter or args.throughput or args.loss
+    if has_custom_net:
+        active_profile = "custom"
+        NETWORK_PROFILES["custom"] = {
+            "rate": args.throughput, "delay": args.delay or "0ms",
+            "jitter": args.jitter or "0ms", "loss": args.loss or "0%",
+        }
+        if args.throughput:
+            parts = args.throughput.replace("mbit", "").replace("mbps", "")
+            try:
+                NETWORK_PROFILES["custom"]["rate_bps"] = float(parts) * 1_000_000 / 8
+            except ValueError:
+                pass
+        profiles_to_run = ["custom"]
+    else:
+        profiles_to_run = args.profiles or ["unlimited"]
+
+    # Generate data
+    source_dir = os.path.join(BENCH_DIR, "source")
+    dest_dir = os.path.join(BENCH_DIR, "dest")
+    total_bytes = generate_bench_data(source_dir, args.size_mb, args.random_ratio)
+    compressible_pct = (1 - args.random_ratio) * 100
+    random_pct = args.random_ratio * 100
+    print(f"Generated {total_bytes / (1024*1024):.1f} MB  "
+          f"({random_pct:.0f}% random, {compressible_pct:.0f}% compressible)")
+
+    # Build config list
+    if args.configs:
+        fastsync_configs = [{"name": c, "flags": c.split(), "tool": "fastsync"} for c in args.configs]
+    else:
+        fastsync_configs = list(FASTSYNC_CONFIGS)
+
+    configs = list(fastsync_configs)
+    if not args.no_rsync:
+        configs += RSYNC_CONFIGS
+
+    # Run benchmarks
+    total_runs = len(configs) * args.runs * len(profiles_to_run)
+    progress = Progress(total_runs, "Benchmarking") if args.progress else None
+    if progress:
+        print(f"Running {total_runs} transfers...")
+
+    all_results = []
+    try:
+        for profile in profiles_to_run:
+            results = run_benchmark(source_dir, dest_dir, configs, args.runs, profile, progress)
+            all_results.extend(results)
+    finally:
+        if not args.keep_data:
+            shutil.rmtree(BENCH_DIR, ignore_errors=True)
+
+    # Output
+    if args.output == "json":
+        print(json.dumps(all_results, indent=2))
+    else:
+        print_table(all_results, total_bytes, args.random_ratio)
+        print()
+
+
+if __name__ == "__main__":
+    main()

shell.nix

@@ -8,11 +8,14 @@ pkgs.mkShell {
     cmake
     gnumake
     pkg-config
+    docker
     tea
   ];
 
   buildInputs = with pkgs; [
     zstd
+    openssl
+    (python3.withPackages (ps: with ps; [ pytest ]))
   ];
 
   NIX_ENFORCE_PURITY = 0;

src/client/client_cli.c

@@ -1,12 +1,17 @@
 #include "client_send.h"
 #include "config.h"
+#include "delta.h"
 #include "log.h"
+#include "protocol.h"
+#include "transport_tls.h"
 #include "utils.h"
+#include <errno.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-char *server_host = "127.0.0.1";
+char* server_host = "127.0.0.1";
 int server_port = 8080;
 
 static void print_usage(void) {
@@ -31,6 +36,12 @@ static void print_usage(void) {
   printf("  --include <pattern> Only include files matching pattern\n");
   printf("  --max-size <n>      Skip files larger than n bytes\n");
   printf("  --min-size <n>      Skip files smaller than n bytes\n");
+  printf("  --incremental       Skip files unchanged since last transfer\n");
+  printf("  --delta             Delta transfer for changed files (requires --incremental)\n");
+  printf("  --delta-block <n>   Delta block size in bytes (default: %d)\n",
+         DELTA_BLOCK_SIZE_DEFAULT);
+  printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
+         DELTA_MAX_FILE_SIZE);
   printf("  -m                  Enable multithreading\n");
   printf("  -s                  Enable chunk serialization\n");
   printf("  -f                  Enable sendfile (TCP only, not with -c or -s)\n");
@@ -42,22 +53,26 @@ static void print_usage(void) {
   printf("  --save-to-disk      Write received files to disk\n");
   printf("  --server-host <ip>  Server IP address (default: 127.0.0.1)\n");
   printf("  --server-port <n>   Server port (default: 8080)\n");
+  printf("  --bwlimit <KB/s>    Bandwidth limit in kilobytes per second\n");
+  printf("  --tls               Enable TLS encryption\n");
+  printf("  --cert <path>       TLS certificate file (PEM)\n");
+  printf("  --key <path>        TLS private key file (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
   printf("  --help              Show this help\n");
 }
 
-int main(int argc, char *argv[]) {
+int main(int argc, char* argv[]) {
-  const char *env_source = getenv("FASTSYNC_SOURCE_DIR");
+  const char* env_source = getenv("FASTSYNC_SOURCE_DIR");
-  const char *env_dest = getenv("FASTSYNC_DEST_DIR");
+  const char* env_dest = getenv("FASTSYNC_DEST_DIR");
-  const char *env_save = getenv("FASTSYNC_SAVE_TO_DISK");
+  const char* env_save = getenv("FASTSYNC_SAVE_TO_DISK");
 
   bool save_to_disk = false;
-  if (env_save &&
+  if (env_save && (strcmp(env_save, "true") == 0 || strcmp(env_save, "1") == 0)) {
-      (strcmp(env_save, "true") == 0 || strcmp(env_save, "1") == 0)) {
     save_to_disk = true;
   }
 
-  Config *config = config_create(str_dup(PROTOCOL_VERSION), NULL, NULL,
+  Config* config = config_create(str_dup(PROTOCOL_VERSION), NULL, NULL, save_to_disk, false, false,
-                                 save_to_disk, false, false, false, false, 5, false, 0);
+                                 false, false, 5, false, 0);
 
   int positional_args[2];
   int positional_count = 0;
@@ -79,26 +94,43 @@ int main(int argc, char *argv[]) {
       config->use_delete = true;
     } else if (strcmp(argv[i], "--exclude") == 0 && i + 1 < argc) {
       int idx = config->exclude_count++;
-      config->exclude_patterns = realloc(config->exclude_patterns, config->exclude_count * sizeof(char *));
+      config->exclude_patterns =
+          realloc(config->exclude_patterns, config->exclude_count * sizeof(char*));
       config->exclude_patterns[idx] = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "--include") == 0 && i + 1 < argc) {
       int idx = config->include_count++;
-      config->include_patterns = realloc(config->include_patterns, config->include_count * sizeof(char *));
+      config->include_patterns =
+          realloc(config->include_patterns, config->include_count * sizeof(char*));
       config->include_patterns[idx] = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "--max-size") == 0 && i + 1 < argc) {
       config->max_size = strtoull(argv[++i], NULL, 10);
     } else if (strcmp(argv[i], "--min-size") == 0 && i + 1 < argc) {
       config->min_size = strtoull(argv[++i], NULL, 10);
+    } else if (strcmp(argv[i], "--incremental") == 0) {
+      config->use_incremental = true;
+    } else if (strcmp(argv[i], "--delta") == 0) {
+      config->use_delta = true;
+    } else if (strcmp(argv[i], "--delta-block") == 0 && i + 1 < argc) {
+      unsigned long long val = strtoull(argv[++i], NULL, 10);
+      if (val >= DELTA_BLOCK_SIZE_MIN && val <= DELTA_BLOCK_SIZE_MAX)
+        config->delta_block_size = (uint32_t)val;
+      else
+        fprintf(stderr, "Warning: --delta-block value %llu out of range, using default\n", val);
+    } else if (strcmp(argv[i], "--delta-max") == 0 && i + 1 < argc) {
+      unsigned long long val = strtoull(argv[++i], NULL, 10);
+      if (val >= DELTA_MIN_FILE_SIZE)
+        config->delta_max_file_size = val;
+      else
+        fprintf(stderr, "Warning: --delta-max value %llu too small, using default\n", val);
     } else if (strcmp(argv[i], "-c") == 0 || strcmp(argv[i], "-z") == 0) {
       config->use_compression = true;
       log_message(LOG_LEVEL_INFO, "Enabled Compression");
       if (i + 1 < argc) {
-        char *end_ptr;
+        char* end_ptr;
         int level = strtol(argv[i + 1], &end_ptr, 10);
         if (*end_ptr == '\0') {
           config->compression_level = level;
-          log_message(LOG_LEVEL_INFO, "Set Compression level to %d",
+          log_message(LOG_LEVEL_INFO, "Set Compression level to %d", config->compression_level);
-                      config->compression_level);
           i++;
         }
       }
@@ -127,12 +159,37 @@ int main(int argc, char *argv[]) {
       server_host = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "--server-port") == 0 && i + 1 < argc) {
       server_port = atoi(argv[++i]);
+    } else if (strcmp(argv[i], "--bwlimit") == 0 && i + 1 < argc) {
+      char* end;
+      errno = 0;
+      unsigned long long kbps = strtoull(argv[++i], &end, 10);
+      if (errno != 0 || *end != '\0' || kbps == 0) {
+        fprintf(stderr, "Error: --bwlimit must be a positive integer\n");
+        return 1;
+      }
+      if (kbps > ULLONG_MAX / 1024) {
+        fprintf(stderr, "Error: --bwlimit value too large\n");
+        return 1;
+      }
+      io_set_bwlimit(kbps * 1024);
+      log_message(LOG_LEVEL_INFO, "Set bandwidth limit to %llu KB/s", kbps);
     } else if (strcmp(argv[i], "--progress") == 0) {
       config->show_progress = true;
     } else if (strcmp(argv[i], "--chunk-size") == 0 && i + 1 < argc) {
       unsigned long long val = strtoull(argv[++i], NULL, 10);
       if (val > 0)
         config->chunk_size = val;
+    } else if (strcmp(argv[i], "--tls") == 0) {
+      config->use_tls = true;
+    } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) {
+      free(config->tls_cert);
+      config->tls_cert = str_dup(argv[++i]);
+    } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
+      free(config->tls_key);
+      config->tls_key = str_dup(argv[++i]);
+    } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
+      free(config->tls_ca);
+      config->tls_ca = str_dup(argv[++i]);
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
     } else if (argv[i][0] == '-') {
@@ -164,9 +221,9 @@ int main(int argc, char *argv[]) {
     return 1;
   } else {
     if (!config->send_directory && env_source)
-      config->send_directory = str_dup((char *)env_source);
+      config->send_directory = str_dup((char*)env_source);
     if (!config->receive_root_directory && env_dest)
-      config->receive_root_directory = str_dup((char *)env_dest);
+      config->receive_root_directory = str_dup((char*)env_dest);
   }
 
   if (!config->send_directory || !config->receive_root_directory) {
@@ -175,7 +232,8 @@ int main(int argc, char *argv[]) {
     return 1;
   }
   if (config->use_sendfile && (config->use_chunk_serialization || config->use_compression)) {
-    fprintf(stderr, "Error: -f/--sendfile cannot be combined with -c (compression) or -s (chunk serialization)\n");
+    fprintf(stderr, "Error: -f/--sendfile cannot be combined with -c (compression) or -s (chunk "
+                    "serialization)\n");
     return 1;
   }
 
@@ -184,6 +242,41 @@ int main(int argc, char *argv[]) {
     return 1;
   }
 
+  if (config->use_incremental && config->use_chunk_serialization) {
+    fprintf(stderr, "Error: --incremental is not supported with -s (chunk serialization)\n");
+    return 1;
+  }
+
+  if (config->use_incremental && !config->use_metadata) {
+    log_message(LOG_LEVEL_INFO, "Enabling metadata preservation for --incremental");
+    config->use_metadata = true;
+  }
+
+  if (config->use_delta && !config->use_incremental) {
+    fprintf(stderr, "Error: --delta requires --incremental\n");
+    return 1;
+  }
+  if (config->use_delta && config->use_chunk_serialization) {
+    fprintf(stderr, "Error: --delta cannot be combined with -s (chunk serialization)\n");
+    return 1;
+  }
+  if (config->use_delta && config->use_sendfile) {
+    fprintf(stderr, "Error: --delta cannot be combined with -f (sendfile)\n");
+    return 1;
+  }
+  if (config->use_delta && !config->use_metadata) {
+    log_message(LOG_LEVEL_INFO, "Enabling metadata preservation for --delta");
+    config->use_metadata = true;
+  }
+
+  if (config->use_tls) {
+    if (!config->tls_cert || !config->tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      return 1;
+    }
+    tls_global_init();
+  }
+
   if (config->use_multithreading)
     return send_files_multithreaded(config);
   return send_files(config);

src/client/client_send.c

@@ -1,9 +1,12 @@
 #include "client_send.h"
 #include "array_list.h"
 #include "chunk.h"
+#include "compression.h"
 #include "config.h"
 #include "data.h"
+#include "delta.h"
 #include "file.h"
+#include "metadata.h"
 #include "log.h"
 #include "multiprocessing.h"
 #include "protocol.h"
@@ -11,6 +14,7 @@
 #include "scanner.h"
 #include "transport_tcp.h"
 #include "transport_ssh.h"
+#include "transport_tls.h"
 #include "utils.h"
 #include <stdio.h>
 #include <stdlib.h>
@@ -18,49 +22,187 @@
 #include <threads.h>
 #include <time.h>
 
-int send_chunk(Client *client, Chunk *chunk, Config *config) {
+static int incremental_check(Client* client, File* file, DeltaSignature** out_sig) {
+  *out_sig = NULL;
+  if (!send_status(client->file_descriptor, STATUS_CHECK))
+    return -1;
+  if (!send_str(client->file_descriptor, file->path))
+    return -1;
+  unsigned long long fsize = file->data->size;
+  long long mtime = file->metadata ? file->metadata->mtime_sec : 0;
+  if (!send_n_data(client->file_descriptor, &fsize, sizeof(fsize)))
+    return -1;
+  if (!send_n_data(client->file_descriptor, &mtime, sizeof(mtime)))
+    return -1;
+  Status s;
+  if (!receive_status(client->file_descriptor, &s))
+    return -1;
+  if (s == STATUS_ERROR) {
+    log_message(LOG_LEVEL_ERROR, "Server reported error for file");
+    return -1;
+  }
+  if (s == STATUS_OK)
+    return 1;
+  if (s == STATUS_DELTA_SIGNATURE) {
+    Data* sig_data = receive_data(client->file_descriptor);
+    if (!sig_data)
+      return -1;
+    DeltaSignature* sig = delta_signature_deserialize(sig_data);
+    data_destroy(sig_data);
+    if (!sig)
+      return -1;
+    *out_sig = sig;
+    return 2;
+  }
+  if (s != STATUS_NEXT) {
+    log_message(LOG_LEVEL_ERROR, "Unexpected server status");
+    return -1;
+  }
+  return 0;
+}
+
+static int send_delta(Client* client, File* file, DeltaSignature* sig, Config* config) {
+  Delta* delta = delta_compute(file->data->data, file->data->size, sig, config->delta_block_size);
+  if (!delta)
+    return 1;
+
+  if (!delta_is_worthwhile(delta, file->data->size)) {
+    delta_destroy(delta);
+    if (!send_status(client->file_descriptor, STATUS_NEXT))
+      return -1;
+    return 1;
+  }
+
+  Data* delta_data = delta_serialize(delta);
+  delta_destroy(delta);
+  if (!delta_data)
+    return -1;
+
+  Data* to_send = delta_data;
+  if (config->use_compression) {
+    to_send = data_compress(delta_data, config->compression_level);
+    data_destroy(delta_data);
+    if (!to_send)
+      return -1;
+  }
+
+  bool ok = send_status(client->file_descriptor, STATUS_DELTA_DATA) &&
+            send_data(client->file_descriptor, to_send);
+
+  if (ok && config->use_metadata)
+    ok = metadata_send(client->file_descriptor, file->metadata);
+
+  data_destroy(to_send);
+  return ok ? 0 : -1;
+}
+
+typedef bool (*file_send_fn)(File*, int, bool, int, bool);
+
+static int send_file_incremental(Client* client, File* file, Config* config, file_send_fn send_fn) {
+  DeltaSignature* sig = NULL;
+  int rc = incremental_check(client, file, &sig);
+  if (rc < 0) {
+    delta_signature_destroy(sig);
+    return -1;
+  }
+  if (rc == 1) {
+    delta_signature_destroy(sig);
+    return 1;
+  }
+  if (rc == 2 && config->use_delta) {
+    int drc = send_delta(client, file, sig, config);
+    delta_signature_destroy(sig);
+    if (drc == 0)
+      return 0;
+    if (drc < 0)
+      return -1;
+  } else {
+    delta_signature_destroy(sig);
+  }
+  if (!send_fn(file, client->file_descriptor, config->use_metadata,
+               config->use_compression ? config->compression_level : 0, false))
+    return -1;
+  return 0;
+}
+
+int send_chunk(Client* client, Chunk* chunk, Config* config) {
   if (config->use_chunk_serialization) {
-    if (!send_status(client->file_descriptor, STATUS_CHUNK)) return -1;
+    if (!send_status(client->file_descriptor, STATUS_CHUNK))
-    Data *data;
+      return -1;
+    Data* data;
     if (config->use_compression) {
       data = chunk_compress(chunk, config->compression_level, config->use_metadata);
     } else {
       data = chunk_serialize(chunk, config->use_metadata);
     }
-    if (data == NULL) return -1;
+    if (data == NULL)
-    if (!send_data(client->file_descriptor, data)) { data_destroy(data); return -1; }
+      return -1;
+    if (!send_data(client->file_descriptor, data)) {
+      data_destroy(data);
+      return -1;
+    }
     data_destroy(data);
   } else if (config->use_sendfile && !config->use_compression) {
     for (int i = 0; i < chunk->element_count; i++) {
-      if (!send_status(client->file_descriptor, STATUS_NEXT)) return -1;
+      if (config->use_incremental) {
-      if (!file_send_sendfile(chunk->items[i], client->file_descriptor, config->use_metadata))
+        int rc = send_file_incremental(client, chunk->items[i], config,
-        return -1;
+                                       (file_send_fn)file_send_sendfile);
+        if (rc == 1)
+          continue;
+        if (rc < 0)
+          return -1;
+      } else {
+        if (!send_status(client->file_descriptor, STATUS_NEXT))
+          return -1;
+        if (!file_send_sendfile(chunk->items[i], client->file_descriptor, config->use_metadata, 0,
+                                true))
+          return -1;
+      }
     }
   } else {
     for (int i = 0; i < chunk->element_count; i++) {
-      if (!send_status(client->file_descriptor, STATUS_NEXT)) return -1;
+      if (config->use_incremental) {
-      if (!file_send_single_calls(chunk->items[i], client->file_descriptor,
+        int rc = send_file_incremental(client, chunk->items[i], config,
-                            config->use_metadata,
+                                       (file_send_fn)file_send_single_calls);
-                            config->use_compression ? config->compression_level : 0))
+        if (rc == 1)
-        return -1;
+          continue;
+        if (rc < 0)
+          return -1;
+      } else {
+        if (!send_status(client->file_descriptor, STATUS_NEXT))
+          return -1;
+        if (!file_send_single_calls(chunk->items[i], client->file_descriptor, config->use_metadata,
+                                    config->use_compression ? config->compression_level : 0, true))
+          return -1;
+      }
     }
   }
   return 0;
 }
 
-static int send_chunks_multithreaded(void *pipeline_context) {
+static int send_chunks_multithreaded(void* pipeline_context) {
-  PipelineContextSender *context = (PipelineContextSender *)pipeline_context;
+  PipelineContextSender* context = (PipelineContextSender*)pipeline_context;
-  Client *client;
+  Client* client;
   if (context->config->transport == TRANSPORT_SSH) {
     if (context->config->use_sendfile) {
       fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
       return 1;
     }
     client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port);
+  } else if (context->config->use_tls) {
+    client = client_create();
+    if (!client || !client_connect_tls(client, server_host, server_port, context->config->tls_cert,
+                                       context->config->tls_key, context->config->tls_ca)) {
+      if (client)
+        client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return thrd_error;
+    }
   } else {
     client = client_create();
     if (!client || !client_connect(client, server_host, server_port)) {
-      if (client) client_delete(client);
+      if (client)
+        client_delete(client);
       fprintf(stderr, "Error: could not connect to server\n");
       return thrd_error;
     }
@@ -72,17 +214,15 @@ static int send_chunks_multithreaded(void *pipeline_context) {
   }
 
   while (true) {
-    Chunk *current_chunk = queue_dequeue_multithreaded(
+    Chunk* current_chunk = queue_dequeue_multithreaded(
-        context->queue_loader, &context->mutex_loader,
+        context->queue_loader, &context->mutex_loader, &context->condition_not_empty_loader,
-        &context->condition_not_empty_loader,
         &context->condition_not_full_loader, &context->loader_done);
     if (current_chunk == NULL) {
       if (context->config->use_delete) {
         send_status(client->file_descriptor, STATUS_MANIFEST);
         send_int(client->file_descriptor, context->manifest->size);
         for (int i = 0; i < context->manifest->size; i++)
-          send_str(client->file_descriptor,
+          send_str(client->file_descriptor, (char*)context->manifest->items[i]);
-                   (char *)context->manifest->items[i]);
       }
       send_status(client->file_descriptor, STATUS_FINISHED);
       Status s;
@@ -101,30 +241,29 @@ static int send_chunks_multithreaded(void *pipeline_context) {
   }
 }
 
-static int scan_directory_multithreaded(void *pipeline_context) {
+static int scan_directory_multithreaded(void* pipeline_context) {
-  PipelineContextSender *context = (PipelineContextSender *)pipeline_context;
+  PipelineContextSender* context = (PipelineContextSender*)pipeline_context;
   mtx_lock(&context->mutex_scanner);
-  DirectoryScanner *scanner = directory_scanner_create(
+  DirectoryScanner* scanner = directory_scanner_create(
-      context->config->send_directory, context->config->use_metadata,
+      context->config->send_directory, context->config->use_metadata, context->config->chunk_size,
-      context->config->chunk_size, context->config->exclude_patterns,
+      context->config->exclude_patterns, context->config->exclude_count,
-      context->config->exclude_count, context->config->include_patterns,
+      context->config->include_patterns, context->config->include_count, context->config->max_size,
-      context->config->include_count, context->config->max_size,
       context->config->min_size);
   mtx_unlock(&context->mutex_scanner);
 
-  Chunk *current_chunk;
+  Chunk* current_chunk;
   while ((current_chunk = directory_scanner_next(scanner)) != NULL) {
     if (context->config->use_delete) {
       mtx_lock(&context->mutex_scanner);
       for (int i = 0; i < current_chunk->element_count; i++) {
-        const char *p = current_chunk->items[i]->path;
+        const char* p = current_chunk->items[i]->path;
-        if (*p == '/') p++;
+        if (*p == '/')
+          p++;
         array_list_add(context->manifest, str_dup(p));
       }
       mtx_unlock(&context->mutex_scanner);
     }
-    queue_enqueue_multithreaded(context->queue_scanner, current_chunk,
+    queue_enqueue_multithreaded(context->queue_scanner, current_chunk, &context->mutex_scanner,
-                                &context->mutex_scanner,
                                 &context->condition_not_empty_scanner,
                                 &context->condition_not_full_scanner);
   }
@@ -137,12 +276,11 @@ static int scan_directory_multithreaded(void *pipeline_context) {
   return thrd_success;
 }
 
-static int load_files_multithreaded(void *pipeline_context) {
+static int load_files_multithreaded(void* pipeline_context) {
-  PipelineContextSender *context = (PipelineContextSender *)pipeline_context;
+  PipelineContextSender* context = (PipelineContextSender*)pipeline_context;
   while (true) {
-    Chunk *chunk = queue_dequeue_multithreaded(
+    Chunk* chunk = queue_dequeue_multithreaded(
-        context->queue_scanner, &context->mutex_scanner,
+        context->queue_scanner, &context->mutex_scanner, &context->condition_not_empty_scanner,
-        &context->condition_not_empty_scanner,
         &context->condition_not_full_scanner, &context->scanner_done);
     if (chunk == NULL) {
       mtx_lock(&context->mutex_loader);
@@ -160,51 +298,58 @@ static int load_files_multithreaded(void *pipeline_context) {
         }
       }
     }
-    queue_enqueue_multithreaded(context->queue_loader, chunk,
+    queue_enqueue_multithreaded(context->queue_loader, chunk, &context->mutex_loader,
-                                &context->mutex_loader,
                                 &context->condition_not_empty_loader,
                                 &context->condition_not_full_loader);
   }
 }
 
-int send_files(Config *config) {
+int send_files(Config* config) {
   if (config->dry_run) {
-    DirectoryScanner *scanner = directory_scanner_create(
+    DirectoryScanner* scanner = directory_scanner_create(
-        config->send_directory, config->use_metadata, config->chunk_size,
+        config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
-        config->exclude_patterns, config->exclude_count,
+        config->exclude_count, config->include_patterns, config->include_count, config->max_size,
-        config->include_patterns, config->include_count,
+        config->min_size);
-        config->max_size, config->min_size);
+    Chunk* chunk;
-    Chunk *chunk;
     int file_count = 0;
     unsigned long long total_bytes = 0;
     printf("Dry run: files to be transferred\n");
     while ((chunk = directory_scanner_next(scanner)) != NULL) {
       for (int i = 0; i < chunk->element_count; i++) {
-        printf("  %s (%zu bytes)\n", chunk->items[i]->path,
+        printf("  %s (%zu bytes)\n", chunk->items[i]->path, chunk->items[i]->data->size);
-               chunk->items[i]->data->size);
         total_bytes += chunk->items[i]->data->size;
         file_count++;
       }
       chunk_destroy(chunk);
     }
     directory_scanner_destroy(scanner);
-    printf("Total: %d files, %.1f MB\n", file_count,
+    printf("Total: %d files, %.1f MB\n", file_count, total_bytes / 1048576.0);
-           total_bytes / 1048576.0);
     return 0;
   }
 
-  Client *client;
+  Client* client;
   if (config->transport == TRANSPORT_SSH) {
     if (config->use_sendfile) {
       fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
       return 1;
     }
     client = client_connect_ssh(config->ssh_destination, config->ssh_port);
-    if (!client) return 1;
+    if (!client)
+      return 1;
+  } else if (config->use_tls) {
+    client = client_create();
+    if (!client || !client_connect_tls(client, server_host, server_port, config->tls_cert,
+                                       config->tls_key, config->tls_ca)) {
+      if (client)
+        client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return 1;
+    }
   } else {
     client = client_create();
     if (!client || !client_connect(client, server_host, server_port)) {
-      if (client) client_delete(client);
+      if (client)
+        client_delete(client);
       fprintf(stderr, "Error: could not connect to server\n");
       return 1;
     }
@@ -214,23 +359,23 @@ int send_files(Config *config) {
     client_delete(client);
     return 1;
   }
-  DirectoryScanner *scanner = directory_scanner_create(
+  DirectoryScanner* scanner = directory_scanner_create(
-      config->send_directory, config->use_metadata, config->chunk_size,
+      config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
-      config->exclude_patterns, config->exclude_count,
+      config->exclude_count, config->include_patterns, config->include_count, config->max_size,
-      config->include_patterns, config->include_count,
+      config->min_size);
-      config->max_size, config->min_size);
+  Chunk* current_chunk;
-  Chunk *current_chunk;
   unsigned long long total_bytes = 0;
   time_t last_progress = 0;
   time_t start = time(NULL);
-  ArrayList *manifest = config->use_delete ? array_list_create(free) : NULL;
+  ArrayList* manifest = config->use_delete ? array_list_create(free) : NULL;
   while ((current_chunk = directory_scanner_next(scanner)) != NULL) {
     unsigned long long chunk_bytes = 0;
     for (int i = 0; i < current_chunk->element_count; i++) {
       chunk_bytes += current_chunk->items[i]->data->size;
       if (manifest) {
-        const char *p = current_chunk->items[i]->path;
+        const char* p = current_chunk->items[i]->path;
-        if (*p == '/') p++;
+        if (*p == '/')
+          p++;
         array_list_add(manifest, str_dup(p));
       }
     }
@@ -264,7 +409,7 @@ int send_files(Config *config) {
     send_status(client->file_descriptor, STATUS_MANIFEST);
     send_int(client->file_descriptor, manifest->size);
     for (int i = 0; i < manifest->size; i++)
-      send_str(client->file_descriptor, (char *)manifest->items[i]);
+      send_str(client->file_descriptor, (char*)manifest->items[i]);
     array_list_delete(manifest);
   }
   send_status(client->file_descriptor, STATUS_FINISHED);
@@ -281,41 +426,39 @@ int send_files(Config *config) {
   return ok ? 0 : -1;
 }
 
-int send_files_multithreaded(Config *config) {
+int send_files_multithreaded(Config* config) {
   if (config->dry_run) {
-    DirectoryScanner *scanner = directory_scanner_create(
+    DirectoryScanner* scanner = directory_scanner_create(
-        config->send_directory, config->use_metadata, config->chunk_size,
+        config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
-        config->exclude_patterns, config->exclude_count,
+        config->exclude_count, config->include_patterns, config->include_count, config->max_size,
-        config->include_patterns, config->include_count,
+        config->min_size);
-        config->max_size, config->min_size);
+    Chunk* chunk;
-    Chunk *chunk;
     int file_count = 0;
     unsigned long long total_bytes = 0;
     printf("Dry run: files to be transferred\n");
     while ((chunk = directory_scanner_next(scanner)) != NULL) {
       for (int i = 0; i < chunk->element_count; i++) {
-        printf("  %s (%zu bytes)\n", chunk->items[i]->path,
+        printf("  %s (%zu bytes)\n", chunk->items[i]->path, chunk->items[i]->data->size);
-               chunk->items[i]->data->size);
         total_bytes += chunk->items[i]->data->size;
         file_count++;
       }
       chunk_destroy(chunk);
     }
     directory_scanner_destroy(scanner);
-    printf("Total: %d files, %.1f MB\n", file_count,
+    printf("Total: %d files, %.1f MB\n", file_count, total_bytes / 1048576.0);
-           total_bytes / 1048576.0);
     return 0;
   }
 
-  Queue *q1 = queue_create(100, chunk_destroy);
+  Queue* q1 = queue_create(100, chunk_destroy);
-  Queue *q2 = queue_create(100, chunk_destroy);
+  Queue* q2 = queue_create(100, chunk_destroy);
   if (!q1 || !q2) {
-    if (q1) queue_destroy(q1);
+    if (q1)
-    if (q2) queue_destroy(q2);
+      queue_destroy(q1);
+    if (q2)
+      queue_destroy(q2);
     return 1;
   }
-  PipelineContextSender *context =
+  PipelineContextSender* context = pipeline_context_sender_create(config, q1, q2);
-      pipeline_context_sender_create(config, q1, q2);
   if (!context) {
     queue_destroy(q1);
     queue_destroy(q2);
@@ -325,11 +468,9 @@ int send_files_multithreaded(Config *config) {
     context->manifest = array_list_create(free);
 
   thrd_t scanner, loader, sender;
-  if (thrd_create(&scanner, scan_directory_multithreaded, context) !=
+  if (thrd_create(&scanner, scan_directory_multithreaded, context) != thrd_success ||
-          thrd_success ||
       thrd_create(&loader, load_files_multithreaded, context) != thrd_success ||
-      thrd_create(&sender, send_chunks_multithreaded, context) !=
+      thrd_create(&sender, send_chunks_multithreaded, context) != thrd_success) {
-          thrd_success) {
     perror("Error creating threads.\n");
     pipeline_context_sender_destroy(context);
     return 1;

src/client/client_send.h

@@ -5,11 +5,11 @@
 #include "config.h"
 #include "transport_tcp.h"
 
-extern char *server_host;
+extern char* server_host;
 extern int server_port;
 
-int send_chunk(Client *client, Chunk *chunk, Config *config);
+int send_chunk(Client* client, Chunk* chunk, Config* config);
-int send_files(Config *config);
+int send_files(Config* config);
-int send_files_multithreaded(Config *config);
+int send_files_multithreaded(Config* config);
 
 #endif

src/client/scanner.c

@@ -11,8 +11,14 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-DirectoryScanner *directory_scanner_create(char *root_directory, bool use_metadata, unsigned long long chunk_size, char **exclude_patterns, int exclude_count, char **include_patterns, int include_count, unsigned long long max_size, unsigned long long min_size) {
+DirectoryScanner* directory_scanner_create(char* root_directory, bool use_metadata,
-  DirectoryScanner *scanner = malloc(sizeof(DirectoryScanner));
+                                           unsigned long long chunk_size, char** exclude_patterns,
+                                           int exclude_count, char** include_patterns,
+                                           int include_count, unsigned long long max_size,
+                                           unsigned long long min_size) {
+  DirectoryScanner* scanner = malloc(sizeof(DirectoryScanner));
+  if (scanner == NULL)
+    return NULL;
   scanner->directories = queue_create(100, free);
   scanner->current_dir = NULL;
   scanner->current_path = NULL;
@@ -28,7 +34,7 @@ DirectoryScanner *directory_scanner_create(char *root_directory, bool use_metada
   return scanner;
 }
 
-void directory_scanner_destroy(DirectoryScanner *scanner) {
+void directory_scanner_destroy(DirectoryScanner* scanner) {
   if (scanner == NULL)
     return;
   if (scanner->current_dir) {
@@ -40,16 +46,16 @@ void directory_scanner_destroy(DirectoryScanner *scanner) {
   free(scanner);
 }
 
-static Chunk *chunk_data_to_chunk(ArrayList *chunk_data) {
+static Chunk* chunk_data_to_chunk(ArrayList* chunk_data) {
-  void **chunk_items = array_list_to_array(chunk_data);
+  void** chunk_items = array_list_to_array(chunk_data);
-  Chunk *chunk = chunk_create((File **)chunk_items, chunk_data->size);
+  Chunk* chunk = chunk_create((File**)chunk_items, chunk_data->size);
   free(chunk_items);
   chunk_data->item_destroyer = NULL;
   array_list_delete(chunk_data);
   return chunk;
 }
 
-static int open_next_directory(DirectoryScanner *scanner) {
+static int open_next_directory(DirectoryScanner* scanner) {
   if (scanner->current_dir) {
     closedir(scanner->current_dir);
     scanner->current_dir = NULL;
@@ -59,7 +65,7 @@ static int open_next_directory(DirectoryScanner *scanner) {
   if (queue_is_empty(scanner->directories))
     return 0;
 
-  scanner->current_path = (char *)queue_dequeue(scanner->directories);
+  scanner->current_path = (char*)queue_dequeue(scanner->directories);
   scanner->current_dir = opendir(scanner->current_path);
   if (scanner->current_dir == NULL) {
     perror("Could not open directory");
@@ -70,8 +76,8 @@ static int open_next_directory(DirectoryScanner *scanner) {
   return 1;
 }
 
-Chunk *directory_scanner_next(DirectoryScanner *scanner) {
+Chunk* directory_scanner_next(DirectoryScanner* scanner) {
-  ArrayList *chunk_data = array_list_create(file_destroy);
+  ArrayList* chunk_data = array_list_create(file_destroy);
   unsigned long long chunk_data_size = 0;
 
   while (1) {
@@ -80,7 +86,7 @@ Chunk *directory_scanner_next(DirectoryScanner *scanner) {
         break;
     }
 
-    struct dirent *entry = readdir(scanner->current_dir);
+    struct dirent* entry = readdir(scanner->current_dir);
     if (entry == NULL) {
       closedir(scanner->current_dir);
       scanner->current_dir = NULL;
@@ -92,7 +98,7 @@ Chunk *directory_scanner_next(DirectoryScanner *scanner) {
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
       continue;
 
-    char *cur_path = path_cat(scanner->current_path, entry->d_name);
+    char* cur_path = path_cat(scanner->current_path, entry->d_name);
     struct stat stats;
     if (stat(cur_path, &stats) != 0) {
       free(cur_path);
@@ -100,7 +106,7 @@ Chunk *directory_scanner_next(DirectoryScanner *scanner) {
     }
 
     if (S_ISDIR(stats.st_mode)) {
-      queue_enqueue(scanner->directories, (void *)cur_path);
+      queue_enqueue(scanner->directories, (void*)cur_path);
     } else {
       bool excluded = false;
       for (int i = 0; i < scanner->exclude_count; i++) {
@@ -134,7 +140,7 @@ Chunk *directory_scanner_next(DirectoryScanner *scanner) {
         continue;
       }
 
-      File *file = file_create(cur_path);
+      File* file = file_create(cur_path);
       if (file == NULL) {
         free(cur_path);
         continue;
@@ -154,5 +160,6 @@ Chunk *directory_scanner_next(DirectoryScanner *scanner) {
 
   if (chunk_data->size > 0)
     return chunk_data_to_chunk(chunk_data);
+  array_list_delete(chunk_data);
   return NULL;
 }

src/client/scanner.h

@@ -7,21 +7,25 @@
 #include <stdbool.h>
 
 typedef struct {
-  Queue *directories;
+  Queue* directories;
-  DIR *current_dir;
+  DIR* current_dir;
-  char *current_path;
+  char* current_path;
   bool use_metadata;
   unsigned long long chunk_size;
-  char **exclude_patterns;
+  char** exclude_patterns;
   int exclude_count;
-  char **include_patterns;
+  char** include_patterns;
   int include_count;
   unsigned long long max_size;
   unsigned long long min_size;
 } DirectoryScanner;
 
-DirectoryScanner *directory_scanner_create(char *root_directory, bool use_metadata, unsigned long long chunk_size, char **exclude_patterns, int exclude_count, char **include_patterns, int include_count, unsigned long long max_size, unsigned long long min_size);
+DirectoryScanner* directory_scanner_create(char* root_directory, bool use_metadata,
-Chunk *directory_scanner_next(DirectoryScanner *scanner);
+                                           unsigned long long chunk_size, char** exclude_patterns,
-void directory_scanner_destroy(DirectoryScanner *scanner);
+                                           int exclude_count, char** include_patterns,
+                                           int include_count, unsigned long long max_size,
+                                           unsigned long long min_size);
+Chunk* directory_scanner_next(DirectoryScanner* scanner);
+void directory_scanner_destroy(DirectoryScanner* scanner);
 
 #endif

src/server/server.c

@@ -1,15 +1,14 @@
 #include "array_list.h"
 #include "chunk.h"
-#include "compression.h"
 #include "config.h"
 #include "data.h"
 #include "file.h"
 #include "log.h"
-#include "metadata.h"
 #include "multiprocessing.h"
 #include "protocol.h"
 #include "queue.h"
 #include "transport_tcp.h"
+#include "transport_tls.h"
 #include "unistd.h"
 #include "utils.h"
 #include <signal.h>
@@ -17,108 +16,79 @@
 #include <stdlib.h>
 #include <string.h>
 
-int receive_files(Config *config, int file_descriptor) {
+int receive_files(Config* config, int fd) {
   Status status;
-  if (!receive_status(file_descriptor, &status)) return -1;
+  if (!receive_status(fd, &status))
-  while (status == STATUS_NEXT || status == STATUS_CHUNK) {
+    return -1;
-    if (status == STATUS_CHUNK) {
-      Data *chunk_data = receive_data(file_descriptor);
-      if (chunk_data == NULL) {
-        log_message(LOG_LEVEL_ERROR, "Failed to receive chunk data");
-        send_status(file_descriptor, STATUS_ERROR);
-        return -1;
-      }
-      Data *data_to_process = chunk_data;
-      if (config->use_compression) {
-        data_to_process = data_decompress(chunk_data);
-        data_destroy(chunk_data);
-        if (data_to_process == NULL) {
-          log_message(LOG_LEVEL_ERROR, "Failed to decompress chunk");
-          send_status(file_descriptor, STATUS_ERROR);
-          return -1;
-        }
-      }
-      Chunk *chunk = chunk_deserialize(data_to_process, config->use_metadata);
-      data_destroy(data_to_process);
-      if (chunk == NULL) {
-        log_message(LOG_LEVEL_ERROR, "Failed to deserialize chunk, skipping");
-        send_status(file_descriptor, STATUS_ERROR);
-        return -1;
-      }
 
+  while (status == STATUS_NEXT || status == STATUS_CHUNK || status == STATUS_CHECK) {
+    if (status == STATUS_CHECK) {
+      bool skipped;
+      File* file = receive_incremental_check(fd, config, &skipped);
+      if (skipped)
+        goto next;
+      if (file == NULL && !skipped)
+        return -1;
+      if (config->save_to_disk)
+        file_save_to_disk(config->receive_root_directory, file);
+      file_destroy(file);
+    } else if (status == STATUS_CHUNK) {
+      Chunk* chunk = receive_chunk_data(fd, config);
+      if (chunk == NULL) {
+        send_status(fd, STATUS_ERROR);
+        return -1;
+      }
       for (int i = 0; i < chunk->element_count; i++) {
-        if (config->save_to_disk) {
+        if (config->save_to_disk)
-          char *disk_path = path_cat(config->receive_root_directory, chunk->items[i]->path);
+          file_save_to_disk(config->receive_root_directory, chunk->items[i]);
-          if (disk_path) {
-            to_disk(disk_path, chunk->items[i]->data->data, chunk->items[i]->data->size);
-            file_restore_metadata(disk_path, chunk->items[i]->metadata);
-            free(disk_path);
-          }
-        }
       }
       chunk_destroy(chunk);
     } else {
-      File *file = file_receive(config, file_descriptor);
+      File* file = file_receive(config, fd);
       if (file == NULL) {
         log_message(LOG_LEVEL_ERROR, "Failed to receive file");
-        send_status(file_descriptor, STATUS_ERROR);
+        send_status(fd, STATUS_ERROR);
         return -1;
       }
-      if (config->save_to_disk) {
+      if (config->save_to_disk)
-        char *disk_path = path_cat(config->receive_root_directory, file->path);
+        file_save_to_disk(config->receive_root_directory, file);
-        if (disk_path) {
-          to_disk(disk_path, file->data->data, file->data->size);
-          file_restore_metadata(disk_path, file->metadata);
-          free(disk_path);
-        }
-      }
       file_destroy(file);
     }
-    if (!receive_status(file_descriptor, &status)) {
+  next:
-      send_status(file_descriptor, STATUS_ERROR);
+    if (!receive_status(fd, &status)) {
+      send_status(fd, STATUS_ERROR);
       return -1;
     }
   }
+
   if (status == STATUS_MANIFEST) {
-    int count;
+    if (receive_manifest(fd, config, &status) != 0)
-    if (!receive_int(file_descriptor, &count)) return -1;
+      return -1;
-    ArrayList *manifest = array_list_create(free);
-    if (manifest) {
-      for (int i = 0; i < count; i++) {
-        char *s = receive_str(file_descriptor);
-        if (s) array_list_add(manifest, s);
-      }
-      fprintf(stderr, "Deleting files not in manifest...\n");
-      delete_extras(config->receive_root_directory, manifest);
-      array_list_delete(manifest);
-    }
-    if (!receive_status(file_descriptor, &status)) return -1;
   }
   if (status != STATUS_FINISHED) {
     log_message(LOG_LEVEL_ERROR, "Did not receive FINISHED Status");
-    send_status(file_descriptor, STATUS_ERROR);
+    send_status(fd, STATUS_ERROR);
     return -1;
   }
-  send_status(file_descriptor, STATUS_OK);
+  send_status(fd, STATUS_OK);
   return 0;
 }
 
 void handler(int file_descriptor) {
-  Config *config = config_receive(file_descriptor);
+  Config* config = config_receive(file_descriptor);
   if (config == NULL) {
     log_message(LOG_LEVEL_ERROR, "Failed to receive config");
     close(file_descriptor);
     return;
   }
   if (config->use_multithreading) {
-    Queue *q = queue_create(100, file_destroy);
+    Queue* q = queue_create(100, file_destroy);
     if (q == NULL) {
       config_delete(config);
       close(file_descriptor);
       return;
     }
-    PipelineContextReceiver *context = pipeline_context_receiver_create(
+    PipelineContextReceiver* context = pipeline_context_receiver_create(config, q, file_descriptor);
-        config, q, file_descriptor);
     if (context == NULL) {
       queue_destroy(q);
       config_delete(config);
@@ -142,7 +112,7 @@ void handler(int file_descriptor) {
   close(file_descriptor);
 }
 
-static Server *g_server = NULL;
+static Server* g_server = NULL;
 
 static void cleanup(int sig) {
   (void)sig;
@@ -152,24 +122,88 @@ static void cleanup(int sig) {
   _exit(0);
 }
 
-int main(int argc, char *argv[]) {
+static void print_server_usage(void) {
+  printf("FastSync Server\n");
+  printf("Usage: fastsync-server [options]\n");
+  printf("\n");
+  printf("Options:\n");
+  printf("  --stdio             Run in stdio mode (SSH transport)\n");
+  printf("  -p <port>           TCP port (default: 8080, range: 1-65535)\n");
+  printf("  --tls               Enable TLS encryption\n");
+  printf("  --cert <path>       TLS certificate file (PEM)\n");
+  printf("  --key <path>        TLS private key file (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
+  printf("  -v, --verbose       Enable debug logging\n");
+  printf("  --help              Show this help\n");
+}
+
+int main(int argc, char* argv[]) {
+  bool use_tls = false;
+  char* tls_cert = NULL;
+  char* tls_key = NULL;
+  char* tls_ca = NULL;
+  int port = 8080;
+
   signal(SIGPIPE, SIG_IGN);
   for (int i = 1; i < argc; i++) {
-    if (strcmp(argv[i], "--stdio") == 0) {
+    if (strcmp(argv[i], "--help") == 0) {
+      print_server_usage();
+      return 0;
+    } else if (strcmp(argv[i], "--stdio") == 0) {
       io_set_fds(STDIN_FILENO, STDOUT_FILENO);
       handler(STDIN_FILENO);
       return 0;
     } else if (strcmp(argv[i], "-v") == 0 || strcmp(argv[i], "--verbose") == 0) {
       set_log_level(LOG_LEVEL_DEBUG);
+    } else if (strcmp(argv[i], "--tls") == 0) {
+      use_tls = true;
+    } else if (strcmp(argv[i], "--cert") == 0 && i + 1 < argc) {
+      tls_cert = argv[++i];
+    } else if (strcmp(argv[i], "--key") == 0 && i + 1 < argc) {
+      tls_key = argv[++i];
+    } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
+      tls_ca = argv[++i];
+    } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
+      char* end;
+      long p = strtol(argv[++i], &end, 10);
+      if (*end || p <= 0 || p > 65535) {
+        fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n", argv[i]);
+        return 1;
+      }
+      port = (int)p;
+    } else if (argv[i][0] == '-') {
+      fprintf(stderr, "Unknown option: %s\n", argv[i]);
+      print_server_usage();
+      return 1;
     }
   }
+
+  if (tls_ca && !use_tls) {
+    log_message(LOG_LEVEL_WARNING, "--ca has no effect without --tls");
+  }
+
   signal(SIGINT, cleanup);
   signal(SIGTERM, cleanup);
-  g_server = server_create(8080);
+  g_server = server_create(port);
   if (g_server == NULL) {
     log_message(LOG_LEVEL_ERROR, "Failed to create server");
     return 1;
   }
-  server_listen(g_server, handler);
+  if (use_tls) {
+    if (!tls_cert || !tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      server_delete(&g_server);
+      return 1;
+    }
+    tls_global_init();
+    if (!server_create_tls(g_server, tls_cert, tls_key, tls_ca)) {
+      log_message(LOG_LEVEL_ERROR, "Failed to set up TLS");
+      server_delete(&g_server);
+      return 1;
+    }
+    server_listen_tls(g_server, handler);
+  } else {
+    server_listen(g_server, handler);
+  }
   return 0;
 }

src/shared/array_list.c

@@ -3,14 +3,14 @@
 #include <stdlib.h>
 #include <string.h>
 
-ArrayList *array_list_create(void (*item_destroyer)(void *item)) {
+ArrayList* array_list_create(void (*item_destroyer)(void* item)) {
-  ArrayList *list = (ArrayList *)malloc(sizeof(ArrayList));
+  ArrayList* list = (ArrayList*)malloc(sizeof(ArrayList));
   if (list == NULL) {
     perror("ERROR: Could not allocate memory for array list struct");
     return NULL;
   }
 
-  list->items = malloc(INITIAL_ARRAY_SIZE * sizeof(void *));
+  list->items = malloc(INITIAL_ARRAY_SIZE * sizeof(void*));
   if (list->items == NULL) {
     free(list);
     return NULL;
@@ -21,7 +21,7 @@ ArrayList *array_list_create(void (*item_destroyer)(void *item)) {
   return list;
 }
 
-void array_list_delete(ArrayList *array_list) {
+void array_list_delete(ArrayList* array_list) {
   if (array_list == NULL)
     return;
   if (array_list->item_destroyer != NULL) {
@@ -34,12 +34,13 @@ void array_list_delete(ArrayList *array_list) {
   free(array_list);
 }
 
-bool array_list_extend(ArrayList *array_list) {
+bool array_list_extend(ArrayList* array_list) {
-  if (array_list == NULL) return false;
+  if (array_list == NULL)
+    return false;
   int new_capacity = array_list->capacity * 2;
   if (new_capacity == 0)
     new_capacity = INITIAL_ARRAY_SIZE;
-  void *new_items = realloc(array_list->items, new_capacity * sizeof(void *));
+  void* new_items = realloc(array_list->items, new_capacity * sizeof(void*));
   if (new_items == NULL) {
     perror("ERROR: Could not reallocate memory for array list items");
     return false;
@@ -49,8 +50,9 @@ bool array_list_extend(ArrayList *array_list) {
   return true;
 }
 
-bool array_list_add(ArrayList *array_list, void *item) {
+bool array_list_add(ArrayList* array_list, void* item) {
-  if (array_list == NULL) return false;
+  if (array_list == NULL)
+    return false;
   if (array_list->capacity == array_list->size) {
     if (!array_list_extend(array_list))
       return false;
@@ -60,15 +62,15 @@ bool array_list_add(ArrayList *array_list, void *item) {
   return true;
 }
 
-void **array_list_to_array(ArrayList *array_list) {
+void** array_list_to_array(const ArrayList* array_list) {
   if (array_list == NULL) {
     return NULL;
   }
-  void **array = malloc(array_list->size * sizeof(void *));
+  void** array = malloc(array_list->size * sizeof(void*));
   if (array == NULL) {
     perror("Could not malloc space for array from array list!");
     return NULL;
   }
-  memcpy(array, array_list->items, array_list->size * sizeof(void *));
+  memcpy(array, array_list->items, array_list->size * sizeof(void*));
   return array;
 }

src/shared/array_list.h

@@ -6,16 +6,16 @@
 #define INITIAL_ARRAY_SIZE 100
 
 typedef struct ArrayList {
-  void **items;
+  void** items;
   int size;
   int capacity;
-  void (*item_destroyer)(void *item);
+  void (*item_destroyer)(void* item);
 } ArrayList;
 
-ArrayList *array_list_create(void (*item_destroyer)(void *item));
+ArrayList* array_list_create(void (*item_destroyer)(void* item));
-void array_list_delete(ArrayList *array_list);
+void array_list_delete(ArrayList* array_list);
-bool array_list_extend(ArrayList *array_list);
+bool array_list_extend(ArrayList* array_list);
-bool array_list_add(ArrayList *array_list, void *item);
+bool array_list_add(ArrayList* array_list, void* item);
-void **array_list_to_array(ArrayList *array_list);
+void** array_list_to_array(const ArrayList* array_list);
 
 #endif

src/shared/chunk.c

@@ -10,15 +10,16 @@
 #include "file.h"
 #include "log.h"
 #include "metadata.h"
+#include "protocol.h"
 
-Chunk *chunk_create(File **items, int element_count) {
+Chunk* chunk_create(File** items, int element_count) {
-  Chunk *chunk = (Chunk *)malloc(sizeof(Chunk));
+  Chunk* chunk = (Chunk*)malloc(sizeof(Chunk));
   if (chunk == NULL) {
     perror("ERROR: Could not allocate memory for chunk structure");
     return NULL;
   }
 
-  chunk->items = (File **)malloc(element_count * sizeof(File *));
+  chunk->items = (File**)malloc(element_count * sizeof(File*));
   if (chunk->items == NULL) {
     free(chunk);
     return NULL;
@@ -31,11 +32,11 @@ Chunk *chunk_create(File **items, int element_count) {
   return chunk;
 }
 
-void chunk_destroy(void *item) {
+void chunk_destroy(void* item) {
   if (item == NULL) {
     return;
   }
-  Chunk *chunk = (Chunk *)item;
+  Chunk* chunk = (Chunk*)item;
   for (int i = 0; i < chunk->element_count; ++i) {
     if (chunk->items[i] != NULL) {
       file_destroy(chunk->items[i]);
@@ -45,26 +46,25 @@ void chunk_destroy(void *item) {
   free(chunk);
 }
 
-static unsigned long long per_file_serialize_size(File *file, bool use_metadata) {
+static unsigned long long per_file_serialize_size(File* file, bool use_metadata) {
   return sizeof(size_t) + strlen(file->path) +
          (use_metadata ? sizeof(int) + (file->metadata ? FILE_METADATA_WIRE_SIZE : 0) : 0) +
          sizeof(size_t) + file->data->size;
 }
 
-Data *chunk_serialize(Chunk *chunk, bool use_metadata) {
+Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
   unsigned long long data_size = 0;
   for (int i = 0; i < chunk->element_count; i++) {
     data_size += per_file_serialize_size(chunk->items[i], use_metadata);
   }
-  Data *data = data_create_empty(data_size);
+  Data* data = data_create_empty(data_size);
   if (data == NULL) {
-    log_message(LOG_LEVEL_ERROR,
+    log_message(LOG_LEVEL_ERROR, "Could not allocate memory for chunk serialization");
-                "Could not allocate memory for chunk serialization");
     return NULL;
   }
-  char *data_pointer = data->data;
+  char* data_pointer = data->data;
   for (int i = 0; i < chunk->element_count; i++) {
-    File *file = chunk->items[i];
+    File* file = chunk->items[i];
     size_t path_len = strlen(file->path);
     memcpy(data_pointer, &path_len, sizeof(size_t));
     data_pointer += sizeof(size_t);
@@ -83,9 +83,9 @@ Data *chunk_serialize(Chunk *chunk, bool use_metadata) {
   return data;
 }
 
-Chunk *chunk_deserialize(Data *data, bool use_metadata) {
+Chunk* chunk_deserialize(Data* data, bool use_metadata) {
-  ArrayList *files = array_list_create(file_destroy);
+  ArrayList* files = array_list_create(file_destroy);
-  char *data_pointer = data->data;
+  char* data_pointer = data->data;
   size_t remaining_size = data->size;
 
   while (remaining_size > 0) {
@@ -95,7 +95,7 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
       return NULL;
     }
 
-    size_t path_len = *(size_t *)data_pointer;
+    size_t path_len = *(size_t*)data_pointer;
     data_pointer += sizeof(size_t);
     remaining_size -= sizeof(size_t);
 
@@ -105,7 +105,7 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
       return NULL;
     }
 
-    char *path = malloc(path_len + 1);
+    char* path = malloc(path_len + 1);
     if (path == NULL) {
       perror("Could not allocate memory for file path");
       array_list_delete(files);
@@ -116,7 +116,7 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
     data_pointer += path_len;
     remaining_size -= path_len;
 
-    File *file = file_create(path);
+    File* file = file_create(path);
     free(path);
 
     if (use_metadata) {
@@ -132,7 +132,7 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
       return NULL;
     }
 
-    size_t file_data_size = *(size_t *)data_pointer;
+    size_t file_data_size = *(size_t*)data_pointer;
     data_pointer += sizeof(size_t);
     remaining_size -= sizeof(size_t);
 
@@ -142,7 +142,7 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
       return NULL;
     }
 
-    void *file_data = malloc(file_data_size);
+    void* file_data = malloc(file_data_size);
     if (file_data == NULL) {
       perror("Could not allocate memory for file data");
       array_list_delete(files);
@@ -157,8 +157,8 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
     array_list_add(files, file);
   }
 
-  File **file_array = (File **)array_list_to_array(files);
+  File** file_array = (File**)array_list_to_array(files);
-  Chunk *chunk = chunk_create(file_array, files->size);
+  Chunk* chunk = chunk_create(file_array, files->size);
 
   free(file_array);
   files->item_destroyer = NULL;
@@ -167,16 +167,37 @@ Chunk *chunk_deserialize(Data *data, bool use_metadata) {
   return chunk;
 }
 
-Data *chunk_compress(Chunk *chunk, int compression_level, bool use_metadata) {
+Data* chunk_compress(Chunk* chunk, int compression_level, bool use_metadata) {
   log_message(LOG_LEVEL_DEBUG, "Starting to compress chunk");
-  Data *serialized = chunk_serialize(chunk, use_metadata);
+  Data* serialized = chunk_serialize(chunk, use_metadata);
-  if (serialized == NULL) return NULL;
+  if (serialized == NULL)
-  Data *compressed = data_compress(serialized, compression_level);
+    return NULL;
+  Data* compressed = data_compress(serialized, compression_level);
   data_destroy(serialized);
-  if (compressed == NULL) return NULL;
+  if (compressed == NULL)
+    return NULL;
   log_message(LOG_LEVEL_DEBUG, "Chunk successfully compressed");
   return compressed;
 }
 
-
+Chunk* receive_chunk_data(int fd, const Config* config) {
-
+  Data* chunk_data = receive_data(fd);
+  if (chunk_data == NULL) {
+    log_message(LOG_LEVEL_ERROR, "Failed to receive chunk data");
+    return NULL;
+  }
+  Data* data_to_process = chunk_data;
+  if (config->use_compression) {
+    data_to_process = data_decompress(chunk_data);
+    data_destroy(chunk_data);
+    if (data_to_process == NULL) {
+      log_message(LOG_LEVEL_ERROR, "Failed to decompress chunk");
+      return NULL;
+    }
+  }
+  Chunk* chunk = chunk_deserialize(data_to_process, config->use_metadata);
+  data_destroy(data_to_process);
+  if (chunk == NULL)
+    log_message(LOG_LEVEL_ERROR, "Failed to deserialize chunk, skipping");
+  return chunk;
+}

src/shared/chunk.h

@@ -1,6 +1,7 @@
 #ifndef CHUNK_H
 #define CHUNK_H
 
+#include "config.h"
 #include "data.h"
 #include "file.h"
 #include <stdbool.h>
@@ -9,14 +10,15 @@
 #define DESIRED_CHUNK_SIZE (10 * 1024 * 1024)
 
 typedef struct {
-  File **items;
+  File** items;
   int element_count;
 } Chunk;
 
-Chunk *chunk_create(File **items, int element_count);
+Chunk* chunk_create(File** items, int element_count);
-void chunk_destroy(void *chunk);
+void chunk_destroy(void* chunk);
-Data *chunk_serialize(Chunk *chunk, bool use_metadata);
+Data* chunk_serialize(Chunk* chunk, bool use_metadata);
-Chunk *chunk_deserialize(Data *data, bool use_metadata);
+Chunk* chunk_deserialize(Data* data, bool use_metadata);
-Data *chunk_compress(Chunk *chunk, int compression_level, bool use_metadata);
+Data* chunk_compress(Chunk* chunk, int compression_level, bool use_metadata);
+Chunk* receive_chunk_data(int fd, const Config* config);
 
 #endif

src/shared/compression.c

@@ -6,13 +6,15 @@
 
 #define INITIAL_DECOMPRESS_BUF_SIZE (1024 * 1024)
 
-Data *data_compress(Data *data_to_compress, int compression_level) {
+Data* data_compress(Data* data_to_compress, int compression_level) {
+  (void)compression_level;
   log_message(LOG_LEVEL_DEBUG, "Starting to compress data");
   size_t dst_size = ZSTD_compressBound(data_to_compress->size);
-  Data *compressed_data = data_create_empty(dst_size);
+  Data* compressed_data = data_create_empty(dst_size);
-  if (compressed_data == NULL) return NULL;
+  if (compressed_data == NULL)
+    return NULL;
 
-  ZSTD_CCtx *cctx = ZSTD_createCCtx();
+  ZSTD_CCtx* cctx = ZSTD_createCCtx();
   if (!cctx) {
     log_message(LOG_LEVEL_ERROR, "Failed to create ZSTD compression context");
     data_destroy(compressed_data);
@@ -26,8 +28,7 @@ Data *data_compress(Data *data_to_compress, int compression_level) {
   do {
     ret = ZSTD_compressStream2(cctx, &output, &input, ZSTD_e_end);
     if (ZSTD_isError(ret)) {
-      log_message(LOG_LEVEL_ERROR, "Compression failed: %s",
+      log_message(LOG_LEVEL_ERROR, "Compression failed: %s", ZSTD_getErrorName(ret));
-                  ZSTD_getErrorName(ret));
       ZSTD_freeCCtx(cctx);
       data_destroy(compressed_data);
       return NULL;
@@ -42,27 +43,25 @@ Data *data_compress(Data *data_to_compress, int compression_level) {
   return compressed_data;
 }
 
-Data *data_decompress(Data *compressed_data) {
+Data* data_decompress(Data* compressed_data) {
   log_message(LOG_LEVEL_DEBUG, "Start to decompress data");
-  unsigned long long dst_size = ZSTD_getFrameContentSize(
+  unsigned long long dst_size =
-      compressed_data->data, compressed_data->size);
+      ZSTD_getFrameContentSize(compressed_data->data, compressed_data->size);
   if (ZSTD_isError(dst_size)) {
     log_message(LOG_LEVEL_ERROR, "Failed to get decompressed size: %s",
                 ZSTD_getErrorName(dst_size));
     return NULL;
   }
 
-  ZSTD_DCtx *dctx = ZSTD_createDCtx();
+  ZSTD_DCtx* dctx = ZSTD_createDCtx();
   if (!dctx) {
-    log_message(LOG_LEVEL_ERROR,
+    log_message(LOG_LEVEL_ERROR, "Failed to create ZSTD decompression context");
-                "Failed to create ZSTD decompression context");
     return NULL;
   }
 
-  size_t buf_size = (!ZSTD_isError(dst_size) && dst_size > 0)
+  size_t buf_size =
-                        ? (size_t)dst_size
+      (!ZSTD_isError(dst_size) && dst_size > 0) ? (size_t)dst_size : INITIAL_DECOMPRESS_BUF_SIZE;
-                        : INITIAL_DECOMPRESS_BUF_SIZE;
+  Data* uncompressed_data = data_create_empty(buf_size);
-  Data *uncompressed_data = data_create_empty(buf_size);
   if (!uncompressed_data) {
     log_message(LOG_LEVEL_ERROR, "Failed to allocate decompression buffer");
     ZSTD_freeDCtx(dctx);
@@ -76,15 +75,14 @@ Data *data_decompress(Data *compressed_data) {
   do {
     ret = ZSTD_decompressStream(dctx, &output, &input);
     if (ZSTD_isError(ret)) {
-      log_message(LOG_LEVEL_ERROR, "Decompression failed: %s",
+      log_message(LOG_LEVEL_ERROR, "Decompression failed: %s", ZSTD_getErrorName(ret));
-                  ZSTD_getErrorName(ret));
       ZSTD_freeDCtx(dctx);
       data_destroy(uncompressed_data);
       return NULL;
     }
     if (ret > 0 && output.pos == output.size) {
       buf_size *= 2;
-      void *new_data = realloc(uncompressed_data->data, buf_size);
+      void* new_data = realloc(uncompressed_data->data, buf_size);
       if (!new_data) {
         log_message(LOG_LEVEL_ERROR, "Failed to grow decompression buffer");
         ZSTD_freeDCtx(dctx);

src/shared/compression.h

@@ -3,7 +3,7 @@
 
 #include "data.h"
 
-Data *data_compress(Data *data_to_compress, int compression_level);
+Data* data_compress(Data* data_to_compress, int compression_level);
-Data *data_decompress(Data *compressed_data);
+Data* data_decompress(Data* compressed_data);
 
 #endif

src/shared/config.c

@@ -1,4 +1,5 @@
 #include "config.h"
+#include "delta.h"
 #include "log.h"
 #include "protocol.h"
 #include "utils.h"
@@ -7,14 +8,12 @@
 #include <stdlib.h>
 #include <string.h>
 
-Config *config_create(char *version, char *send_directory,
+Config* config_create(char* version, char* send_directory, char* receive_directory,
-                      char *receive_directory, bool save_to_disk,
+                      bool save_to_disk, bool use_multithreading, bool use_chunk_serialization,
-                      bool use_multithreading, bool use_chunk_serialization,
+                      bool use_compression, bool use_metadata, int compression_level,
-                       bool use_compression, bool use_metadata,
+                      bool use_sendfile, unsigned long long chunk_size) {
-                       int compression_level, bool use_sendfile,
-                       unsigned long long chunk_size) {
 
-  Config *config = malloc(sizeof(Config));
+  Config* config = malloc(sizeof(Config));
   config->version = version;
   config->send_directory = send_directory;
   config->receive_root_directory = receive_directory;
@@ -38,31 +37,44 @@ Config *config_create(char *version, char *send_directory,
   config->include_count = 0;
   config->max_size = 0;
   config->min_size = 0;
+  config->use_incremental = false;
+  config->use_delta = false;
+  config->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
+  config->delta_max_file_size = DELTA_MAX_FILE_SIZE;
+  config->use_tls = false;
+  config->tls_cert = NULL;
+  config->tls_key = NULL;
+  config->tls_ca = NULL;
   return config;
 }
 
-bool is_remote_dest(const char *s) {
+bool is_remote_dest(const char* s) {
-  if (s == NULL) return false;
+  if (s == NULL)
-  const char *colon = strchr(s, ':');
+    return false;
-  if (colon == NULL) return false;
+  const char* colon = strchr(s, ':');
-  if (colon == s) return false;
+  if (colon == NULL)
-  for (const char *p = s; p < colon; p++) {
+    return false;
-    if (*p == '/') return false;
+  if (colon == s)
+    return false;
+  for (const char* p = s; p < colon; p++) {
+    if (*p == '/')
+      return false;
   }
   return true;
 }
 
-void config_parse_ssh_dest(Config *config) {
+void config_parse_ssh_dest(Config* config) {
-  if (!is_remote_dest(config->receive_root_directory)) return;
+  if (!is_remote_dest(config->receive_root_directory))
+    return;
   config->transport = TRANSPORT_SSH;
   config->ssh_destination = str_dup(config->receive_root_directory);
-  char *colon = strchr(config->receive_root_directory, ':');
+  const char* colon = strchr(config->receive_root_directory, ':');
-  char *path = str_dup(colon + 1);
+  char* path = str_dup(colon + 1);
   free(config->receive_root_directory);
   config->receive_root_directory = path;
 }
 
-void config_delete(Config *config) {
+void config_delete(Config* config) {
   free(config->version);
   free(config->send_directory);
   free(config->receive_root_directory);
@@ -73,24 +85,48 @@ void config_delete(Config *config) {
   for (int i = 0; i < config->include_count; i++)
     free(config->include_patterns[i]);
   free(config->include_patterns);
+  free(config->tls_cert);
+  free(config->tls_key);
+  free(config->tls_ca);
   free(config);
 }
 
-bool config_send(int file_descriptor, Config *config) {
+bool config_send(int file_descriptor, const Config* config) {
-  if (!send_str(file_descriptor, config->version)) return false;
+  if (!send_str(file_descriptor, config->version))
-  if (!send_str(file_descriptor, config->send_directory)) return false;
+    return false;
-  if (!send_str(file_descriptor, config->receive_root_directory)) return false;
+  if (!send_str(file_descriptor, config->send_directory))
-  if (!send_int(file_descriptor, config->save_to_disk)) return false;
+    return false;
-  if (!send_int(file_descriptor, config->use_multithreading)) return false;
+  if (!send_str(file_descriptor, config->receive_root_directory))
-  if (!send_int(file_descriptor, config->use_chunk_serialization)) return false;
+    return false;
-  if (!send_int(file_descriptor, config->use_compression)) return false;
+  if (!send_int(file_descriptor, config->save_to_disk))
-  if (!send_int(file_descriptor, config->use_metadata)) return false;
+    return false;
-  if (!send_int(file_descriptor, config->compression_level)) return false;
+  if (!send_int(file_descriptor, config->use_multithreading))
-  if (!send_int(file_descriptor, (int)config->chunk_size)) return false;
+    return false;
-  if (!send_int(file_descriptor, config->use_sendfile)) return false;
+  if (!send_int(file_descriptor, config->use_chunk_serialization))
-  if (!send_int(file_descriptor, config->use_delete)) return false;
+    return false;
+  if (!send_int(file_descriptor, config->use_compression))
+    return false;
+  if (!send_int(file_descriptor, config->use_metadata))
+    return false;
+  if (!send_int(file_descriptor, config->compression_level))
+    return false;
+  if (!send_int(file_descriptor, (int)config->chunk_size))
+    return false;
+  if (!send_int(file_descriptor, config->use_sendfile))
+    return false;
+  if (!send_int(file_descriptor, config->use_delete))
+    return false;
+  if (!send_int(file_descriptor, config->use_incremental))
+    return false;
+  if (!send_int(file_descriptor, config->use_delta))
+    return false;
+  if (!send_int(file_descriptor, (int)config->delta_block_size))
+    return false;
+  if (!send_n_data(file_descriptor, &config->delta_max_file_size, sizeof(unsigned long long)))
+    return false;
   Status status;
-  if (!receive_status(file_descriptor, &status)) return false;
+  if (!receive_status(file_descriptor, &status))
+    return false;
   if (status != STATUS_OK) {
     log_message(LOG_LEVEL_ERROR, "Error transmitting config");
     return false;
@@ -98,42 +134,75 @@ bool config_send(int file_descriptor, Config *config) {
   return true;
 }
 
-Config *config_receive(int file_descriptor) {
+Config* config_receive(int file_descriptor) {
-  Config *config = (Config *)malloc(sizeof(Config));
+  Config* config = (Config*)malloc(sizeof(Config));
-  if (config == NULL) return NULL;
+  if (config == NULL)
+    return NULL;
   config->version = receive_str(file_descriptor);
-  if (!config->version) { free(config); return NULL; }
+  if (!config->version) {
+    free(config);
+    return NULL;
+  }
   if (strcmp(config->version, PROTOCOL_VERSION) != 0) {
-    fprintf(stderr, "Protocol version mismatch: client=%s, server=%s\n",
+    fprintf(stderr, "Protocol version mismatch: client=%s, server=%s\n", config->version,
-            config->version, PROTOCOL_VERSION);
+            PROTOCOL_VERSION);
     free(config->version);
     free(config);
     send_status(file_descriptor, STATUS_ERROR);
     return NULL;
   }
   config->send_directory = receive_str(file_descriptor);
-  if (!config->send_directory) { free(config->version); free(config); return NULL; }
+  if (!config->send_directory) {
+    free(config->version);
+    free(config);
+    return NULL;
+  }
   config->receive_root_directory = receive_str(file_descriptor);
-  if (!config->receive_root_directory) { free(config->version); free(config->send_directory); free(config); return NULL; }
+  if (!config->receive_root_directory) {
+    free(config->version);
+    free(config->send_directory);
+    free(config);
+    return NULL;
+  }
   int tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->save_to_disk = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->use_multithreading = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->use_chunk_serialization = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->use_compression = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->use_metadata = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->compression_level = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->chunk_size = (unsigned long long)tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->use_sendfile = tmp;
-  if (!receive_int(file_descriptor, &tmp)) goto error;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
   config->use_delete = tmp;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
+  config->use_incremental = tmp;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
+  config->use_delta = tmp;
+  if (!receive_int(file_descriptor, &tmp))
+    goto error;
+  config->delta_block_size = (uint32_t)tmp;
+  if (!receive_n_data(file_descriptor, &config->delta_max_file_size, sizeof(unsigned long long)))
+    goto error;
   config->show_progress = false;
   config->dry_run = false;
   config->ssh_port = 22;
@@ -145,7 +214,12 @@ Config *config_receive(int file_descriptor) {
   config->include_count = 0;
   config->max_size = 0;
   config->min_size = 0;
-  if (!send_status(file_descriptor, STATUS_OK)) goto error;
+  config->use_tls = false;
+  config->tls_cert = NULL;
+  config->tls_key = NULL;
+  config->tls_ca = NULL;
+  if (!send_status(file_descriptor, STATUS_OK))
+    goto error;
   return config;
 
 error:

src/shared/config.h

@@ -2,16 +2,14 @@
 #define CONFIG_H
 
 #include <stdbool.h>
+#include <stdint.h>
 
-typedef enum {
+typedef enum { TRANSPORT_TCP, TRANSPORT_SSH } TransportType;
-  TRANSPORT_TCP,
-  TRANSPORT_SSH
-} TransportType;
 
 typedef struct Config {
-  char *version;
+  char* version;
-  char *send_directory;
+  char* send_directory;
-  char *receive_root_directory;
+  char* receive_root_directory;
   bool save_to_disk;
   bool use_multithreading;
   bool use_chunk_serialization;
@@ -25,28 +23,34 @@ typedef struct Config {
   unsigned long long chunk_size;
   int ssh_port;
   TransportType transport;
-  char *ssh_destination;
+  char* ssh_destination;
-  char **exclude_patterns;
+  char** exclude_patterns;
   int exclude_count;
-  char **include_patterns;
+  char** include_patterns;
   int include_count;
   unsigned long long max_size;
   unsigned long long min_size;
+  bool use_incremental;
+  bool use_delta;
+  uint32_t delta_block_size;
+  unsigned long long delta_max_file_size;
+  bool use_tls;
+  char* tls_cert;
+  char* tls_key;
+  char* tls_ca;
 } Config;
 
-#define PROTOCOL_VERSION "1.0.0"
+#define PROTOCOL_VERSION "1.2.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 
-Config *config_create(char *version, char *send_directory,
+Config* config_create(char* version, char* send_directory, char* receive_directory,
-                      char *receive_directory, bool save_to_disk,
+                      bool save_to_disk, bool use_multithreading, bool use_chunk_serialization,
-                      bool use_multithreading, bool use_chunk_serialization,
+                      bool use_compression, bool use_metadata, int compression_level,
-                       bool use_compression, bool use_metadata,
+                      bool use_sendfile, unsigned long long chunk_size);
-                       int compression_level, bool use_sendfile,
+void config_delete(Config* config);
-                       unsigned long long chunk_size);
+bool config_send(int file_descriptor, const Config* config);
-void config_delete(Config *config);
+Config* config_receive(int file_descriptor);
-bool config_send(int file_descriptor, Config *config);
+bool is_remote_dest(const char* s);
-Config *config_receive(int file_descriptor);
+void config_parse_ssh_dest(Config* config);
-bool is_remote_dest(const char *s);
-void config_parse_ssh_dest(Config *config);
 
 #endif

src/shared/data.c

@@ -2,8 +2,8 @@
 #include "log.h"
 #include "stdlib.h"
 
-Data *data_create_empty(size_t data_size) {
+Data* data_create_empty(size_t data_size) {
-  void *data = malloc(data_size);
+  void* data = malloc(data_size);
   if (data == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for empty data");
     return NULL;
@@ -11,8 +11,8 @@ Data *data_create_empty(size_t data_size) {
   return data_create(data, data_size);
 }
 
-Data *data_create_reserve(size_t size) {
+Data* data_create_reserve(size_t size) {
-  Data *d = malloc(sizeof(Data));
+  Data* d = malloc(sizeof(Data));
   if (d == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for data");
     return NULL;
@@ -22,8 +22,8 @@ Data *data_create_reserve(size_t size) {
   return d;
 }
 
-Data *data_create(void *data, size_t data_size) {
+Data* data_create(void* data, size_t data_size) {
-  Data *new_data = malloc(sizeof(Data));
+  Data* new_data = malloc(sizeof(Data));
   if (new_data == NULL) {
     log_message(LOG_LEVEL_ERROR, "Could not allocate memory for data");
     free(data);
@@ -34,8 +34,9 @@ Data *data_create(void *data, size_t data_size) {
   return new_data;
 }
 
-void data_destroy(Data *data) {
+void data_destroy(Data* data) {
-  if (data == NULL) return;
+  if (data == NULL)
+    return;
   free(data->data);
   free(data);
 }

src/shared/data.h

@@ -4,13 +4,13 @@
 #include "stdlib.h"
 
 typedef struct {
-  void *data;
+  void* data;
   size_t size;
 } Data;
 
-Data *data_create_empty(size_t data_size);
+Data* data_create_empty(size_t data_size);
-Data *data_create_reserve(size_t size);
+Data* data_create_reserve(size_t size);
-Data *data_create(void *data, size_t data_size);
+Data* data_create(void* data, size_t data_size);
-void data_destroy(Data *data);
+void data_destroy(Data* data);
 
 #endif

src/shared/delta.c

@@ -0,0 +1,503 @@
+#include "delta.h"
+#include "log.h"
+#include <stdlib.h>
+#include <string.h>
+
+#define XXH_STATIC_LINKING_ONLY
+#define XXH_IMPLEMENTATION
+#include <xxhash.h>
+
+uint32_t delta_adler32(const void* data, uint32_t len) {
+  const uint8_t* p = (const uint8_t*)data;
+  uint32_t s1 = 1;
+  uint32_t s2 = 0;
+  for (uint32_t i = 0; i < len; i++) {
+    s1 = (s1 + p[i]) % DELTA_ADLER32_MODULUS;
+    s2 = (s2 + s1) % DELTA_ADLER32_MODULUS;
+  }
+  return (s2 << 16) | s1;
+}
+
+uint32_t delta_xxhash32(const void* data, uint32_t len) {
+  return XXH32(data, len, 0);
+}
+
+DeltaSignature* delta_signature_create(const void* old_file_data, uint64_t old_file_size,
+                                       uint32_t block_size) {
+  if (old_file_data == NULL || old_file_size == 0 || block_size == 0)
+    return NULL;
+
+  uint32_t block_count = (uint32_t)((old_file_size + block_size - 1) / block_size);
+
+  DeltaSignature* sig = malloc(sizeof(DeltaSignature));
+  if (!sig)
+    return NULL;
+
+  sig->file_size = old_file_size;
+  sig->block_size = block_size;
+  sig->block_count = block_count;
+  sig->blocks = malloc(block_count * sizeof(DeltaBlockSig));
+  if (!sig->blocks) {
+    free(sig);
+    return NULL;
+  }
+
+  const uint8_t* data = (const uint8_t*)old_file_data;
+  for (uint32_t i = 0; i < block_count; i++) {
+    uint64_t offset = (uint64_t)i * block_size;
+    uint32_t len =
+        (uint32_t)((old_file_size - offset < block_size) ? (old_file_size - offset) : block_size);
+    sig->blocks[i].adler32 = delta_adler32(data + offset, len);
+    sig->blocks[i].xxhash = delta_xxhash32(data + offset, len);
+  }
+
+  return sig;
+}
+
+Data* delta_signature_serialize(const DeltaSignature* sig) {
+  if (!sig)
+    return NULL;
+
+  uint64_t total = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) +
+                   (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
+
+  uint8_t* buf = malloc((size_t)total);
+  if (!buf)
+    return NULL;
+
+  size_t pos = 0;
+  memcpy(buf + pos, &sig->file_size, sizeof(uint64_t));
+  pos += sizeof(uint64_t);
+  memcpy(buf + pos, &sig->block_size, sizeof(uint32_t));
+  pos += sizeof(uint32_t);
+  memcpy(buf + pos, &sig->block_count, sizeof(uint32_t));
+  pos += sizeof(uint32_t);
+
+  for (uint32_t i = 0; i < sig->block_count; i++) {
+    memcpy(buf + pos, &sig->blocks[i].adler32, sizeof(uint32_t));
+    pos += sizeof(uint32_t);
+    memcpy(buf + pos, &sig->blocks[i].xxhash, sizeof(uint32_t));
+    pos += sizeof(uint32_t);
+  }
+
+  return data_create(buf, (size_t)total);
+}
+
+DeltaSignature* delta_signature_deserialize(const Data* data) {
+  if (!data || data->size < sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t))
+    return NULL;
+
+  const uint8_t* buf = (const uint8_t*)data->data;
+  size_t pos = 0;
+
+  DeltaSignature* sig = malloc(sizeof(DeltaSignature));
+  if (!sig)
+    return NULL;
+
+  memcpy(&sig->file_size, buf + pos, sizeof(uint64_t));
+  pos += sizeof(uint64_t);
+  memcpy(&sig->block_size, buf + pos, sizeof(uint32_t));
+  pos += sizeof(uint32_t);
+  memcpy(&sig->block_count, buf + pos, sizeof(uint32_t));
+  pos += sizeof(uint32_t);
+
+  uint64_t expected = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) +
+                      (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
+  if (data->size < expected) {
+    free(sig);
+    return NULL;
+  }
+
+  sig->blocks = malloc(sig->block_count * sizeof(DeltaBlockSig));
+  if (!sig->blocks) {
+    free(sig);
+    return NULL;
+  }
+
+  for (uint32_t i = 0; i < sig->block_count; i++) {
+    memcpy(&sig->blocks[i].adler32, buf + pos, sizeof(uint32_t));
+    pos += sizeof(uint32_t);
+    memcpy(&sig->blocks[i].xxhash, buf + pos, sizeof(uint32_t));
+    pos += sizeof(uint32_t);
+  }
+
+  return sig;
+}
+
+void delta_signature_destroy(DeltaSignature* sig) {
+  if (!sig)
+    return;
+  free(sig->blocks);
+  free(sig);
+}
+
+static bool ensure_capacity(DeltaInstruction** instrs, uint32_t* capacity, uint32_t count) {
+  if (count < *capacity)
+    return true;
+  uint32_t new_cap = *capacity * 2;
+  DeltaInstruction* tmp = realloc(*instrs, new_cap * sizeof(DeltaInstruction));
+  if (!tmp)
+    return false;
+  *instrs = tmp;
+  *capacity = new_cap;
+  return true;
+}
+
+static bool flush_literal(DeltaInstruction** instrs, uint32_t* capacity, uint32_t* count,
+                          const uint8_t* data, uint64_t start, uint64_t end) {
+  if (start >= end)
+    return true;
+  uint32_t lit_len = (uint32_t)(end - start);
+  if (!ensure_capacity(instrs, capacity, *count))
+    return false;
+  uint8_t* lit_data = malloc(lit_len);
+  if (!lit_data)
+    return false;
+  memcpy(lit_data, data + start, lit_len);
+  (*instrs)[*count].type = DELTA_INSTR_LITERAL;
+  (*instrs)[*count].literal.data = lit_data;
+  (*instrs)[*count].literal.length = lit_len;
+  (*count)++;
+  return true;
+}
+
+Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const DeltaSignature* sig,
+                     uint32_t block_size) {
+  if (!new_file_data || !sig || new_file_size == 0 || block_size == 0)
+    return NULL;
+
+  const uint8_t* new_data = (const uint8_t*)new_file_data;
+
+  uint32_t capacity = 64;
+  uint32_t count = 0;
+  DeltaInstruction* instrs = malloc(capacity * sizeof(DeltaInstruction));
+  if (!instrs)
+    return NULL;
+
+  uint64_t literal_start = 0;
+  bool has_literal = false;
+
+  uint64_t i = 0;
+
+  uint32_t s1 = 1, s2 = 0;
+  bool rolling_valid = false;
+
+  while (i < new_file_size) {
+    uint32_t window_len =
+        (uint32_t)((new_file_size - i < block_size) ? (new_file_size - i) : block_size);
+    bool full_window = (window_len == block_size);
+
+    uint32_t adler;
+    if (rolling_valid && full_window) {
+      uint8_t old_byte = new_data[i - 1];
+      uint8_t new_byte = new_data[i + block_size - 1];
+      s1 = (s1 + DELTA_ADLER32_MODULUS - old_byte + new_byte) % DELTA_ADLER32_MODULUS;
+      s2 = (s2 + DELTA_ADLER32_MODULUS -
+            (uint32_t)((uint64_t)block_size * old_byte % DELTA_ADLER32_MODULUS) + s1 - 1) %
+           DELTA_ADLER32_MODULUS;
+      adler = (s2 << 16) | s1;
+    } else {
+      s1 = 1;
+      s2 = 0;
+      for (uint32_t k = 0; k < window_len; k++) {
+        s1 = (s1 + new_data[i + k]) % DELTA_ADLER32_MODULUS;
+        s2 = (s2 + s1) % DELTA_ADLER32_MODULUS;
+      }
+      adler = (s2 << 16) | s1;
+      rolling_valid = full_window;
+    }
+
+    bool matched = false;
+    for (uint32_t j = 0; j < sig->block_count; j++) {
+      if (adler == sig->blocks[j].adler32 && full_window) {
+        uint32_t xxh = delta_xxhash32(new_data + i, window_len);
+        if (xxh == sig->blocks[j].xxhash) {
+          if (has_literal) {
+            if (!flush_literal(&instrs, &capacity, &count, new_data, literal_start, i)) {
+              free(instrs);
+              return NULL;
+            }
+            has_literal = false;
+          }
+
+          if (!ensure_capacity(&instrs, &capacity, count)) {
+            free(instrs);
+            return NULL;
+          }
+          instrs[count].type = DELTA_INSTR_BLOCK_MATCH;
+          instrs[count].match.block_index = j;
+          instrs[count].match.block_offset = 0;
+          instrs[count].match.length = window_len;
+          count++;
+
+          i += window_len;
+          rolling_valid = false;
+          matched = true;
+          break;
+        }
+      }
+    }
+
+    if (!matched) {
+      if (!has_literal) {
+        literal_start = i;
+        has_literal = true;
+      }
+      i++;
+    }
+  }
+
+  if (has_literal) {
+    if (!flush_literal(&instrs, &capacity, &count, new_data, literal_start, new_file_size)) {
+      free(instrs);
+      return NULL;
+    }
+  }
+
+  Delta* delta = malloc(sizeof(Delta));
+  if (!delta) {
+    for (uint32_t k = 0; k < count; k++) {
+      if (instrs[k].type == DELTA_INSTR_LITERAL)
+        free(instrs[k].literal.data);
+    }
+    free(instrs);
+    return NULL;
+  }
+
+  delta->new_file_size = new_file_size;
+  delta->instruction_count = count;
+  delta->instructions = instrs;
+  delta->delta_size = 0;
+
+  for (uint32_t k = 0; k < count; k++) {
+    delta->delta_size += 1;
+    if (instrs[k].type == DELTA_INSTR_BLOCK_MATCH) {
+      delta->delta_size += sizeof(uint32_t) * 3;
+    } else {
+      delta->delta_size += sizeof(uint32_t) + instrs[k].literal.length;
+    }
+  }
+
+  return delta;
+}
+
+Data* delta_serialize(const Delta* delta) {
+  if (!delta)
+    return NULL;
+
+  uint64_t total = sizeof(uint64_t) + sizeof(uint32_t) + delta->delta_size;
+  uint8_t* buf = malloc((size_t)total);
+  if (!buf)
+    return NULL;
+
+  size_t pos = 0;
+  memcpy(buf + pos, &delta->new_file_size, sizeof(uint64_t));
+  pos += sizeof(uint64_t);
+  memcpy(buf + pos, &delta->instruction_count, sizeof(uint32_t));
+  pos += sizeof(uint32_t);
+
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    uint8_t type = (uint8_t)delta->instructions[i].type;
+    memcpy(buf + pos, &type, sizeof(uint8_t));
+    pos += sizeof(uint8_t);
+
+    if (delta->instructions[i].type == DELTA_INSTR_BLOCK_MATCH) {
+      memcpy(buf + pos, &delta->instructions[i].match.block_index, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+      memcpy(buf + pos, &delta->instructions[i].match.block_offset, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+      memcpy(buf + pos, &delta->instructions[i].match.length, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+    } else {
+      memcpy(buf + pos, &delta->instructions[i].literal.length, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+      memcpy(buf + pos, delta->instructions[i].literal.data, delta->instructions[i].literal.length);
+      pos += delta->instructions[i].literal.length;
+    }
+  }
+
+  return data_create(buf, (size_t)total);
+}
+
+Delta* delta_deserialize(const Data* data) {
+  if (!data || data->size < sizeof(uint64_t) + sizeof(uint32_t))
+    return NULL;
+
+  const uint8_t* buf = (const uint8_t*)data->data;
+  size_t pos = 0;
+
+  Delta* delta = malloc(sizeof(Delta));
+  if (!delta)
+    return NULL;
+
+  memcpy(&delta->new_file_size, buf + pos, sizeof(uint64_t));
+  pos += sizeof(uint64_t);
+  memcpy(&delta->instruction_count, buf + pos, sizeof(uint32_t));
+  pos += sizeof(uint32_t);
+
+  delta->instructions = malloc(delta->instruction_count * sizeof(DeltaInstruction));
+  if (!delta->instructions) {
+    free(delta);
+    return NULL;
+  }
+
+  delta->delta_size = 0;
+
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (pos >= data->size) {
+      for (uint32_t k = 0; k < i; k++) {
+        if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
+          free(delta->instructions[k].literal.data);
+      }
+      free(delta->instructions);
+      free(delta);
+      return NULL;
+    }
+
+    uint8_t type;
+    memcpy(&type, buf + pos, sizeof(uint8_t));
+    pos += sizeof(uint8_t);
+
+    delta->delta_size += 1;
+
+    if (type == DELTA_OP_BLOCK_MATCH) {
+      if (pos + sizeof(uint32_t) * 3 > data->size) {
+        free(delta->instructions);
+        free(delta);
+        return NULL;
+      }
+      delta->instructions[i].type = DELTA_INSTR_BLOCK_MATCH;
+      memcpy(&delta->instructions[i].match.block_index, buf + pos, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+      memcpy(&delta->instructions[i].match.block_offset, buf + pos, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+      memcpy(&delta->instructions[i].match.length, buf + pos, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+      delta->delta_size += sizeof(uint32_t) * 3;
+    } else if (type == DELTA_OP_LITERAL) {
+      if (pos + sizeof(uint32_t) > data->size) {
+        for (uint32_t k = 0; k < i; k++) {
+          if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
+            free(delta->instructions[k].literal.data);
+        }
+        free(delta->instructions);
+        free(delta);
+        return NULL;
+      }
+      delta->instructions[i].type = DELTA_INSTR_LITERAL;
+      memcpy(&delta->instructions[i].literal.length, buf + pos, sizeof(uint32_t));
+      pos += sizeof(uint32_t);
+
+      uint32_t lit_len = delta->instructions[i].literal.length;
+      if (pos + lit_len > data->size) {
+        for (uint32_t k = 0; k < i; k++) {
+          if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
+            free(delta->instructions[k].literal.data);
+        }
+        free(delta->instructions);
+        free(delta);
+        return NULL;
+      }
+      delta->instructions[i].literal.data = malloc(lit_len);
+      if (!delta->instructions[i].literal.data) {
+        free(delta->instructions);
+        free(delta);
+        return NULL;
+      }
+      memcpy(delta->instructions[i].literal.data, buf + pos, lit_len);
+      pos += lit_len;
+      delta->delta_size += sizeof(uint32_t) + lit_len;
+    } else {
+      for (uint32_t k = 0; k < i; k++) {
+        if (delta->instructions[k].type == DELTA_INSTR_LITERAL)
+          free(delta->instructions[k].literal.data);
+      }
+      free(delta->instructions);
+      free(delta);
+      return NULL;
+    }
+  }
+
+  return delta;
+}
+
+void* delta_apply(const void* old_data, uint64_t old_size, const Delta* delta,
+                  uint32_t block_size) {
+  if (!old_data || !delta)
+    return NULL;
+
+  void* output = malloc((size_t)delta->new_file_size);
+  if (!output)
+    return NULL;
+
+  uint8_t* out = (uint8_t*)output;
+  const uint8_t* old = (const uint8_t*)old_data;
+  uint64_t out_pos = 0;
+
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_BLOCK_MATCH) {
+      uint64_t src_offset = (uint64_t)delta->instructions[i].match.block_index * block_size;
+      src_offset += delta->instructions[i].match.block_offset;
+      uint32_t len = delta->instructions[i].match.length;
+
+      if (src_offset + len > old_size) {
+        free(output);
+        return NULL;
+      }
+      memcpy(out + out_pos, old + src_offset, len);
+      out_pos += len;
+    } else {
+      uint32_t len = delta->instructions[i].literal.length;
+      memcpy(out + out_pos, delta->instructions[i].literal.data, len);
+      out_pos += len;
+    }
+  }
+
+  if (out_pos != delta->new_file_size) {
+    free(output);
+    return NULL;
+  }
+
+  return output;
+}
+
+void delta_destroy(Delta* delta) {
+  if (!delta)
+    return;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_LITERAL)
+      free(delta->instructions[i].literal.data);
+  }
+  free(delta->instructions);
+  free(delta);
+}
+
+bool delta_should_attempt(uint64_t old_size, uint64_t new_size, uint64_t max_file_size) {
+  if (old_size < DELTA_MIN_FILE_SIZE || new_size < DELTA_MIN_FILE_SIZE)
+    return false;
+  if (old_size > max_file_size || new_size > max_file_size)
+    return false;
+  double large = (old_size > new_size) ? (double)old_size : (double)new_size;
+  double small = (old_size > new_size) ? (double)new_size : (double)old_size;
+  if (small == 0 || large / small > DELTA_MAX_SIZE_RATIO)
+    return false;
+  return true;
+}
+
+bool delta_is_worthwhile(const Delta* delta, uint64_t new_file_size) {
+  if (!delta || delta->instruction_count == 0)
+    return false;
+
+  bool has_match = false;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_BLOCK_MATCH) {
+      has_match = true;
+      break;
+    }
+  }
+  if (!has_match)
+    return false;
+
+  double ratio = (double)delta->delta_size / (double)new_file_size;
+  return ratio < DELTA_FALLBACK_RATIO;
+}

src/shared/delta.h

@@ -0,0 +1,76 @@
+#ifndef DELTA_H
+#define DELTA_H
+
+#include "data.h"
+#include <stdbool.h>
+#include <stdint.h>
+#include <stddef.h>
+
+#define DELTA_BLOCK_SIZE_DEFAULT 8192U
+#define DELTA_BLOCK_SIZE_MIN 1024U
+#define DELTA_BLOCK_SIZE_MAX 65536U
+#define DELTA_MIN_FILE_SIZE 16384ULL
+#define DELTA_MAX_FILE_SIZE (256ULL * 1024 * 1024)
+#define DELTA_MAX_SIZE_RATIO 10.0
+#define DELTA_FALLBACK_RATIO 0.7
+#define DELTA_ADLER32_MODULUS 65521U
+
+#define DELTA_OP_BLOCK_MATCH 0x01
+#define DELTA_OP_LITERAL 0x02
+
+typedef struct {
+  uint32_t adler32;
+  uint32_t xxhash;
+} DeltaBlockSig;
+
+typedef struct {
+  uint64_t file_size;
+  uint32_t block_size;
+  uint32_t block_count;
+  DeltaBlockSig* blocks;
+} DeltaSignature;
+
+typedef enum { DELTA_INSTR_BLOCK_MATCH = 0x01, DELTA_INSTR_LITERAL = 0x02 } DeltaInstrType;
+
+typedef struct {
+  DeltaInstrType type;
+  union {
+    struct {
+      uint32_t block_index;
+      uint32_t block_offset;
+      uint32_t length;
+    } match;
+    struct {
+      uint8_t* data;
+      uint32_t length;
+    } literal;
+  };
+} DeltaInstruction;
+
+typedef struct {
+  uint64_t new_file_size;
+  uint32_t instruction_count;
+  DeltaInstruction* instructions;
+  uint64_t delta_size;
+} Delta;
+
+DeltaSignature* delta_signature_create(const void* old_file_data, uint64_t old_file_size,
+                                       uint32_t block_size);
+Data* delta_signature_serialize(const DeltaSignature* sig);
+DeltaSignature* delta_signature_deserialize(const Data* data);
+void delta_signature_destroy(DeltaSignature* sig);
+
+Delta* delta_compute(const void* new_file_data, uint64_t new_file_size, const DeltaSignature* sig,
+                     uint32_t block_size);
+Data* delta_serialize(const Delta* delta);
+Delta* delta_deserialize(const Data* data);
+void* delta_apply(const void* old_data, uint64_t old_size, const Delta* delta, uint32_t block_size);
+void delta_destroy(Delta* delta);
+
+bool delta_should_attempt(uint64_t old_size, uint64_t new_size, uint64_t max_file_size);
+bool delta_is_worthwhile(const Delta* delta, uint64_t new_file_size);
+
+uint32_t delta_adler32(const void* data, uint32_t len);
+uint32_t delta_xxhash32(const void* data, uint32_t len);
+
+#endif

src/shared/file.c

@@ -10,6 +10,7 @@
 #include <unistd.h>
 
 #include "compression.h"
+#include "delta.h"
 #include "log.h"
 #include "config.h"
 #include "data.h"
@@ -19,15 +20,15 @@
 #include "protocol.h"
 #include "utils.h"
 
-File *file_create(const char *path) {
+File* file_create(const char* path) {
-  File *file = (File *)malloc(sizeof(File));
+  File* file = (File*)malloc(sizeof(File));
   if (file == NULL) {
     perror("ERROR: Could not allocate memory for file struct");
     return NULL;
   }
 
   int path_len = strlen(path);
-  file->path = (char *)malloc(path_len + 1);
+  file->path = (char*)malloc(path_len + 1);
   if (file->path == NULL) {
     free(file);
     return NULL;
@@ -44,10 +45,10 @@ File *file_create(const char *path) {
   return file;
 }
 
-void file_destroy(void *item) {
+void file_destroy(void* item) {
   if (item == NULL)
     return;
-  File *file = (File *)item;
+  File* file = (File*)item;
   data_destroy(file->data);
   file->data = NULL;
   file_metadata_destroy(file->metadata);
@@ -57,8 +58,8 @@ void file_destroy(void *item) {
   free(file);
 }
 
-FileMetadata *file_metadata_create(struct stat *stats) {
+FileMetadata* file_metadata_create(const struct stat* stats) {
-  FileMetadata *m = malloc(sizeof(FileMetadata));
+  FileMetadata* m = malloc(sizeof(FileMetadata));
   if (m == NULL) {
     perror("ERROR: Could not allocate memory for file metadata");
     return NULL;
@@ -75,12 +76,13 @@ FileMetadata *file_metadata_create(struct stat *stats) {
   return m;
 }
 
-void file_metadata_destroy(void *metadata) {
+void file_metadata_destroy(void* metadata) {
   free(metadata);
 }
 
-bool file_load_data(File *file) {
+bool file_load_data(File* file) {
-  if (file == NULL) return false;
+  if (file == NULL)
+    return false;
   if (file->data->data == NULL) {
     file->data->data = malloc(file->data->size);
     if (file->data->data == NULL) {
@@ -96,35 +98,325 @@ bool file_load_data(File *file) {
   return true;
 }
 
-bool file_send_single_calls(File *file, int file_descriptor, bool use_metadata, int compression_level) {
+bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
+                            int compression_level, bool send_path) {
+  const Data* data_to_send = file->data;
+  Data* compressed_data = NULL;
   if (compression_level > 0) {
-    Data *compressed_data = data_compress(file->data, compression_level);
+    compressed_data = data_compress(file->data, compression_level);
     if (compressed_data == NULL) {
       log_message(LOG_LEVEL_ERROR, "Failed to compress file data");
       return false;
     }
-    data_destroy(file->data);
+    data_to_send = compressed_data;
-    if (compressed_data == NULL) {
-      log_message(LOG_LEVEL_ERROR, "Compression failed in file_send_single_calls");
-      exit(EXIT_FAILURE);
-    }
-    file->data = compressed_data;
   }
-  if (!send_str(file_descriptor, file->path)) return false;
+  if (send_path && !send_str(file_descriptor, file->path)) {
-  if (use_metadata && !metadata_send(file_descriptor, file->metadata)) return false;
+    data_destroy(compressed_data);
-  if (!send_data(file_descriptor, file->data)) return false;
+    return false;
+  }
+  if (use_metadata && !metadata_send(file_descriptor, file->metadata)) {
+    data_destroy(compressed_data);
+    return false;
+  }
+  if (!send_data(file_descriptor, data_to_send)) {
+    data_destroy(compressed_data);
+    return false;
+  }
+  data_destroy(compressed_data);
   return true;
 }
 
-bool to_disk(const char *path, const void *data, unsigned long long data_size) {
+bool file_save_to_disk(const char* root_directory, File* file) {
-  char *directory = str_dup(path);
+  char* disk_path = path_cat((char*)root_directory, file->path);
-  char *dir_to_free = directory;
+  if (disk_path == NULL)
+    return false;
+  bool ok = to_disk(disk_path, file->data->data, file->data->size);
+  if (ok)
+    file_restore_metadata(disk_path, file->metadata);
+  free(disk_path);
+  return ok;
+}
+
+static void* old_data_from_path(const char* full_path, unsigned long long old_size) {
+  void* data = malloc((size_t)old_size);
+  if (!data)
+    return NULL;
+  FILE* fp = fopen(full_path, "rb");
+  if (!fp) {
+    free(data);
+    return NULL;
+  }
+  size_t nread = fread(data, 1, (size_t)old_size, fp);
+  fclose(fp);
+  if (nread != (size_t)old_size) {
+    free(data);
+    return NULL;
+  }
+  return data;
+}
+
+static File* receive_delta_file(int fd, const Config* config, const char* check_path,
+                                void* old_data, unsigned long long old_size) {
+  if (!old_data)
+    return NULL;
+
+  DeltaSignature* sig = delta_signature_create(old_data, old_size, config->delta_block_size);
+  if (!sig) {
+    free(old_data);
+    return NULL;
+  }
+
+  Data* sig_data = delta_signature_serialize(sig);
+  if (!sig_data) {
+    delta_signature_destroy(sig);
+    free(old_data);
+    return NULL;
+  }
+
+  bool sig_sent = send_status(fd, STATUS_DELTA_SIGNATURE) && send_data(fd, sig_data);
+  data_destroy(sig_data);
+
+  if (!sig_sent) {
+    delta_signature_destroy(sig);
+    free(old_data);
+    return NULL;
+  }
+
+  Status resp;
+  if (!receive_status(fd, &resp)) {
+    delta_signature_destroy(sig);
+    free(old_data);
+    return NULL;
+  }
+
+  if (resp == STATUS_DELTA_DATA) {
+    Data* delta_data = receive_data(fd);
+    if (!delta_data) {
+      delta_signature_destroy(sig);
+      free(old_data);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+
+    Data* raw_delta = delta_data;
+    if (config->use_compression) {
+      raw_delta = data_decompress(delta_data);
+      data_destroy(delta_data);
+      if (!raw_delta) {
+        free(old_data);
+        delta_signature_destroy(sig);
+        send_status(fd, STATUS_ERROR);
+        return NULL;
+      }
+    }
+
+    Delta* delta = delta_deserialize(raw_delta);
+    data_destroy(raw_delta);
+    if (!delta) {
+      free(old_data);
+      delta_signature_destroy(sig);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+
+    void* new_data = delta_apply(old_data, old_size, delta, config->delta_block_size);
+    uint64_t new_size = delta->new_file_size;
+    delta_destroy(delta);
+
+    if (!new_data) {
+      free(old_data);
+      delta_signature_destroy(sig);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+
+    File* file = file_create(check_path);
+    if (!file) {
+      free(new_data);
+      free(old_data);
+      delta_signature_destroy(sig);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+
+    if (config->use_metadata) {
+      int meta_ok = 1;
+      file->metadata = metadata_receive(fd, &meta_ok);
+      if (!meta_ok) {
+        file_destroy(file);
+        free(new_data);
+        free(old_data);
+        delta_signature_destroy(sig);
+        send_status(fd, STATUS_ERROR);
+        return NULL;
+      }
+    }
+
+    data_destroy(file->data);
+    file->data = data_create(new_data, (size_t)new_size);
+
+    free(old_data);
+    delta_signature_destroy(sig);
+    return file;
+  }
+
+  if (resp == STATUS_NEXT) {
+    delta_signature_destroy(sig);
+    free(old_data);
+
+    File* file = file_create(check_path);
+    if (!file) {
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+
+    if (config->use_metadata) {
+      int meta_ok = 1;
+      file->metadata = metadata_receive(fd, &meta_ok);
+      if (!meta_ok) {
+        file_destroy(file);
+        send_status(fd, STATUS_ERROR);
+        return NULL;
+      }
+    }
+
+    Data* file_data = receive_data(fd);
+    if (file_data == NULL) {
+      file_destroy(file);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+
+    if (config->use_compression) {
+      Data* uncompressed = data_decompress(file_data);
+      data_destroy(file_data);
+      if (uncompressed == NULL) {
+        file_destroy(file);
+        send_status(fd, STATUS_ERROR);
+        return NULL;
+      }
+      file_data = uncompressed;
+    }
+
+    data_destroy(file->data);
+    file->data = file_data;
+    return file;
+  }
+
+  delta_signature_destroy(sig);
+  free(old_data);
+  return NULL;
+}
+
+File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
+  *skipped = false;
+  char* check_path = receive_str(fd);
+  if (check_path == NULL) {
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+
+  unsigned long long check_size;
+  long long check_mtime;
+  if (!receive_n_data(fd, &check_size, sizeof(check_size)) ||
+      !receive_n_data(fd, &check_mtime, sizeof(check_mtime))) {
+    free(check_path);
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+
+  char* full_path = path_cat(config->receive_root_directory, check_path);
+  struct stat st;
+  bool has_old_file = (full_path && stat(full_path, &st) == 0);
+  unsigned long long old_size = has_old_file ? (unsigned long long)st.st_size : 0;
+
+  bool match = has_old_file && (unsigned long long)st.st_size == check_size &&
+               (long long)st.st_mtime == check_mtime;
+
+  if (match) {
+    if (!send_status(fd, STATUS_OK)) {
+      free(full_path);
+      free(check_path);
+      return NULL;
+    }
+    free(full_path);
+    free(check_path);
+    *skipped = true;
+    return NULL;
+  }
+
+  bool try_delta = config->use_delta && has_old_file &&
+                   delta_should_attempt(old_size, check_size, config->delta_max_file_size);
+
+  if (try_delta) {
+    void* old_data = old_data_from_path(full_path, old_size);
+    File* delta_file = receive_delta_file(fd, config, check_path, old_data, old_size);
+    if (delta_file) {
+      free(full_path);
+      free(check_path);
+      return delta_file;
+    }
+    try_delta = false;
+  }
+
+  if (!try_delta) {
+    if (!send_status(fd, STATUS_NEXT)) {
+      free(full_path);
+      free(check_path);
+      return NULL;
+    }
+  }
+
+  File* file = file_create(check_path);
+  free(check_path);
+  free(full_path);
+  if (file == NULL) {
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+
+  if (config->use_metadata) {
+    int meta_ok = 1;
+    file->metadata = metadata_receive(fd, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+  }
+
+  Data* file_data = receive_data(fd);
+  if (file_data == NULL) {
+    file_destroy(file);
+    send_status(fd, STATUS_ERROR);
+    return NULL;
+  }
+
+  if (config->use_compression) {
+    Data* uncompressed = data_decompress(file_data);
+    data_destroy(file_data);
+    if (uncompressed == NULL) {
+      file_destroy(file);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
+    file_data = uncompressed;
+  }
+
+  data_destroy(file->data);
+  file->data = file_data;
+  return file;
+}
+
+bool to_disk(const char* path, const void* data, unsigned long long data_size) {
+  char* directory = str_dup(path);
+  char* dir_to_free = directory;
   directory = dirname(directory);
   if (!mkdir_r(directory)) {
     free(dir_to_free);
     return false;
   }
-  FILE *file_pointer = fopen(path, "wb");
+  FILE* file_pointer = fopen(path, "wb");
   if (file_pointer == NULL) {
     perror("Could not open File");
     free(dir_to_free);
@@ -141,9 +433,13 @@ bool to_disk(const char *path, const void *data, unsigned long long data_size) {
   return true;
 }
 
-bool file_send_sendfile(File *file, int file_descriptor, bool use_metadata) {
+bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
-  if (!send_str(file_descriptor, file->path)) return false;
+                        bool send_path) {
-  if (use_metadata && !metadata_send(file_descriptor, file->metadata)) return false;
+  (void)compression_level;
+  if (send_path && !send_str(file_descriptor, file->path))
+    return false;
+  if (use_metadata && !metadata_send(file_descriptor, file->metadata))
+    return false;
 
   int fd = open(file->path, O_RDONLY);
   if (fd == -1) {
@@ -158,7 +454,7 @@ bool file_send_sendfile(File *file, int file_descriptor, bool use_metadata) {
   }
 
   off_t offset = 0;
-  while (offset < file_size) {
+  while ((unsigned long long)offset < file_size) {
     ssize_t sent = sendfile(file_descriptor, fd, &offset, file_size - offset);
     if (sent == -1) {
       perror("sendfile failed");
@@ -171,22 +467,29 @@ bool file_send_sendfile(File *file, int file_descriptor, bool use_metadata) {
   return true;
 }
 
-File *file_receive(Config *config, int file_descriptor) {
+File* file_receive(const Config* config, int file_descriptor) {
-  char *path = receive_str(file_descriptor);
+  char* path = receive_str(file_descriptor);
-  if (path == NULL) return NULL;
+  if (path == NULL)
-  File *file = file_create(path);
+    return NULL;
+  File* file = file_create(path);
   free(path);
-  if (file == NULL) return NULL;
+  if (file == NULL)
+    return NULL;
   if (config->use_metadata) {
-    file->metadata = metadata_receive(file_descriptor);
+    int meta_ok = 1;
+    file->metadata = metadata_receive(file_descriptor, &meta_ok);
+    if (!meta_ok) {
+      file_destroy(file);
+      return NULL;
+    }
   }
-  Data *file_data = receive_data(file_descriptor);
+  Data* file_data = receive_data(file_descriptor);
   if (file_data == NULL) {
     file_destroy(file);
     return NULL;
   }
   if (config->use_compression) {
-    Data *file_data_uncompressed = data_decompress(file_data);
+    Data* file_data_uncompressed = data_decompress(file_data);
     data_destroy(file_data);
     if (file_data_uncompressed == NULL) {
       file_destroy(file);
@@ -199,14 +502,13 @@ File *file_receive(Config *config, int file_descriptor) {
   return file;
 }
 
-size_t file_content_to_buffer(File *file) {
+size_t file_content_to_buffer(File* file) {
-  FILE *file_pointer = fopen(file->path, "rb");
+  FILE* file_pointer = fopen(file->path, "rb");
   if (file_pointer == NULL) {
     perror("Could not open the file!");
     return 0;
   }
-  size_t bytes_read =
+  size_t bytes_read = fread(file->data->data, 1, file->data->size, file_pointer);
-      fread(file->data->data, 1, file->data->size, file_pointer);
   if (bytes_read != (size_t)file->data->size) {
     fclose(file_pointer);
     perror("Read unexpected number of bytes from File!");
@@ -216,4 +518,22 @@ size_t file_content_to_buffer(File *file) {
   return bytes_read;
 }
 
-
+int receive_manifest(int fd, const Config* config, int* next_status) {
+  int count;
+  if (!receive_int(fd, &count))
+    return -1;
+  ArrayList* manifest = array_list_create(free);
+  if (manifest) {
+    for (int i = 0; i < count; i++) {
+      char* s = receive_str(fd);
+      if (s)
+        array_list_add(manifest, s);
+    }
+    fprintf(stderr, "Deleting files not in manifest...\n");
+    delete_extras(config->receive_root_directory, manifest);
+    array_list_delete(manifest);
+  }
+  if (!receive_status(fd, next_status))
+    return -1;
+  return 0;
+}

src/shared/file.h

@@ -15,20 +15,25 @@ typedef struct {
 } FileMetadata;
 
 typedef struct {
-  char *path;
+  char* path;
-  Data *data;
+  Data* data;
-  FileMetadata *metadata;
+  FileMetadata* metadata;
 } File;
 
-File *file_create(const char *path);
+File* file_create(const char* path);
-void file_destroy(void *item);
+void file_destroy(void* item);
-bool file_load_data(File *file);
+bool file_load_data(File* file);
-File *file_receive(Config *config, int file_descriptor);
+File* file_receive(const Config* config, int file_descriptor);
-bool file_send_single_calls(File *file, int file_descriptor, bool use_metadata, int compression_level);
+bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
-bool file_send_sendfile(File *file, int file_descriptor, bool use_metadata);
+                            int compression_level, bool send_path);
-size_t file_content_to_buffer(File *file);
+bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
-FileMetadata *file_metadata_create(struct stat *stats);
+                        bool send_path);
-void file_metadata_destroy(void *metadata);
+size_t file_content_to_buffer(File* file);
-bool to_disk(const char *path, const void *data, unsigned long long data_size);
+FileMetadata* file_metadata_create(const struct stat* stats);
+void file_metadata_destroy(void* metadata);
+bool to_disk(const char* path, const void* data, unsigned long long data_size);
+bool file_save_to_disk(const char* root_directory, File* file);
+File* receive_incremental_check(int fd, const Config* config, bool* skipped);
+int receive_manifest(int fd, const Config* config, int* next_status);
 
 #endif

src/shared/log.c

@@ -3,22 +3,21 @@
 #include <stdio.h>
 #include <time.h>
 
-static const char *log_level_strings[] = {"DEBUG", "INFO", "WARN", "ERROR"};
+static const char* log_level_strings[] = {"DEBUG", "INFO", "WARN", "ERROR"};
 static LogLevel current_log_level = LOG_LEVEL_WARNING;
 
 void set_log_level(LogLevel level) {
   current_log_level = level;
 }
 
-void log_message(LogLevel log_level, char *format, ...) {
+void log_message(LogLevel log_level, char* format, ...) {
   if (log_level < current_log_level)
     return;
   time_t now = time(NULL);
-  struct tm *t = localtime(&now);
+  const struct tm* t = localtime(&now);
 
-  fprintf(stderr, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t->tm_year + 1900,
+  fprintf(stderr, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t->tm_year + 1900, t->tm_mon + 1,
-          t->tm_mon + 1, t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec,
+          t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec, log_level_strings[log_level]);
-          log_level_strings[log_level]);
 
   va_list args;
   va_start(args, format);

src/shared/log.h

@@ -1,14 +1,9 @@
 #ifndef LOG_H
 #define LOG_H
 
-typedef enum {
+typedef enum { LOG_LEVEL_DEBUG, LOG_LEVEL_INFO, LOG_LEVEL_WARNING, LOG_LEVEL_ERROR } LogLevel;
-  LOG_LEVEL_DEBUG,
-  LOG_LEVEL_INFO,
-  LOG_LEVEL_WARNING,
-  LOG_LEVEL_ERROR
-} LogLevel;
 
-void log_message(LogLevel log_level, char *message, ...);
+void log_message(LogLevel log_level, char* message, ...);
 void set_log_level(LogLevel level);
 
 #endif

src/shared/metadata.c

@@ -8,35 +8,45 @@
 #include <time.h>
 #include <unistd.h>
 
-void metadata_to_buf(char **buf, FileMetadata *m) {
+void metadata_to_buf(char** buf, const FileMetadata* m) {
   int present = (m != NULL) ? 1 : 0;
   memcpy(*buf, &present, sizeof(int));
   *buf += sizeof(int);
   if (m == NULL)
     return;
-  memcpy(*buf, &m->mode, sizeof(mode_t));        *buf += sizeof(mode_t);
+  memcpy(*buf, &m->mode, sizeof(mode_t));
-  memcpy(*buf, &m->uid, sizeof(uid_t));          *buf += sizeof(uid_t);
+  *buf += sizeof(mode_t);
-  memcpy(*buf, &m->gid, sizeof(gid_t));          *buf += sizeof(gid_t);
+  memcpy(*buf, &m->uid, sizeof(uid_t));
-  memcpy(*buf, &m->mtime_sec, sizeof(time_t));   *buf += sizeof(time_t);
+  *buf += sizeof(uid_t);
-  memcpy(*buf, &m->mtime_nsec, sizeof(long));    *buf += sizeof(long);
+  memcpy(*buf, &m->gid, sizeof(gid_t));
+  *buf += sizeof(gid_t);
+  memcpy(*buf, &m->mtime_sec, sizeof(time_t));
+  *buf += sizeof(time_t);
+  memcpy(*buf, &m->mtime_nsec, sizeof(long));
+  *buf += sizeof(long);
 }
 
-FileMetadata *metadata_from_buf(char **buf) {
+FileMetadata* metadata_from_buf(char** buf) {
   int present;
   memcpy(&present, *buf, sizeof(int));
   *buf += sizeof(int);
   if (!present)
     return NULL;
-  FileMetadata *m = malloc(sizeof(FileMetadata));
+  FileMetadata* m = malloc(sizeof(FileMetadata));
-  memcpy(&m->mode, *buf, sizeof(mode_t));        *buf += sizeof(mode_t);
+  memcpy(&m->mode, *buf, sizeof(mode_t));
-  memcpy(&m->uid, *buf, sizeof(uid_t));          *buf += sizeof(uid_t);
+  *buf += sizeof(mode_t);
-  memcpy(&m->gid, *buf, sizeof(gid_t));          *buf += sizeof(gid_t);
+  memcpy(&m->uid, *buf, sizeof(uid_t));
-  memcpy(&m->mtime_sec, *buf, sizeof(time_t));   *buf += sizeof(time_t);
+  *buf += sizeof(uid_t);
-  memcpy(&m->mtime_nsec, *buf, sizeof(long));    *buf += sizeof(long);
+  memcpy(&m->gid, *buf, sizeof(gid_t));
+  *buf += sizeof(gid_t);
+  memcpy(&m->mtime_sec, *buf, sizeof(time_t));
+  *buf += sizeof(time_t);
+  memcpy(&m->mtime_nsec, *buf, sizeof(long));
+  *buf += sizeof(long);
   return m;
 }
 
-bool metadata_send(int file_descriptor, FileMetadata *m) {
+bool metadata_send(int file_descriptor, FileMetadata* m) {
   if (m == NULL) {
     int zero = 0;
     return send_n_data(file_descriptor, &zero, sizeof(int));
@@ -50,26 +60,40 @@ bool metadata_send(int file_descriptor, FileMetadata *m) {
          send_n_data(file_descriptor, &m->mtime_nsec, sizeof(long));
 }
 
-FileMetadata *metadata_receive(int file_descriptor) {
+FileMetadata* metadata_receive(int file_descriptor, int* ok) {
   int present;
-  if (!receive_n_data(file_descriptor, &present, sizeof(int)))
+  if (!receive_n_data(file_descriptor, &present, sizeof(int))) {
+    if (ok)
+      *ok = 0;
     return NULL;
-  if (!present)
+  }
+  if (!present) {
+    if (ok)
+      *ok = 1;
     return NULL;
-  FileMetadata *m = malloc(sizeof(FileMetadata));
+  }
-  if (m == NULL) return NULL;
+  FileMetadata* m = malloc(sizeof(FileMetadata));
+  if (m == NULL) {
+    if (ok)
+      *ok = 0;
+    return NULL;
+  }
   if (!receive_n_data(file_descriptor, &m->mode, sizeof(mode_t)) ||
       !receive_n_data(file_descriptor, &m->uid, sizeof(uid_t)) ||
       !receive_n_data(file_descriptor, &m->gid, sizeof(gid_t)) ||
       !receive_n_data(file_descriptor, &m->mtime_sec, sizeof(time_t)) ||
       !receive_n_data(file_descriptor, &m->mtime_nsec, sizeof(long))) {
     free(m);
+    if (ok)
+      *ok = 0;
     return NULL;
   }
+  if (ok)
+    *ok = 1;
   return m;
 }
 
-void file_restore_metadata(const char *path, FileMetadata *metadata) {
+void file_restore_metadata(const char* path, FileMetadata* metadata) {
   if (metadata == NULL)
     return;
   chmod(path, metadata->mode & 07777);

src/shared/metadata.h

@@ -5,12 +5,13 @@
 #include <stdbool.h>
 #include <sys/stat.h>
 
-#define FILE_METADATA_WIRE_SIZE (sizeof(mode_t) + sizeof(uid_t) + sizeof(gid_t) + sizeof(time_t) + sizeof(long))
+#define FILE_METADATA_WIRE_SIZE                                                                    \
+  (sizeof(mode_t) + sizeof(uid_t) + sizeof(gid_t) + sizeof(time_t) + sizeof(long))
 
-void metadata_to_buf(char **buf, FileMetadata *m);
+void metadata_to_buf(char** buf, const FileMetadata* m);
-FileMetadata *metadata_from_buf(char **buf);
+FileMetadata* metadata_from_buf(char** buf);
-bool metadata_send(int file_descriptor, FileMetadata *m);
+bool metadata_send(int file_descriptor, FileMetadata* m);
-FileMetadata *metadata_receive(int file_descriptor);
+FileMetadata* metadata_receive(int file_descriptor, int* ok);
-void file_restore_metadata(const char *path, FileMetadata *metadata);
+void file_restore_metadata(const char* path, FileMetadata* metadata);
 
 #endif

src/shared/multiprocessing.c

@@ -1,12 +1,10 @@
 #include "multiprocessing.h"
 #include "array_list.h"
 #include "chunk.h"
-#include "compression.h"
 #include "config.h"
 #include "data.h"
 #include "file.h"
 #include "log.h"
-#include "metadata.h"
 #include "protocol.h"
 #include "queue.h"
 #include "utils.h"
@@ -15,11 +13,11 @@
 #include <string.h>
 #include <threads.h>
 
-PipelineContextSender *pipeline_context_sender_create(Config *config,
+PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,
-                                                      Queue *queue_scanner,
+                                                      Queue* queue_loader) {
-                                                      Queue *queue_loader) {
+  PipelineContextSender* context = malloc(sizeof(PipelineContextSender));
-  PipelineContextSender *context = malloc(sizeof(PipelineContextSender));
+  if (context == NULL)
-  if (context == NULL) return NULL;
+    return NULL;
   context->config = config;
   context->queue_scanner = queue_scanner;
   context->queue_loader = queue_loader;
@@ -39,7 +37,7 @@ PipelineContextSender *pipeline_context_sender_create(Config *config,
   return context;
 }
 
-void pipeline_context_sender_destroy(PipelineContextSender *context) {
+void pipeline_context_sender_destroy(PipelineContextSender* context) {
   if (context->manifest) {
     array_list_delete(context->manifest);
   }
@@ -55,11 +53,11 @@ void pipeline_context_sender_destroy(PipelineContextSender *context) {
   free(context);
 }
 
-PipelineContextReceiver *pipeline_context_receiver_create(Config *config,
+PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue* queue,
-                                                          Queue *queue,
                                                           int file_descriptor) {
-  PipelineContextReceiver *context = malloc(sizeof(PipelineContextReceiver));
+  PipelineContextReceiver* context = malloc(sizeof(PipelineContextReceiver));
-  if (context == NULL) return NULL;
+  if (context == NULL)
+    return NULL;
   context->config = config;
   context->queue = queue;
   context->file_descriptor = file_descriptor;
@@ -74,7 +72,7 @@ PipelineContextReceiver *pipeline_context_receiver_create(Config *config,
   return context;
 }
 
-void pipeline_context_receiver_destroy(PipelineContextReceiver *context) {
+void pipeline_context_receiver_destroy(PipelineContextReceiver* context) {
   config_delete(context->config);
   queue_destroy(context->queue);
   mtx_destroy(&context->mutex);
@@ -83,81 +81,57 @@ void pipeline_context_receiver_destroy(PipelineContextReceiver *context) {
   free(context);
 }
 
-static void receive_chunk_enqueue(int file_descriptor,
+static void receive_chunk_enqueue(int file_descriptor, PipelineContextReceiver* context) {
-                                  PipelineContextReceiver *context) {
+  Chunk* chunk = receive_chunk_data(file_descriptor, context->config);
-  Data *chunk_data = receive_data(file_descriptor);
+  if (chunk == NULL)
-  if (chunk_data == NULL) {
-    log_message(LOG_LEVEL_ERROR, "Failed to receive chunk data");
     return;
-  }
-  Data *data_to_process = chunk_data;
-  if (context->config->use_compression) {
-    data_to_process = data_decompress(chunk_data);
-    data_destroy(chunk_data);
-    if (data_to_process == NULL) {
-      log_message(LOG_LEVEL_ERROR, "Failed to decompress chunk");
-      return;
-    }
-  }
-  Chunk *chunk = chunk_deserialize(data_to_process, context->config->use_metadata);
-  data_destroy(data_to_process);
-  if (chunk == NULL) {
-    log_message(LOG_LEVEL_ERROR, "Failed to deserialize chunk, skipping");
-    return;
-  }
 
   for (int i = 0; i < chunk->element_count; i++) {
-    File *file = chunk->items[i];
+    File* file = chunk->items[i];
     chunk->items[i] = NULL;
     queue_enqueue_multithreaded(context->queue, file, &context->mutex,
-                                &context->condition_not_empty,
+                                &context->condition_not_empty, &context->condition_not_full);
-                                &context->condition_not_full);
   }
   chunk_destroy(chunk);
 }
 
-int receive_thread(void *pipeline_context) {
+int receive_thread(void* pipeline_context) {
-  PipelineContextReceiver *context =
+  PipelineContextReceiver* context = (PipelineContextReceiver*)pipeline_context;
-      (PipelineContextReceiver *)pipeline_context;
   mtx_lock(&context->mutex);
   int file_descriptor = context->file_descriptor;
-  Config *config = context->config;
+  const Config* config = context->config;
   mtx_unlock(&context->mutex);
 
   Status status;
-  if (!receive_status(file_descriptor, &status)) return thrd_error;
+  if (!receive_status(file_descriptor, &status))
-  while (status == STATUS_NEXT || status == STATUS_CHUNK) {
+    return thrd_error;
-    if (status == STATUS_CHUNK) {
+  while (status == STATUS_NEXT || status == STATUS_CHUNK || status == STATUS_CHECK) {
+    if (status == STATUS_CHECK) {
+      bool skipped;
+      File* file = receive_incremental_check(file_descriptor, config, &skipped);
+      if (!skipped) {
+        if (file == NULL)
+          return thrd_error;
+        queue_enqueue_multithreaded(context->queue, file, &context->mutex,
+                                    &context->condition_not_empty, &context->condition_not_full);
+      }
+    } else if (status == STATUS_CHUNK) {
       receive_chunk_enqueue(file_descriptor, context);
     } else {
-      File *file = file_receive(config, file_descriptor);
+      File* file = file_receive(config, file_descriptor);
       if (file) {
         queue_enqueue_multithreaded(context->queue, file, &context->mutex,
-                                    &context->condition_not_empty,
+                                    &context->condition_not_empty, &context->condition_not_full);
-                                    &context->condition_not_full);
       } else {
         log_message(LOG_LEVEL_ERROR, "Failed to receive file");
       }
     }
-    if (!receive_status(file_descriptor, &status)) return thrd_error;
+    if (!receive_status(file_descriptor, &status))
+      return thrd_error;
   }
   if (status == STATUS_MANIFEST) {
-    int count;
+    if (receive_manifest(file_descriptor, config, &status) != 0)
-    if (!receive_int(file_descriptor, &count)) return thrd_error;
+      return thrd_error;
-    ArrayList *manifest = array_list_create(free);
-    if (manifest) {
-      for (int i = 0; i < count; i++) {
-        char *s = receive_str(file_descriptor);
-        if (s) {
-          array_list_add(manifest, s);
-        }
-      }
-      delete_extras(context->config->receive_root_directory, manifest);
-      for (int i = 0; i < manifest->size; i++)
-        free(manifest->items[i]);
-      array_list_delete(manifest);
-    }
-    if (!receive_status(file_descriptor, &status)) return thrd_error;
   }
   mtx_lock(&context->mutex);
   context->receiver_done = true;
@@ -166,30 +140,23 @@ int receive_thread(void *pipeline_context) {
   return thrd_success;
 }
 
-int write_thread(void *pipeline_context) {
+int write_thread(void* pipeline_context) {
-  PipelineContextReceiver *context =
+  PipelineContextReceiver* context = (PipelineContextReceiver*)pipeline_context;
-      (PipelineContextReceiver *)pipeline_context;
   mtx_lock(&context->mutex);
   bool save_to_disk = context->config->save_to_disk;
-  char *root_directory = str_dup(context->config->receive_root_directory);
+  char* root_directory = str_dup(context->config->receive_root_directory);
   mtx_unlock(&context->mutex);
 
   while (true) {
-    File *file = queue_dequeue_multithreaded(
+    File* file =
-        context->queue, &context->mutex, &context->condition_not_empty,
+        queue_dequeue_multithreaded(context->queue, &context->mutex, &context->condition_not_empty,
-        &context->condition_not_full, &context->receiver_done);
+                                    &context->condition_not_full, &context->receiver_done);
     if (file == NULL) {
       free(root_directory);
       return thrd_success;
     }
-    if (save_to_disk) {
+    if (save_to_disk)
-      char *disk_path = path_cat(root_directory, file->path);
+      file_save_to_disk(root_directory, file);
-      if (disk_path) {
-        to_disk(disk_path, file->data->data, file->data->size);
-        file_restore_metadata(disk_path, file->metadata);
-        free(disk_path);
-      }
-    }
     file_destroy(file);
   }
 }

src/shared/multiprocessing.h

@@ -9,23 +9,23 @@
 #include "queue.h"
 
 typedef struct {
-  Config *config;
+  Config* config;
-  Queue *queue_scanner;
+  Queue* queue_scanner;
   mtx_t mutex_scanner;
   cnd_t condition_not_full_scanner;
   cnd_t condition_not_empty_scanner;
   bool scanner_done;
-  Queue *queue_loader;
+  Queue* queue_loader;
   mtx_t mutex_loader;
   cnd_t condition_not_full_loader;
   cnd_t condition_not_empty_loader;
   bool loader_done;
-  ArrayList *manifest;
+  ArrayList* manifest;
 } PipelineContextSender;
 
 typedef struct PipelineContextReceiver {
-  Queue *queue;
+  Queue* queue;
-  Config *config;
+  Config* config;
   int file_descriptor;
   mtx_t mutex;
   cnd_t condition_not_full;
@@ -33,14 +33,12 @@ typedef struct PipelineContextReceiver {
   bool receiver_done;
 } PipelineContextReceiver;
 
-PipelineContextSender *pipeline_context_sender_create(Config *config,
+PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* queue_scanner,
-                                                      Queue *queue_scanner,
+                                                      Queue* queue_loader);
-                                                      Queue *queue_loader);
+void pipeline_context_sender_destroy(PipelineContextSender* context);
-void pipeline_context_sender_destroy(PipelineContextSender *context);
+PipelineContextReceiver* pipeline_context_receiver_create(Config* config, Queue* queue_receiver,
-PipelineContextReceiver *pipeline_context_receiver_create(Config *config,
-                                                          Queue *queue_receiver,
                                                           int file_descriptor);
-void pipeline_context_receiver_destroy(PipelineContextReceiver *context);
+void pipeline_context_receiver_destroy(PipelineContextReceiver* context);
-int receive_thread(void *pipeline_context);
+int receive_thread(void* pipeline_context);
-int write_thread(void *pipeline_context);
+int write_thread(void* pipeline_context);
 #endif

src/shared/protocol.c

@@ -1,46 +1,106 @@
 #include "protocol.h"
 #include "log.h"
+#include <errno.h>
+#include <openssl/ssl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
 #include <unistd.h>
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
+static SSL* io_ssl = NULL;
+
+static unsigned long long io_bwlimit = 0;
+static long long bw_tokens = 0;
+static struct timespec bw_last_refill = {0, 0};
 
 void io_set_fds(int read_fd, int write_fd) {
   io_read_fd = read_fd;
   io_write_fd = write_fd;
 }
 
+void io_set_bwlimit(unsigned long long bytes_per_sec) {
+  io_bwlimit = bytes_per_sec;
+  bw_tokens = (long long)io_bwlimit;
+  clock_gettime(CLOCK_MONOTONIC, &bw_last_refill);
+}
+
+static void bw_throttle(size_t bytes_written) {
+  if (io_bwlimit == 0)
+    return;
+
+  struct timespec now;
+  clock_gettime(CLOCK_MONOTONIC, &now);
+
+  long long elapsed_ns =
+      (now.tv_sec - bw_last_refill.tv_sec) * 1000000000LL + (now.tv_nsec - bw_last_refill.tv_nsec);
+  bw_last_refill = now;
+
+  long long tokens_to_add = (long long)((double)io_bwlimit * elapsed_ns / 1000000000.0);
+  bw_tokens += tokens_to_add;
+  if (bw_tokens > (long long)io_bwlimit)
+    bw_tokens = (long long)io_bwlimit;
+
+  bw_tokens -= (long long)bytes_written;
+
+  if (bw_tokens < 0) {
+    long long deficit_ns = (long long)((double)(-bw_tokens) / io_bwlimit * 1000000000.0);
+    struct timespec sleep_time, remaining;
+    sleep_time.tv_sec = deficit_ns / 1000000000LL;
+    sleep_time.tv_nsec = deficit_ns % 1000000000LL;
+    while (nanosleep(&sleep_time, &remaining) < 0 && errno == EINTR)
+      sleep_time = remaining;
+    bw_tokens = 0;
+    clock_gettime(CLOCK_MONOTONIC, &bw_last_refill);
+  }
+}
+
+void io_set_ssl(SSL* ssl) {
+  io_ssl = ssl;
+}
+
 static int io_fd(int dir_fd, int file_descriptor) {
   return (dir_fd != -1) ? dir_fd : file_descriptor;
 }
 
-bool send_n_data(int file_descriptor, void *data, size_t data_size) {
+bool send_n_data(int file_descriptor, const void* data, size_t data_size) {
   log_message(LOG_LEVEL_DEBUG, "    Sending n Data: %zu", data_size);
   int fd = io_fd(io_write_fd, file_descriptor);
   ssize_t total_bytes_send = 0;
-  while (total_bytes_send < data_size) {
+  while ((size_t)total_bytes_send < data_size) {
-    ssize_t bytes_send =
+    size_t chunk = data_size - total_bytes_send;
-        write(fd, (char *)data + total_bytes_send, data_size - total_bytes_send);
+    if (io_bwlimit > 0 && chunk > 65536)
+      chunk = 65536;
+    ssize_t bytes_send;
+    if (io_ssl)
+      bytes_send = SSL_write(io_ssl, (const char*)data + total_bytes_send, chunk);
+    else
+      bytes_send = write(fd, (const char*)data + total_bytes_send, chunk);
     if (bytes_send <= 0) {
       log_message(LOG_LEVEL_ERROR, "Could not send data");
       return false;
     }
+    bw_throttle((size_t)bytes_send);
     total_bytes_send += bytes_send;
   }
   log_message(LOG_LEVEL_DEBUG, "    Send n Data: %zu", total_bytes_send);
   return true;
 }
 
-bool receive_n_data(int file_descriptor, void *data, size_t data_size) {
+bool receive_n_data(int file_descriptor, void* data, size_t data_size) {
   log_message(LOG_LEVEL_DEBUG, "    Receiving n Data: %zu", data_size);
   int fd = io_fd(io_read_fd, file_descriptor);
   size_t total_bytes_received = 0;
   while (total_bytes_received < data_size) {
-    ssize_t bytes_received =
+    ssize_t bytes_received;
-        read(fd, (char *)data + total_bytes_received, data_size - total_bytes_received);
+    if (io_ssl)
+      bytes_received =
+          SSL_read(io_ssl, (char*)data + total_bytes_received, data_size - total_bytes_received);
+    else
+      bytes_received =
+          read(fd, (char*)data + total_bytes_received, data_size - total_bytes_received);
     if (bytes_received <= 0) {
       if (bytes_received == 0)
         log_message(LOG_LEVEL_ERROR, "Connection closed while receiving data");
@@ -54,7 +114,7 @@ bool receive_n_data(int file_descriptor, void *data, size_t data_size) {
   return true;
 }
 
-static const char *status_to_string(Status status) {
+static const char* status_to_string(Status status) {
   switch (status) {
   case STATUS_OK:
     return "OK";
@@ -66,24 +126,34 @@ static const char *status_to_string(Status status) {
     return "NEXT";
   case STATUS_CHUNK:
     return "CHUNK";
+  case STATUS_CHECK:
+    return "CHECK";
+  case STATUS_DELTA_SIGNATURE:
+    return "DELTA_SIGNATURE";
+  case STATUS_DELTA_DATA:
+    return "DELTA_DATA";
   default:
     return "UNKNOWN";
   }
 }
 
-bool send_str(int file_descriptor, char *data) {
+bool send_str(int file_descriptor, const char* data) {
   size_t size = strlen(data);
-  if (!send_n_data(file_descriptor, &size, sizeof(size_t))) return false;
+  if (!send_n_data(file_descriptor, &size, sizeof(size_t)))
-  if (!send_n_data(file_descriptor, data, size)) return false;
+    return false;
+  if (!send_n_data(file_descriptor, data, size))
+    return false;
   log_message(LOG_LEVEL_DEBUG, "Send String: %s", data);
   return true;
 }
 
-char *receive_str(int file_descriptor) {
+char* receive_str(int file_descriptor) {
   size_t size;
-  if (!receive_n_data(file_descriptor, &size, sizeof(size_t))) return NULL;
+  if (!receive_n_data(file_descriptor, &size, sizeof(size_t)))
-  char *data = (char *)malloc(size + 1);
+    return NULL;
-  if (data == NULL) return NULL;
+  char* data = (char*)malloc(size + 1);
+  if (data == NULL)
+    return NULL;
   if (!receive_n_data(file_descriptor, data, size)) {
     free(data);
     return NULL;
@@ -93,7 +163,7 @@ char *receive_str(int file_descriptor) {
   return data;
 }
 
-bool send_data(int file_descriptor, Data *data) {
+bool send_data(int file_descriptor, const Data* data) {
   unsigned long long data_size = data->size;
   if (!send_n_data(file_descriptor, &data_size, sizeof(unsigned long long)))
     return false;
@@ -103,12 +173,13 @@ bool send_data(int file_descriptor, Data *data) {
   return true;
 }
 
-Data *receive_data(int file_descriptor) {
+Data* receive_data(int file_descriptor) {
   unsigned long long size = 0;
   if (!receive_n_data(file_descriptor, &size, sizeof(unsigned long long)))
     return NULL;
-  void *data = malloc((size_t)size);
+  void* data = malloc((size_t)size);
-  if (data == NULL) return NULL;
+  if (data == NULL)
+    return NULL;
   if (!receive_n_data(file_descriptor, data, (size_t)size)) {
     free(data);
     return NULL;
@@ -118,25 +189,29 @@ Data *receive_data(int file_descriptor) {
 }
 
 bool send_int(int file_descriptor, int data) {
-  if (!send_n_data(file_descriptor, &data, sizeof(int))) return false;
+  if (!send_n_data(file_descriptor, &data, sizeof(int)))
+    return false;
   log_message(LOG_LEVEL_DEBUG, "Send Int: %d", data);
   return true;
 }
 
-bool receive_int(int file_descriptor, int *data) {
+bool receive_int(int file_descriptor, int* data) {
-  if (!receive_n_data(file_descriptor, data, sizeof(int))) return false;
+  if (!receive_n_data(file_descriptor, data, sizeof(int)))
+    return false;
   log_message(LOG_LEVEL_DEBUG, "Received Int: %d", *data);
   return true;
 }
 
 bool send_status(int file_descriptor, Status status) {
-  if (!send_n_data(file_descriptor, &status, sizeof(Status))) return false;
+  if (!send_n_data(file_descriptor, &status, sizeof(Status)))
+    return false;
   log_message(LOG_LEVEL_DEBUG, "Send Status: %s", status_to_string(status));
   return true;
 }
 
-bool receive_status(int file_descriptor, Status *status) {
+bool receive_status(int file_descriptor, Status* status) {
-  if (!receive_n_data(file_descriptor, status, sizeof(Status))) return false;
+  if (!receive_n_data(file_descriptor, status, sizeof(Status)))
+    return false;
   log_message(LOG_LEVEL_DEBUG, "Received Status: %s", status_to_string(*status));
   return true;
 }

src/shared/protocol.h

@@ -5,20 +5,34 @@
 #include <stdbool.h>
 #include <stddef.h>
 
+typedef struct ssl_st SSL;
+
 typedef int Status;
-enum NET_STATUS { STATUS_OK, STATUS_ERROR, STATUS_FINISHED, STATUS_NEXT, STATUS_CHUNK, STATUS_MANIFEST };
+enum NET_STATUS {
+  STATUS_OK,
+  STATUS_ERROR,
+  STATUS_FINISHED,
+  STATUS_NEXT,
+  STATUS_CHUNK,
+  STATUS_MANIFEST,
+  STATUS_CHECK,
+  STATUS_DELTA_SIGNATURE,
+  STATUS_DELTA_DATA
+};
 
 void io_set_fds(int read_fd, int write_fd);
-bool send_n_data(int file_descriptor, void *data, size_t data_size);
+void io_set_bwlimit(unsigned long long bytes_per_sec);
-bool receive_n_data(int file_descriptor, void *data, size_t data_size);
+void io_set_ssl(SSL* ssl);
+bool send_n_data(int file_descriptor, const void* data, size_t data_size);
+bool receive_n_data(int file_descriptor, void* data, size_t data_size);
 
-bool send_str(int file_descriptor, char *data);
+bool send_str(int file_descriptor, const char* data);
-char *receive_str(int file_descriptor);
+char* receive_str(int file_descriptor);
-bool send_data(int file_descriptor, Data *data);
+bool send_data(int file_descriptor, const Data* data);
-Data *receive_data(int file_descriptor);
+Data* receive_data(int file_descriptor);
 bool send_int(int file_descriptor, int data);
-bool receive_int(int file_descriptor, int *data);
+bool receive_int(int file_descriptor, int* data);
 bool send_status(int file_descriptor, Status status);
-bool receive_status(int file_descriptor, Status *status);
+bool receive_status(int file_descriptor, Status* status);
 
 #endif

src/shared/queue.c

@@ -6,14 +6,14 @@
 
 #include "queue.h"
 
-Queue *queue_create(int capacity, void (*destroyer)(void *item)) {
+Queue* queue_create(int capacity, void (*destroyer)(void* item)) {
-  Queue *queue = (Queue *)malloc(sizeof(Queue));
+  Queue* queue = (Queue*)malloc(sizeof(Queue));
   if (queue == NULL) {
     perror("ERROR: Could not allocate memory for queue structure");
     return NULL;
   }
 
-  queue->items = malloc(capacity * sizeof(void *));
+  queue->items = malloc(capacity * sizeof(void*));
   if (queue->items == NULL) {
     free(queue);
     return NULL;
@@ -32,7 +32,7 @@ Queue *queue_create(int capacity, void (*destroyer)(void *item)) {
   return queue;
 }
 
-void queue_destroy(Queue *queue) {
+void queue_destroy(Queue* queue) {
   if (queue == NULL)
     return;
 
@@ -46,24 +46,25 @@ void queue_destroy(Queue *queue) {
   free(queue);
 }
 
-bool queue_is_empty(Queue *queue) {
+bool queue_is_empty(const Queue* queue) {
   if (queue == NULL)
     return true;
   return queue->size == 0;
 }
 
-bool queue_is_full(Queue *queue) {
+bool queue_is_full(const Queue* queue) {
   if (queue == NULL)
     return false;
   return queue->size == queue->capacity;
 }
 
-static bool queue_double_capacity(Queue *queue) {
+static bool queue_double_capacity(Queue* queue) {
-  if (queue == NULL) return false;
+  if (queue == NULL)
+    return false;
   unsigned int new_capacity = queue->capacity * 2;
   if (new_capacity <= 1)
     new_capacity = 100;
-  void **new_items = malloc(new_capacity * sizeof(void *));
+  void** new_items = malloc(new_capacity * sizeof(void*));
   if (new_items == NULL) {
     perror("ERROR: Could not allocate memory for doubling capacity of queue.");
     return false;
@@ -78,10 +79,12 @@ static bool queue_double_capacity(Queue *queue) {
   return true;
 }
 
-bool queue_enqueue(Queue *queue, void *item) {
+bool queue_enqueue(Queue* queue, void* item) {
-  if (queue == NULL || item == NULL) return false;
+  if (queue == NULL || item == NULL)
+    return false;
   if (queue_is_full(queue)) {
-    if (!queue_double_capacity(queue)) return false;
+    if (!queue_double_capacity(queue))
+      return false;
   }
   queue->items[queue->rear] = item;
   queue->rear = (queue->rear + 1) % queue->capacity;
@@ -89,9 +92,8 @@ bool queue_enqueue(Queue *queue, void *item) {
   return true;
 }
 
-bool queue_enqueue_multithreaded(Queue *queue, void *item, mtx_t *mutex,
+bool queue_enqueue_multithreaded(Queue* queue, void* item, mtx_t* mutex, cnd_t* condition_not_empty,
-                                 cnd_t *condition_not_empty,
+                                 cnd_t* condition_not_full) {
-                                 cnd_t *condition_not_full) {
   mtx_lock(mutex);
   while (queue_is_full(queue))
     cnd_wait(condition_not_full, mutex);
@@ -101,23 +103,21 @@ bool queue_enqueue_multithreaded(Queue *queue, void *item, mtx_t *mutex,
   return ok;
 }
 
-void *queue_dequeue(Queue *queue) {
+void* queue_dequeue(Queue* queue) {
   if (queue == NULL || queue_is_empty(queue)) {
     perror("ERROR: Could not dequeue from null or empty queue.");
     return NULL;
   }
 
-  void *item = queue->items[queue->front];
+  void* item = queue->items[queue->front];
   queue->items[queue->front] = NULL;
   queue->front = (queue->front + 1) % queue->capacity;
   queue->size--;
   return item;
 }
 
-void *queue_dequeue_multithreaded(Queue *queue, mtx_t *mutex,
+void* queue_dequeue_multithreaded(Queue* queue, mtx_t* mutex, cnd_t* condition_not_empty,
-                                  cnd_t *condition_not_empty,
+                                  cnd_t* condition_not_full, const bool* other_thread_done) {
-                                  cnd_t *condition_not_full,
-                                  bool *other_thread_done) {
   mtx_lock(mutex);
   while (queue_is_empty(queue) && !*other_thread_done)
     cnd_wait(condition_not_empty, mutex);
@@ -125,7 +125,7 @@ void *queue_dequeue_multithreaded(Queue *queue, mtx_t *mutex,
     mtx_unlock(mutex);
     return NULL;
   }
-  void *item = queue_dequeue(queue);
+  void* item = queue_dequeue(queue);
   cnd_signal(condition_not_full);
   mtx_unlock(mutex);
   return item;

src/shared/queue.h

@@ -5,26 +5,23 @@
 #include <threads.h>
 
 typedef struct Queue {
-  void **items;
+  void** items;
   int front;
   int rear;
   int size;
   int capacity;
-  void (*item_destroyer)(void *item);
+  void (*item_destroyer)(void* item);
 } Queue;
 
-Queue *queue_create(int capacity, void (*destroyer)(void *item));
+Queue* queue_create(int capacity, void (*destroyer)(void* item));
-void queue_destroy(Queue *queue);
+void queue_destroy(Queue* queue);
-bool queue_is_empty(Queue *queue);
+bool queue_is_empty(const Queue* queue);
-bool queue_is_full(Queue *queue);
+bool queue_is_full(const Queue* queue);
-bool queue_enqueue(Queue *queue, void *item);
+bool queue_enqueue(Queue* queue, void* item);
-bool queue_enqueue_multithreaded(Queue *queue, void *item, mtx_t *mutex,
+bool queue_enqueue_multithreaded(Queue* queue, void* item, mtx_t* mutex, cnd_t* condition_not_empty,
-                                 cnd_t *condition_not_empty,
+                                 cnd_t* condition_not_full);
-                                 cnd_t *condition_not_full);
+void* queue_dequeue(Queue* queue);
-void *queue_dequeue(Queue *queue);
+void* queue_dequeue_multithreaded(Queue* queue, mtx_t* mutex, cnd_t* condition_not_empty,
-void *queue_dequeue_multithreaded(Queue *queue, mtx_t *mutex,
+                                  cnd_t* condition_not_full, const bool* other_thread_done);
-                                  cnd_t *condition_not_empty,
-                                  cnd_t *condition_not_full,
-                                  bool *other_thread_done);
 
 #endif

src/shared/transport_ssh.c

@@ -13,36 +13,41 @@ typedef struct {
   char remote_path[4096];
 } RemoteDest;
 
-static int parse_remote_dest(const char *dest, RemoteDest *r) {
+static int parse_remote_dest(const char* dest, RemoteDest* r) {
-  const char *colon = strchr(dest, ':');
+  const char* colon = strchr(dest, ':');
-  if (!colon) return -1;
+  if (!colon)
+    return -1;
 
   size_t remote_path_len = strlen(colon + 1);
-  if (remote_path_len >= sizeof(r->remote_path)) return -1;
+  if (remote_path_len >= sizeof(r->remote_path))
+    return -1;
   memcpy(r->remote_path, colon + 1, remote_path_len + 1);
 
-  const char *at = memchr(dest, '@', colon - dest);
+  const char* at = memchr(dest, '@', colon - dest);
   if (at) {
     size_t user_len = at - dest;
-    if (user_len >= sizeof(r->user)) return -1;
+    if (user_len >= sizeof(r->user))
+      return -1;
     memcpy(r->user, dest, user_len);
     r->user[user_len] = '\0';
 
     size_t host_len = colon - at - 1;
-    if (host_len >= sizeof(r->host)) return -1;
+    if (host_len >= sizeof(r->host))
+      return -1;
     memcpy(r->host, at + 1, host_len);
     r->host[host_len] = '\0';
   } else {
     r->user[0] = '\0';
     size_t host_len = colon - dest;
-    if (host_len >= sizeof(r->host)) return -1;
+    if (host_len >= sizeof(r->host))
+      return -1;
     memcpy(r->host, dest, host_len);
     r->host[host_len] = '\0';
   }
   return 0;
 }
 
-Client *client_connect_ssh(char *destination, int port) {
+Client* client_connect_ssh(const char* destination, int port) {
   RemoteDest r;
   if (parse_remote_dest(destination, &r) != 0) {
     fprintf(stderr, "Invalid remote destination: %s\n", destination);
@@ -64,15 +69,18 @@ Client *client_connect_ssh(char *destination, int port) {
   int exec_pipe[2];
   if (pipe(exec_pipe) < 0) {
     perror("pipe failed");
-    close(sv[0]); close(sv[1]);
+    close(sv[0]);
+    close(sv[1]);
     return NULL;
   }
 
   pid_t pid = fork();
   if (pid < 0) {
     perror("fork failed");
-    close(sv[0]); close(sv[1]);
+    close(sv[0]);
-    close(exec_pipe[0]); close(exec_pipe[1]);
+    close(sv[1]);
+    close(exec_pipe[0]);
+    close(exec_pipe[1]);
     return NULL;
   }
 
@@ -85,7 +93,8 @@ Client *client_connect_ssh(char *destination, int port) {
       dup2(sv[1], STDIN_FILENO);
     if (sv[1] != STDOUT_FILENO)
       dup2(sv[1], STDOUT_FILENO);
-    if (sv[1] > 1) close(sv[1]);
+    if (sv[1] > 1)
+      close(sv[1]);
 
     char ssh_user[512];
     if (r.user[0] != '\0')
@@ -93,7 +102,7 @@ Client *client_connect_ssh(char *destination, int port) {
     else
       snprintf(ssh_user, sizeof(ssh_user), "%s", r.host);
 
-    char *ssh_argv[16];
+    char* ssh_argv[16];
     int ac = 0;
     char port_str[16];
     ssh_argv[ac++] = "ssh";
@@ -133,7 +142,7 @@ Client *client_connect_ssh(char *destination, int port) {
     return NULL;
   }
 
-  Client *client = malloc(sizeof(Client));
+  Client* client = malloc(sizeof(Client));
   if (client == NULL) {
     close(sv[0]);
     waitpid(pid, NULL, 0);
@@ -143,5 +152,7 @@ Client *client_connect_ssh(char *destination, int port) {
   client->address.sin_family = AF_UNIX;
   client->address_length = 0;
   client->ssh_child_pid = pid;
+  client->ssl = NULL;
+  client->ssl_ctx = NULL;
   return client;
 }

src/shared/transport_ssh.h

@@ -3,6 +3,6 @@
 
 #include "transport_tcp.h"
 
-Client *client_connect_ssh(char *destination, int port);
+Client* client_connect_ssh(const char* destination, int port);
 
 #endif

src/shared/transport_tcp.c

@@ -1,6 +1,8 @@
 #include "transport_tcp.h"
 #include "log.h"
+#include "protocol.h"
 #include <arpa/inet.h>
+#include <openssl/ssl.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -9,8 +11,8 @@
 #include <sys/wait.h>
 #include <unistd.h>
 
-Server *server_create(int port) {
+Server* server_create(int port) {
-  Server *server = (Server *)malloc(sizeof(Server));
+  Server* server = (Server*)malloc(sizeof(Server));
   if (server == NULL) {
     perror("Could not allocate space for Server");
     return NULL;
@@ -24,8 +26,7 @@ Server *server_create(int port) {
   }
   server->file_descriptor = file_descriptor;
   int opt = 1;
-  if (setsockopt(server->file_descriptor, SOL_SOCKET, SO_REUSEADDR, &opt,
+  if (setsockopt(server->file_descriptor, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt))) {
-                 sizeof(opt))) {
     perror("Error setting a socket option!");
     close(server->file_descriptor);
     free(server);
@@ -36,9 +37,10 @@ Server *server_create(int port) {
   server->address.sin_addr.s_addr = INADDR_ANY;
   server->address.sin_port = htons(port);
   server->address_length = sizeof(server->address);
+  server->ssl_ctx = NULL;
 
-  if (bind(server->file_descriptor, (struct sockaddr *)&server->address,
+  if (bind(server->file_descriptor, (struct sockaddr*)&server->address, server->address_length) <
-           server->address_length) < 0) {
+      0) {
     perror("Could not bind server");
     close(server->file_descriptor);
     free(server);
@@ -48,54 +50,74 @@ Server *server_create(int port) {
   return server;
 }
 
-void server_delete(Server **server) {
+void server_delete(Server** server) {
-  if (server == NULL || *server == NULL) return;
+  if (server == NULL || *server == NULL)
+    return;
   close((*server)->file_descriptor);
+  if ((*server)->ssl_ctx) {
+    SSL_CTX_free((*server)->ssl_ctx);
+    (*server)->ssl_ctx = NULL;
+  }
   free(*server);
   *server = NULL;
 }
 
-bool server_listen(Server *server, void (*handler)(int file_descriptor)) {
+static void accept_loop(Server* server, void (*child_fn)(int, void*), void* child_ctx,
-  log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d",
+                        const char* log_fmt) {
-              server->address.sin_port);
   if (listen(server->file_descriptor, SOMAXCONN) < 0) {
     perror("Could not listen on port!");
-    return false;
+    return;
   }
-
   signal(SIGCHLD, SIG_IGN);
-
   while (1) {
     struct sockaddr_in client_addr;
     socklen_t client_len = sizeof(client_addr);
-    int file_descriptor =
+    int fd = accept(server->file_descriptor, (struct sockaddr*)&client_addr, &client_len);
-        accept(server->file_descriptor, (struct sockaddr *)&client_addr,
+    if (fd < 0) {
-               &client_len);
-    if (file_descriptor < 0) {
       perror("Could not accept the connection");
       continue;
     }
-    log_message(LOG_LEVEL_INFO, "Received Connection");
+    log_message(LOG_LEVEL_INFO, "%s", log_fmt);
     pid_t pid = fork();
     if (pid == 0) {
       close(server->file_descriptor);
-      handler(file_descriptor);
+      child_fn(fd, child_ctx);
-      close(file_descriptor);
+      close(fd);
       _exit(0);
     }
-    close(file_descriptor);
+    close(fd);
   }
+}
+
+struct plain_ctx {
+  void (*handler)(int);
+};
+
+static void plain_child_fn(int fd, void* ctx) {
+  ((struct plain_ctx*)ctx)->handler(fd);
+}
+
+bool server_listen(Server* server, void (*handler)(int file_descriptor)) {
+  log_message(LOG_LEVEL_INFO, "Start Listening on Port: %d", ntohs(server->address.sin_port));
+  struct plain_ctx ctx = {handler};
+  accept_loop(server, plain_child_fn, &ctx, "Received Connection");
   return true;
 }
 
-Client *client_create() {
+void server_accept_loop(Server* server, void (*child_fn)(int, void*), void* child_ctx,
+                        const char* log_fmt) {
+  log_message(LOG_LEVEL_INFO, "Start TLS Listening on Port: %d", ntohs(server->address.sin_port));
+  accept_loop(server, child_fn, child_ctx, log_fmt);
+}
+
+Client* client_create() {
   int file_descriptor = socket(AF_INET, SOCK_STREAM, 0);
   if (file_descriptor < 0) {
     perror("Could not create Socket!");
     return NULL;
   }
 
-  Client *client = (Client *)malloc(sizeof(Client));
+  Client* client = (Client*)malloc(sizeof(Client));
   if (client == NULL) {
     close(file_descriptor);
     return NULL;
@@ -104,10 +126,12 @@ Client *client_create() {
   client->address.sin_family = AF_INET;
   client->address_length = sizeof(client->address);
   client->ssh_child_pid = -1;
+  client->ssl = NULL;
+  client->ssl_ctx = NULL;
   return client;
 }
 
-bool client_connect(Client *client, char *host, int port) {
+bool client_connect(Client* client, char* host, int port) {
   client->address.sin_port = htons(port);
 
   if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
@@ -115,15 +139,21 @@ bool client_connect(Client *client, char *host, int port) {
     return false;
   }
 
-  if (connect(client->file_descriptor, (struct sockaddr *)&client->address,
+  if (connect(client->file_descriptor, (struct sockaddr*)&client->address, client->address_length) <
-              client->address_length) < 0) {
+      0) {
     perror("Could not connect to Server!");
     return false;
   }
   return true;
 }
 
-void client_disconnect(Client *client) {
+void client_disconnect(Client* client) {
+  if (client->ssl) {
+    SSL_shutdown(client->ssl);
+    SSL_free(client->ssl);
+    client->ssl = NULL;
+    io_set_ssl(NULL);
+  }
   close(client->file_descriptor);
   if (client->ssh_child_pid > 0) {
     int status;
@@ -132,8 +162,12 @@ void client_disconnect(Client *client) {
   }
 }
 
-void client_delete(Client *client) {
+void client_delete(Client* client) {
   if (client == NULL)
     return;
+  if (client->ssl_ctx) {
+    SSL_CTX_free(client->ssl_ctx);
+    client->ssl_ctx = NULL;
+  }
   free(client);
 }

src/shared/transport_tcp.h

@@ -9,6 +9,7 @@ typedef struct Server {
   struct sockaddr_in address;
   unsigned int address_length;
   int file_descriptor;
+  void* ssl_ctx;
 } Server;
 
 typedef struct Client {
@@ -16,14 +17,18 @@ typedef struct Client {
   unsigned int address_length;
   int file_descriptor;
   pid_t ssh_child_pid;
+  void* ssl;
+  void* ssl_ctx;
 } Client;
 
-Server *server_create(int port);
+Server* server_create(int port);
-bool server_listen(Server *server, void (*handler)(int file_descriptor));
+bool server_listen(Server* server, void (*handler)(int file_descriptor));
-void server_delete(Server **server);
+void server_accept_loop(Server* server, void (*child_fn)(int, void*), void* child_ctx,
-Client *client_create();
+                        const char* log_fmt);
-bool client_connect(Client *client, char *host, int port);
+void server_delete(Server** server);
-void client_disconnect(Client *client);
+Client* client_create();
-void client_delete(Client *client);
+bool client_connect(Client* client, char* host, int port);
+void client_disconnect(Client* client);
+void client_delete(Client* client);
 
 #endif

src/shared/transport_tls.c

@@ -0,0 +1,161 @@
+#include "transport_tls.h"
+#include "log.h"
+#include "protocol.h"
+#include "transport_tcp.h"
+#include <arpa/inet.h>
+#include <openssl/err.h>
+#include <openssl/ssl.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+bool tls_global_init(void) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+  SSL_library_init();
+  OpenSSL_add_all_algorithms();
+  SSL_load_error_strings();
+#endif
+  return true;
+}
+
+static void log_ssl_errors(void) {
+  unsigned long err;
+  char buf[256];
+  while ((err = ERR_get_error()) != 0) {
+    ERR_error_string_n(err, buf, sizeof(buf));
+    log_message(LOG_LEVEL_ERROR, "SSL error: %s", buf);
+  }
+}
+
+static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key,
+                               const char* ca_path) {
+  const SSL_METHOD* method = is_server ? TLS_server_method() : TLS_client_method();
+  SSL_CTX* ctx = SSL_CTX_new(method);
+  if (!ctx) {
+    log_message(LOG_LEVEL_ERROR, "Unable to create SSL context");
+    log_ssl_errors();
+    return NULL;
+  }
+
+  SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
+
+  if (cert && key) {
+    if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) {
+      log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert);
+      log_ssl_errors();
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+    if (SSL_CTX_use_PrivateKey_file(ctx, key, SSL_FILETYPE_PEM) <= 0) {
+      log_message(LOG_LEVEL_ERROR, "Failed to load private key: %s", key);
+      log_ssl_errors();
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+    if (!SSL_CTX_check_private_key(ctx)) {
+      log_message(LOG_LEVEL_ERROR, "Private key does not match certificate");
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+  }
+
+  if (ca_path) {
+    if (!SSL_CTX_load_verify_locations(ctx, ca_path, NULL)) {
+      log_message(LOG_LEVEL_ERROR, "Failed to load CA: %s", ca_path);
+      log_ssl_errors();
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
+    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL);
+    SSL_CTX_set_verify_depth(ctx, 4);
+  }
+
+  return ctx;
+}
+
+static SSL* wrap_fd_with_ssl(int fd, SSL_CTX* ctx, bool is_server) {
+  SSL* ssl = SSL_new(ctx);
+  if (!ssl) {
+    log_message(LOG_LEVEL_ERROR, "Failed to create SSL object");
+    return NULL;
+  }
+  SSL_set_fd(ssl, fd);
+  int ret;
+  if (is_server)
+    ret = SSL_accept(ssl);
+  else
+    ret = SSL_connect(ssl);
+
+  if (ret <= 0) {
+    log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect");
+    log_ssl_errors();
+    SSL_free(ssl);
+    return NULL;
+  }
+  return ssl;
+}
+
+bool server_create_tls(Server* server, const char* cert_path, const char* key_path,
+                       const char* ca_path) {
+  SSL_CTX* ctx = create_ssl_ctx(true, cert_path, key_path, ca_path);
+  if (!ctx)
+    return false;
+  server->ssl_ctx = ctx;
+  return true;
+}
+
+struct tls_child_ctx {
+  void (*handler)(int);
+  SSL_CTX* ssl_ctx;
+};
+
+static void tls_child_fn(int fd, void* arg) {
+  struct tls_child_ctx* ctx = (struct tls_child_ctx*)arg;
+  SSL* ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true);
+  if (!ssl)
+    return;
+  io_set_ssl(ssl);
+  ctx->handler(fd);
+  SSL_shutdown(ssl);
+  SSL_free(ssl);
+  io_set_ssl(NULL);
+}
+
+bool server_listen_tls(Server* server, void (*handler)(int file_descriptor)) {
+  struct tls_child_ctx ctx = {handler, (SSL_CTX*)server->ssl_ctx};
+  server_accept_loop(server, tls_child_fn, &ctx, "Received TLS Connection");
+  return true;
+}
+
+bool client_connect_tls(Client* client, char* host, int port, const char* cert_path,
+                        const char* key_path, const char* ca_path) {
+  client->address.sin_port = htons(port);
+  if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
+    perror("Could not convert host address!");
+    return false;
+  }
+  if (connect(client->file_descriptor, (struct sockaddr*)&client->address, client->address_length) <
+      0) {
+    perror("Could not connect to Server!");
+    return false;
+  }
+
+  SSL_CTX* ctx = create_ssl_ctx(false, cert_path, key_path, ca_path);
+  if (!ctx)
+    return false;
+  client->ssl_ctx = ctx;
+
+  SSL* ssl = wrap_fd_with_ssl(client->file_descriptor, ctx, false);
+  if (!ssl) {
+    SSL_CTX_free(ctx);
+    client->ssl_ctx = NULL;
+    return false;
+  }
+  client->ssl = ssl;
+  io_set_ssl(ssl);
+  return true;
+}

src/shared/transport_tls.h

@@ -0,0 +1,15 @@
+#ifndef TRANSPORT_TLS_H
+#define TRANSPORT_TLS_H
+
+#include "transport_tcp.h"
+#include <stdbool.h>
+
+bool tls_global_init(void);
+
+bool server_create_tls(Server* server, const char* cert_path, const char* key_path,
+                       const char* ca_path);
+bool server_listen_tls(Server* server, void (*handler)(int file_descriptor));
+bool client_connect_tls(Client* client, char* host, int port, const char* cert_path,
+                        const char* key_path, const char* ca_path);
+
+#endif

src/shared/utils.c

@@ -8,21 +8,25 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-bool mkdir_r(char *path) {
+bool mkdir_r(const char* path) {
-  char *path_duplicate = malloc(strlen(path) + 1);
+  char* path_duplicate = malloc(strlen(path) + 1);
-  if (!path_duplicate) return false;
+  if (!path_duplicate)
+    return false;
   strcpy(path_duplicate, path);
-  char *path_current = (char *)malloc((strlen(path) + 2) * sizeof(char));
+  char* path_current = (char*)malloc((strlen(path) + 2) * sizeof(char));
-  if (!path_current) { free(path_duplicate); return false; }
+  if (!path_current) {
-  char *path_current_position = path_current;
+    free(path_duplicate);
+    return false;
+  }
+  char* path_current_position = path_current;
   if (path[0] == '/') {
     strcpy(path_current, "/");
     path_current_position += 1;
   } else {
     path_current[0] = '\0';
   }
-  const char *delimiter = "/";
+  const char* delimiter = "/";
-  char *part = strtok(path_duplicate, delimiter);
+  const char* part = strtok(path_duplicate, delimiter);
   bool ok = true;
   while (part != NULL) {
     strcpy(path_current_position, part);
@@ -44,15 +48,15 @@ bool mkdir_r(char *path) {
   return ok;
 }
 
-char *str_dup(const char *string) {
+char* str_dup(const char* string) {
   if (string == NULL)
     return NULL;
-  char *new_string = (char *)malloc(strlen(string) + 1);
+  char* new_string = (char*)malloc(strlen(string) + 1);
   strcpy(new_string, string);
   return new_string;
 }
 
-bool glob_match(const char *pattern, const char *str) {
+bool glob_match(const char* pattern, const char* str) {
   while (*pattern) {
     if (*pattern == '*') {
       pattern++;
@@ -77,17 +81,16 @@ bool glob_match(const char *pattern, const char *str) {
   return *str == '\0';
 }
 
-static void delete_extras_walk(const char *abs_path, const char *rel_path,
+static void delete_extras_walk(const char* abs_path, const char* rel_path, ArrayList* manifest) {
-                               ArrayList *manifest) {
+  DIR* dir = opendir(abs_path);
-  DIR *dir = opendir(abs_path);
   if (!dir)
     return;
-  struct dirent *entry;
+  struct dirent* entry;
   while ((entry = readdir(dir)) != NULL) {
     if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
       continue;
-    char *child_abs = path_cat((char *)abs_path, entry->d_name);
+    char* child_abs = path_cat((char*)abs_path, entry->d_name);
-    char *child_rel = path_cat((char *)rel_path, entry->d_name);
+    char* child_rel = path_cat((char*)rel_path, entry->d_name);
     struct stat st;
     if (stat(child_abs, &st) != 0) {
       free(child_abs);
@@ -100,7 +103,7 @@ static void delete_extras_walk(const char *abs_path, const char *rel_path,
       // Check if relative path is in manifest
       bool found = false;
       for (int i = 0; i < manifest->size; i++) {
-        if (strcmp((char *)manifest->items[i], child_rel) == 0) {
+        if (strcmp((char*)manifest->items[i], child_rel) == 0) {
           found = true;
           break;
         }
@@ -117,26 +120,27 @@ static void delete_extras_walk(const char *abs_path, const char *rel_path,
   rmdir(abs_path);
 }
 
-void delete_extras(const char *dest_root, ArrayList *manifest) {
+void delete_extras(const char* dest_root, ArrayList* manifest) {
   delete_extras_walk(dest_root, "", manifest);
 }
 
-char *path_cat(char *path1, char *path2) {
+char* path_cat(const char* path1, char* path2) {
   if (path1 == NULL || *path1 == '\0')
     return str_dup(path2);
   if (path2 == NULL || *path2 == '\0')
     return str_dup(path1);
   int path1_len = strlen(path1);
   int path2_len = strlen(path2);
-  char *path2_pointer = path2;
+  char* path2_pointer = path2;
   if (path1[path1_len - 1] == '/')
     path1_len -= 1;
   if (path2[0] == '/') {
     path2_pointer += 1;
     path2_len -= 1;
   }
-  char *new_path = malloc(path1_len + path2_len + 2);
+  char* new_path = malloc(path1_len + path2_len + 2);
-  if (new_path == NULL) return NULL;
+  if (new_path == NULL)
+    return NULL;
   memcpy(new_path, path1, path1_len);
   new_path[path1_len] = '/';
   memcpy(new_path + path1_len + 1, path2_pointer, path2_len);

src/shared/utils.h

@@ -4,10 +4,10 @@
 #include "array_list.h"
 #include <stdbool.h>
 
-bool mkdir_r(char *path);
+bool mkdir_r(const char* path);
-char *str_dup(const char *string);
+char* str_dup(const char* string);
-char *path_cat(char *path1, char *path2);
+char* path_cat(const char* path1, char* path2);
-bool glob_match(const char *pattern, const char *str);
+bool glob_match(const char* pattern, const char* str);
-void delete_extras(const char *dest_root, ArrayList *manifest);
+void delete_extras(const char* dest_root, ArrayList* manifest);
 
 #endif

test.py

@@ -1,673 +0,0 @@
-import argparse
-import filecmp
-import os
-import random
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-import time
-import socket
-
-TEST_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), "test_data")
-DEFAULT_SOURCE_DIR = os.path.join(TEST_DIR, "source")
-DEFAULT_DEST_DIR = os.path.join(TEST_DIR, "dest")
-
-SERVER_CMD = ["./build/server"]
-BASE_CLIENT_CMD = ["./build/client"]
-
-DISK_DEVICE = "/dev/nvme0n1p5"
-READ_BPS_MAX = "15M"
-WRITE_BPS_MAX = "10M"
-NETWORK_INTERFACE = "lo"
-
-NETWORK_PROFILES = {
-    "Unlimited": {},
-    "LAN": {
-        "rate": "1000mbit",
-        "delay": "20ms",
-        "jitter": "1ms",
-        "loss": "0.1%",
-    },
-    "WAN": {
-        "rate": "100mbit",
-        "delay": "50ms",
-        "jitter": "10ms",
-        "loss": "1%",
-    },
-}
-
-CLIENT_CMD_PREFIX = [
-    "sudo",
-    "systemd-run",
-    "--scope",
-    "-p",
-    f"IOReadBandwidthMax={DISK_DEVICE} {READ_BPS_MAX}",
-    "-p",
-    f"IOWriteBandwidthMax={DISK_DEVICE} {WRITE_BPS_MAX}",
-]
-
-BASE_CLIENT_FLAGS = ["--save-to-disk"]
-
-TEST_CASES = [
-    {"name": "Standard", "flags": []},
-    {"name": "Posix Args (no flags)", "flags": [], "posix": True},
-    {"name": "Standard (no metadata)", "flags": [], "use_metadata": False},
-    {"name": "Multithreading (-m)", "flags": ["-m"]},
-    {"name": "Compression (-c)", "flags": ["-c"]},
-    {"name": "Chunk Serialization (-s)", "flags": ["-s"]},
-    {"name": "Compression + Chunk Serialization (-c -s)", "flags": ["-c", "-s"]},
-    {"name": "Multithreading + Compression (-m -c)", "flags": ["-m", "-c"]},
-    {"name": "Multithreading + Chunk Serialization (-m -s)", "flags": ["-m", "-s"]},
-    {
-        "name": "Multithreading + Compression + Chunk Serialization (-m -c -s)",
-        "flags": ["-m", "-c", "-s"],
-    },
-    {"name": "Sendfile (-f)", "flags": ["-f"]},
-    {"name": "Sendfile + Multithreading (-f -m)", "flags": ["-f", "-m"]},
-]
-
-SSH_CASES = [
-    {"name": "SSH (localhost)", "flags": []},
-    {"name": "SSH Multithreading (-m)", "flags": ["-m"]},
-    {"name": "SSH Compression (-c)", "flags": ["-c"]},
-    {"name": "SSH Chunk Serialization (-s)", "flags": ["-s"]},
-    {"name": "SSH Compression + Chunk Serialization (-c -s)", "flags": ["-c", "-s"]},
-    {"name": "SSH Multithreading + Compression (-m -c)", "flags": ["-m", "-c"]},
-    {"name": "SSH Multithreading + Chunk Serialization (-m -s)", "flags": ["-m", "-s"]},
-    {"name": "SSH Multithreading + Compression + Chunk Serialization (-m -c -s)", "flags": ["-m", "-c", "-s"]},
-]
-
-RSYNC_CASES = [
-    {"name": "rsync (archive)", "args": ["-aH"]},
-    {"name": "rsync (archive + compress)", "args": ["-aHz"]},
-]
-
-
-def netem_apply(profile):
-    params = NETWORK_PROFILES[profile]
-    if not params:
-        netem_reset()
-        return
-    netem_reset()
-    cmd = ["sudo", "tc", "qdisc", "add", "dev", NETWORK_INTERFACE, "root", "netem"]
-    cmd += ["rate", params["rate"]]
-    cmd += ["delay", params["delay"], params["jitter"]]
-    cmd += ["loss", params["loss"]]
-    subprocess.run(cmd, check=True, capture_output=True)
-
-
-def netem_reset():
-    subprocess.run(
-        f"sudo tc qdisc del dev {NETWORK_INTERFACE} root".split(),
-        capture_output=True,
-    )
-
-
-def wait_proc(proc, timeout=5):
-    try:
-        proc.wait(timeout=timeout)
-    except subprocess.TimeoutExpired:
-        proc.kill()
-        proc.wait()
-
-
-def find_free_port():
-    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(('', 0))
-        return s.getsockname()[1]
-
-
-def generate_test_files(source_dir):
-    if os.path.exists(source_dir):
-        shutil.rmtree(source_dir)
-    os.makedirs(source_dir)
-
-    target_total = 25 * 1024 * 1024
-    written = 0
-
-    files = {
-        "small.txt": b"hello world\n",
-        "medium.txt": b"the quick brown fox jumps over the lazy dog\n" * 5000,
-        "binary.bin": bytes(range(256)) * 1000,
-        "nested/subdir/deep.txt": b"deeply nested file\n",
-        "nested/another.txt": b"another nested file\n" * 50,
-    }
-    for rel_path, content in files.items():
-        full_path = os.path.join(source_dir, rel_path)
-        os.makedirs(os.path.dirname(full_path), exist_ok=True)
-        with open(full_path, "wb") as f:
-            f.write(content)
-        written += len(content)
-
-    os.makedirs(os.path.join(source_dir, "bulk"), exist_ok=True)
-    i = 0
-    while written < target_total:
-        chunk_size = min(5 * 1024 * 1024, target_total - written)
-        with open(os.path.join(source_dir, f"bulk/file_{i}.dat"), "wb") as f:
-            f.write(random.randbytes(chunk_size))
-        written += chunk_size
-        i += 1
-
-    total_mb = written / (1024 * 1024)
-    small_bytes = sum(len(c) for c in files.values())
-    print(f"  Generated {total_mb:.1f} MB of test data in {source_dir} "
-          f"({(written - small_bytes)/(1024*1024):.1f} MB random, "
-          f"{small_bytes} B structured)")
-    return written
-
-
-def verify_transfer(source_dir, received_dir):
-    source_dir = os.path.abspath(source_dir)
-    received_dir = os.path.abspath(received_dir)
-    if not os.path.exists(received_dir):
-        return [], ["no received files found"]
-    mismatches, missing = [], []
-    for root, dirs, files in os.walk(source_dir):
-        for f in files:
-            src_path = os.path.join(root, f)
-            rel = os.path.relpath(src_path, source_dir)
-            dst_path = os.path.join(received_dir, rel)
-            if not os.path.exists(dst_path):
-                missing.append(rel)
-            elif not filecmp.cmp(src_path, dst_path, shallow=False):
-                mismatches.append(rel)
-    return mismatches, missing
-
-
-def start_rsync_daemon(source_dir):
-    port = find_free_port()
-    conf = os.path.join(tempfile.gettempdir(), f"rsyncd-{port}.conf")
-    with open(conf, "w") as f:
-        f.write(f"port = {port}\nread only = yes\n\n[source]\n    path = {source_dir}\n")
-    daemon = subprocess.Popen(
-        ["rsync", "--daemon", "--no-detach", f"--config={conf}"],
-        stdout=subprocess.DEVNULL, stderr=None,
-    )
-    for _ in range(50):
-        time.sleep(0.1)
-        if daemon.poll() is not None:
-            raise RuntimeError(f"rsync daemon exited (rc={daemon.returncode})")
-        try:
-            with socket.create_connection(("127.0.0.1", port), timeout=0.3):
-                break
-        except (ConnectionRefusedError, OSError):
-            continue
-    else:
-        raise RuntimeError("rsync daemon did not start")
-    return port, conf, daemon
-
-
-def run_single_test(cmd, name, source_dir, dest_dir, *, source_prefix=None, no_server=False, expected_missing=None):
-    if os.path.exists(dest_dir):
-        shutil.rmtree(dest_dir)
-    if no_server:
-        server = None
-    else:
-        server = subprocess.Popen(SERVER_CMD, stdout=subprocess.DEVNULL, stderr=None)
-        time.sleep(0.5)
-    try:
-        start = time.monotonic()
-        result = subprocess.run(cmd, text=True, capture_output=True)
-        duration = time.monotonic() - start
-    finally:
-        if server:
-            wait_proc(server)
-
-    mismatches, missing = [], []
-    if result.returncode == 0:
-        received = os.path.join(dest_dir, source_prefix if source_prefix is not None
-                                else os.path.abspath(source_dir).lstrip(os.sep))
-        mismatches, missing = verify_transfer(source_dir, received)
-        if expected_missing:
-            missing = [m for m in missing if m not in expected_missing]
-
-    first_line = lambda s: (s or "").strip().split("\n")[0]
-    entry = {
-        "name": name,
-        "time": f"{duration:.4f}s" if result.returncode == 0 else "N/A",
-    }
-    if result.returncode == 0 and not mismatches and not missing:
-        entry["status"] = "Success"
-        entry["error"] = ""
-    else:
-        entry["status"] = "Failed"
-        errors = []
-        if result.returncode != 0:
-            errors.append(f"Exit code {result.returncode}: {first_line(result.stderr) or first_line(result.stdout) or 'No output'[:80]}")
-        if missing:
-            errors.append(f"Missing ({len(missing)}): {', '.join(missing[:5])}")
-        if mismatches:
-            errors.append(f"Mismatch ({len(mismatches)}): {', '.join(mismatches[:3])}")
-        entry["error"] = " | ".join(errors)
-    return entry
-
-
-def print_profile_header(profile_name):
-    params = NETWORK_PROFILES[profile_name]
-    print(f"\n{'=' * 60}\nProfile: {profile_name}\n{'=' * 60}")
-    if params:
-        print(f"  Network: rate={params['rate']}, delay={params['delay']} ±{params['jitter']}, loss={params['loss']}")
-        print(f"  Disk I/O: Reads <= {READ_BPS_MAX}, Writes <= {WRITE_BPS_MAX}")
-    else:
-        print("  No limits applied")
-
-
-def run_profile(profile_name, source_dir, dest_dir):
-    print_profile_header(profile_name)
-    is_limited = profile_name != "Unlimited"
-    client_prefix = CLIENT_CMD_PREFIX if is_limited else []
-
-    try:
-        if is_limited:
-            netem_apply(profile_name)
-        else:
-            netem_reset()
-
-        results = []
-        for case in TEST_CASES:
-            flags = BASE_CLIENT_FLAGS + (["-M"] if case.get("use_metadata", True) else []) + case["flags"]
-            if case.get("posix"):
-                cmd = client_prefix + BASE_CLIENT_CMD + [source_dir, dest_dir] + flags
-            else:
-                cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + flags
-            print(f"\n  --- {case['name']} ---\n    Running: {' '.join(cmd)}")
-            try:
-                r = run_single_test(cmd, case["name"], source_dir, dest_dir)
-                r["suite"] = profile_name
-                results.append(r)
-            except Exception as e:
-                results.append({"name": case["name"], "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        if SSH_AVAILABLE:
-            for case in SSH_CASES:
-                flags = BASE_CLIENT_FLAGS + (["-M"] if case.get("use_metadata", True) else []) + case["flags"]
-                ssh_dest = f"localhost:{dest_dir}_ssh"
-                cmd = BASE_CLIENT_CMD + [source_dir, ssh_dest] + flags
-                print(f"\n  --- {case['name']} ---\n    Running: {' '.join(cmd)}")
-                try:
-                    r = run_single_test(cmd, case["name"], source_dir, f"{dest_dir}_ssh", no_server=True)
-                    r["suite"] = profile_name
-                    results.append(r)
-                except Exception as e:
-                    results.append({"name": case["name"], "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-    
-        port, conf, daemon = start_rsync_daemon(source_dir)
-        try:
-            for case in RSYNC_CASES:
-                cmd = client_prefix + ["rsync"] + case["args"] + [f"rsync://localhost:{port}/source/", f"{dest_dir}/"]
-                print(f"\n  --- {case['name']} ---\n    Running: {' '.join(cmd)}")
-                try:
-                    r = run_single_test(cmd, case["name"], source_dir, dest_dir, source_prefix="")
-                    r["suite"] = profile_name
-                except subprocess.TimeoutExpired:
-                    r = {"name": case["name"], "suite": profile_name, "status": "Timeout", "time": "N/A", "error": "Exceeded 120s"}
-                except Exception as e:
-                    r = {"name": case["name"], "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)}
-                else:
-                    if r["status"] != "Success" and client_prefix:
-                        tmp = tempfile.mkdtemp()
-                        try:
-                            plain = subprocess.run(["rsync", "-aH", f"rsync://localhost:{port}/source/", f"{tmp}/"], capture_output=True, text=True, timeout=30)
-                            if plain.returncode != 0:
-                                errs = [l for l in (plain.stderr or "").split("\n") if l.strip()]
-                                if errs:
-                                    r["error"] += f" | raw: {errs[-1][:150]}"
-                        finally:
-                            shutil.rmtree(tmp, ignore_errors=True)
-                results.append(r)
-        finally:
-            wait_proc(daemon)
-            try:
-                os.unlink(conf)
-            except Exception:
-                pass
-
-        # Feature-specific tests for rsync-compatible flags
-        print("\n  " + "─" * 56 + "\n  Feature Tests\n  " + "─" * 56)
-
-        # Dry run (-n) — no server needed
-        print("\n  --- Dry run (-n) ---")
-        flags = BASE_CLIENT_FLAGS + ["-n"]
-        cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + flags
-        print(f"    Running: {' '.join(cmd)}")
-        try:
-            start = time.monotonic()
-            result = subprocess.run(cmd, text=True, capture_output=True)
-            duration = time.monotonic() - start
-            r = {"name": "Dry run (-n)", "suite": profile_name}
-            if result.returncode == 0 and "Dry run:" in result.stdout:
-                r["status"] = "Success"
-                r["time"] = f"{duration:.4f}s"
-                r["error"] = ""
-            else:
-                r["status"] = "Failed"
-                r["time"] = "N/A"
-                r["error"] = f"Exit {result.returncode}: {(result.stderr or result.stdout)[:100]}"
-            results.append(r)
-        except Exception as e:
-            results.append({"name": "Dry run (-n)", "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        # Archive mode (-a)
-        feature_flags = BASE_CLIENT_FLAGS + ["-a"]
-        cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + feature_flags
-        print(f"\n  --- Archive mode (-a) ---\n    Running: {' '.join(cmd)}")
-        try:
-            r = run_single_test(cmd, "Archive mode (-a)", source_dir, dest_dir)
-            r["suite"] = profile_name
-            results.append(r)
-        except Exception as e:
-            results.append({"name": "Archive mode (-a)", "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        # Exclude (--exclude small.txt)
-        feature_flags = BASE_CLIENT_FLAGS + ["--exclude", "small.txt"]
-        cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + feature_flags
-        print(f"\n  --- Exclude (--exclude small.txt) ---\n    Running: {' '.join(cmd)}")
-        try:
-            r = run_single_test(cmd, "Exclude (--exclude small.txt)", source_dir, dest_dir,
-                                expected_missing=["small.txt"])
-            r["suite"] = profile_name
-            results.append(r)
-        except Exception as e:
-            results.append({"name": "Exclude (--exclude small.txt)", "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        # Progress (--progress)
-        feature_flags = BASE_CLIENT_FLAGS + ["--progress"]
-        cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + feature_flags
-        print(f"\n  --- Progress (--progress) ---\n    Running: {' '.join(cmd)}")
-        try:
-            r = run_single_test(cmd, "Progress (--progress)", source_dir, dest_dir)
-            r["suite"] = profile_name
-            results.append(r)
-        except Exception as e:
-            results.append({"name": "Progress (--progress)", "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        # Chunk size (--chunk-size 5242880)
-        feature_flags = BASE_CLIENT_FLAGS + ["--chunk-size", "5242880"]
-        cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + feature_flags
-        print(f"\n  --- Chunk size (--chunk-size 5242880) ---\n    Running: {' '.join(cmd)}")
-        try:
-            r = run_single_test(cmd, "Chunk size (--chunk-size 5242880)", source_dir, dest_dir)
-            r["suite"] = profile_name
-            results.append(r)
-        except Exception as e:
-            results.append({"name": "Chunk size (--chunk-size 5242880)", "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        # Delete (--delete) — pre-populate dest, add extra files, then sync with --delete
-        # Note: server handles one client per launch, so we restart between syncs
-        print(f"\n  --- Delete (--delete) ---")
-        try:
-            flags = BASE_CLIENT_FLAGS + ["-M"]
-            # First sync (no delete) to populate dest
-            s1 = subprocess.Popen(SERVER_CMD, stdout=subprocess.DEVNULL, stderr=None)
-            time.sleep(0.5)
-            first_cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + flags
-            r1 = subprocess.run(first_cmd, text=True, capture_output=True)
-            wait_proc(s1)
-            if r1.returncode != 0:
-                raise RuntimeError(f"First sync failed: {r1.stderr[:100]}")
-            # Add extra files to received dir
-            received = os.path.join(dest_dir, os.path.abspath(source_dir).lstrip(os.sep))
-            extra_path = os.path.join(received, "extra_file.txt")
-            with open(extra_path, "w") as f:
-                f.write("should be deleted")
-            extra_dir = os.path.join(received, "extra_dir")
-            os.makedirs(extra_dir, exist_ok=True)
-            with open(os.path.join(extra_dir, "nested.txt"), "w") as f:
-                f.write("nested extra")
-            # Second sync with --delete (fresh server)
-            s2 = subprocess.Popen(SERVER_CMD, stdout=subprocess.DEVNULL, stderr=None)
-            time.sleep(0.5)
-            second_cmd = client_prefix + BASE_CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir] + flags + ["--delete"]
-            start = time.monotonic()
-            r2 = subprocess.run(second_cmd, text=True, capture_output=True)
-            duration = time.monotonic() - start
-            wait_proc(s2)
-            r = {"name": "Delete (--delete)", "suite": profile_name}
-            if r2.returncode == 0 and not os.path.exists(extra_path) and not os.path.exists(extra_dir):
-                mismatches, missing = verify_transfer(source_dir, received)
-                if not mismatches and not missing:
-                    r["status"] = "Success"
-                    r["time"] = f"{duration:.4f}s"
-                    r["error"] = ""
-                else:
-                    r["status"] = "Failed"
-                    r["time"] = "N/A"
-                    r["error"] = f"post-delete verify: mismatches={len(mismatches)}, missing={len(missing)}"
-            else:
-                r["status"] = "Failed"
-                r["time"] = "N/A"
-                errs = []
-                if r2.returncode != 0:
-                    errs.append(f"Exit {r2.returncode}: {(r2.stderr or r2.stdout)[:60]}")
-                if os.path.exists(extra_path):
-                    errs.append("extra_file.txt remains")
-                if os.path.exists(extra_dir):
-                    errs.append("extra_dir remains")
-                r["error"] = " | ".join(errs)
-            results.append(r)
-        except Exception as e:
-            results.append({"name": "Delete (--delete)", "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-        # SSH feature tests
-        if SSH_AVAILABLE:
-            ssh_dest = f"localhost:{dest_dir}_ssh"
-            ssh_feature_cases = [
-                {"name": "SSH Archive (-a)", "flags": ["-a"]},
-                {"name": "SSH Exclude (--exclude small.txt)", "flags": ["--exclude", "small.txt"], "expected_missing": ["small.txt"]},
-            ]
-            for case in ssh_feature_cases:
-                flags = BASE_CLIENT_FLAGS + case["flags"]
-                cmd = BASE_CLIENT_CMD + [source_dir, ssh_dest] + flags
-                print(f"\n  --- {case['name']} ---\n    Running: {' '.join(cmd)}")
-                try:
-                    r = run_single_test(cmd, case["name"], source_dir, f"{dest_dir}_ssh",
-                                        no_server=True,
-                                        expected_missing=case.get("expected_missing"))
-                    r["suite"] = profile_name
-                    results.append(r)
-                except Exception as e:
-                    results.append({"name": case["name"], "suite": profile_name, "status": "Error", "time": "N/A", "error": str(e)})
-
-    except (subprocess.CalledProcessError, RuntimeError) as e:
-        print(f"  Error: {e}")
-        results = []
-    finally:
-        if is_limited:
-            try:
-                netem_reset()
-            except Exception:
-                pass
-
-    return results
-
-
-def print_metrics(profile_name, results, total_bytes):
-    params = NETWORK_PROFILES.get(profile_name)
-    if not params or "rate" not in params:
-        return
-
-    client_times, rsync_times = [], {}
-    for r in results:
-        if r["status"] != "Success" or r["time"] == "N/A":
-            continue
-        t = float(r["time"].rstrip("s"))
-        if r["name"].startswith("rsync"):
-            rsync_times[r["name"]] = t
-        elif "Dry run" not in r["name"]:
-            client_times.append((t, r["name"]))
-    if not client_times or len(rsync_times) < 2:
-        return
-
-    m = re.match(r'(\d+)\s*(mbit|gbit|kbit|bit)', params["rate"])
-    rate_val = int(m.group(1)) * {'mbit': 1_000_000, 'gbit': 1_000_000_000, 'kbit': 1000, 'bit': 1}[m.group(2)] / 8 if m else None
-
-    best_time, best_name = min(client_times, key=lambda x: x[0])
-    theoretical_max = total_bytes / rate_val if rate_val else None
-
-    print(f"\n  {'─' * 90}\n  Profile: {profile_name}\n  {'─' * 90}")
-    print(f"  Total data size:               {total_bytes / (1024*1024):.1f} MB")
-    if rate_val:
-        print(f"  Network rate:                  {params['rate']} ({format_throughput(rate_val)})")
-    print(f"  Best client configuration:     {best_name}")
-    print(f"  Best client time:              {best_time:.4f}s")
-    if theoretical_max:
-        print(f"  Theoretical max (uncompressed): {theoretical_max:.4f}s")
-        print(f"  Speedup vs theoretical max:    {theoretical_max / best_time:.2f}x")
-    if (a := rsync_times.get("rsync (archive)")):
-        print(f"  Speedup vs rsync (archive):    {a / best_time:.2f}x")
-    if (c := rsync_times.get("rsync (archive + compress)")):
-        print(f"  Speedup vs rsync (compress):   {c / best_time:.2f}x")
-
-
-def format_throughput(bps):
-    for unit, threshold in [("GB/s", 1_000_000_000), ("MB/s", 1_000_000), ("KB/s", 1000)]:
-        if bps >= threshold:
-            return f"{bps/threshold:.1f} {unit}"
-    return f"{bps:.0f} B/s"
-
-
-SSH_AVAILABLE = False
-
-def check_ssh_localhost():
-    global SSH_AVAILABLE
-    build_dir = os.path.abspath("build")
-    server_path = os.path.join(build_dir, "server")
-
-    r = subprocess.run(["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5",
-                        "localhost", "which", "fastsync-server"],
-                       capture_output=True, timeout=10)
-    if r.returncode == 0:
-        SSH_AVAILABLE = True
-        return
-
-    SSH_AVAILABLE = False
-    # Try each PATH dir: create symlink, then verify with which
-    r = subprocess.run(
-        ["ssh", "-o", "BatchMode=yes", "localhost",
-         'echo "$PATH"'],
-        capture_output=True, timeout=10, text=True)
-    if r.returncode != 0:
-        return
-    for d in r.stdout.strip().split(":"):
-        d = d.strip()
-        if not d:
-            continue
-        if "wrappers" in d:
-            continue
-        test = subprocess.run(
-            ["ssh", "-o", "BatchMode=yes", "localhost",
-             f'test -w "{d}" && ln -sf {server_path} "{d}/fastsync-server" && which fastsync-server'],
-            capture_output=True, timeout=10)
-        if test.returncode == 0:
-            SSH_AVAILABLE = True
-            return
-
-
-def preflight_checks():
-    global SSH_AVAILABLE
-    errors = []
-    print("Pre-flight checks:")
-    print("  [1] --help flag...", end=" ")
-    r = subprocess.run(BASE_CLIENT_CMD + ["--help"], capture_output=True, text=True)
-    if r.returncode == 0 and "Usage:" in r.stdout and "SSH transport" in r.stdout:
-        print("OK")
-    else:
-        print("FAIL")
-        errors.append("--help failed")
-
-    print("  [2] Remote SSH dest detection...", end=" ")
-    r = subprocess.run(BASE_CLIENT_CMD + ["/x", "somehost:/y"], capture_output=True, text=True, timeout=5)
-    if r.returncode != 0 and ("ssh" in r.stderr or "Could not receive" in r.stderr or "could not launch" in r.stderr or "Error" in r.stderr):
-        print("OK (detected as SSH)")
-    else:
-        print("FAIL (not detected as SSH dest)")
-        errors.append("SSH detection failed")
-
-    print("  [3] Server --stdio flag...", end=" ")
-    try:
-        r = subprocess.run(["./build/server", "--stdio"], capture_output=True, text=True, timeout=3)
-        if r.returncode != 0 and ("receiving" in r.stderr or "receiving" in r.stdout or "Receiving" in r.stderr):
-            print("OK (started in stdio mode)")
-        else:
-            print("WARN (stdio exited: rc=%d)" % r.returncode)
-    except subprocess.TimeoutExpired:
-        print("OK (waiting for stdin)")
-
-    print("  [4] Posix arg syntax (no server, expect failure)...", end=" ")
-    r = subprocess.run(BASE_CLIENT_CMD + ["/tmp/x", "/tmp/y"], capture_output=True, text=True, timeout=5)
-    if r.returncode != 0 and "connect" in r.stderr:
-        print("OK (TCP fallback)")
-    else:
-        print("FAIL")
-        errors.append("Posix arg syntax failed")
-
-    check_ssh_localhost()
-    print("  [5] SSH to localhost...", end=" ")
-    if SSH_AVAILABLE:
-        print("OK")
-    else:
-        print("SKIP (install fastsync-server in PATH on remote)")
-
-    if errors:
-        print(f"\n  {len(errors)} pre-flight check(s) failed: {', '.join(errors)}")
-        sys.exit(1)
-    print("  All pre-flight checks passed.\n")
-
-
-def main():
-    os.system("cmake -B build -S . > /dev/null 2>&1")
-    if os.system("cd build && make -j$(nproc) 2>&1 | tail -3") != 0:
-        print("Build failed")
-        sys.exit(1)
-    preflight_checks()
-    parser = argparse.ArgumentParser(description="FastSync integration test / benchmark")
-    parser.add_argument("--source-dir", default=DEFAULT_SOURCE_DIR)
-    parser.add_argument("--dest-dir", default=DEFAULT_DEST_DIR)
-    parser.add_argument("--keep-data", action="store_true")
-    parser.add_argument("--unlimited", action="store_true")
-    parser.add_argument("--wan", action="store_true")
-    args = parser.parse_args()
-
-    total_bytes = generate_test_files(args.source_dir)
-    if os.path.exists(args.dest_dir):
-        shutil.rmtree(args.dest_dir)
-    os.makedirs(args.dest_dir, exist_ok=True)
-
-    profiles = []
-    if args.unlimited:
-        profiles.append("Unlimited")
-    elif args.wan:
-        profiles.append("WAN")
-    else:
-        profiles.append("LAN")
-
-    try:
-        all_results = []
-        for p in profiles:
-            all_results.extend(run_profile(p, args.source_dir, args.dest_dir))
-
-        print("\n" + "=" * 130)
-        print(f"{'RESULTS':^130}")
-        print("=" * 130)
-        print(f"{'Configuration':<45} | {'Profile':<12} | {'Status':<8} | {'Time':<10} | {'Details'}")
-        print("-" * 130)
-        for r in all_results:
-            print(f"{r['name']:<45} | {r['suite']:<12} | {r['status']:<8} | {r['time']:<10} | {r['error']}")
-
-        for p in profiles:
-            print_metrics(p, [r for r in all_results if r["suite"] == p], total_bytes)
-
-        failed = [r for r in all_results if r["status"] != "Success"]
-        if failed:
-            print(f"\n  {len(failed)} test(s) FAILED")
-            sys.exit(1)
-        print(f"\n  ALL {len(all_results)} TESTS PASSED")
-    finally:
-        if not args.keep_data:
-            shutil.rmtree(TEST_DIR, ignore_errors=True)
-
-
-if __name__ == "__main__":
-    main()

tests/conftest.py

@@ -0,0 +1,17 @@
+"""Shared pytest configuration for integration tests."""
+import os
+import sys
+import pytest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "integration"))
+
+from common import ServerManager
+
+
+@pytest.fixture(scope="session")
+def shared_server():
+    """One server for the entire test session. Avoids 27+ server start/stop cycles."""
+    server = ServerManager()
+    server.start()
+    yield server
+    server.stop()

tests/integration/common.py

@@ -0,0 +1,181 @@
+import filecmp
+import os
+import random
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+
+PROJECT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", ".."))
+BUILD_DIR = os.path.join(PROJECT_ROOT, "build")
+SERVER_CMD = [os.path.join(BUILD_DIR, "server")]
+CLIENT_CMD = [os.path.join(BUILD_DIR, "client")]
+TEST_DATA_DIR = os.path.join(PROJECT_ROOT, "test_data")
+
+
+class ServerManager:
+    """Manages a long-lived server process. Reuses across test cases."""
+
+    def __init__(self):
+        self._proc = None
+        self._port = None
+
+    def start(self, extra_args=None):
+        self.stop()
+        self._port = _find_free_port()
+        cmd = SERVER_CMD + ["-p", str(self._port)]
+        if extra_args:
+            cmd += extra_args
+        self._proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        _wait_for_port(self._port, timeout=5)
+
+    def stop(self):
+        if self._proc:
+            _wait_proc(self._proc)
+            self._proc = None
+
+    @property
+    def port(self):
+        return self._port
+
+    def __enter__(self):
+        self.start()
+        return self
+
+    def __exit__(self, *args):
+        self.stop()
+
+    def __del__(self):
+        self.stop()
+
+
+def run_client(source_dir, dest_dir, flags=None, port=None, extra_args=None):
+    """Run the client and return (result, duration)."""
+    cmd = CLIENT_CMD + ["--source-dir", source_dir, "--dest-dir", dest_dir, "--save-to-disk"]
+    if port:
+        cmd += ["--server-port", str(port)]
+    if flags:
+        cmd += flags
+    if extra_args:
+        cmd += extra_args
+    start = time.monotonic()
+    result = subprocess.run(cmd, text=True, capture_output=True)
+    duration = time.monotonic() - start
+    return result, duration
+
+
+def run_client_posix(source_dir, dest_dir, flags=None, port=None):
+    """Run the client with positional args (rsync-style)."""
+    cmd = CLIENT_CMD + [source_dir, dest_dir, "--save-to-disk"]
+    if port:
+        cmd += ["--server-port", str(port)]
+    if flags:
+        cmd += flags
+    start = time.monotonic()
+    result = subprocess.run(cmd, text=True, capture_output=True)
+    duration = time.monotonic() - start
+    return result, duration
+
+
+def generate_test_files(source_dir, full=False):
+    """Generate structured test data. Returns total bytes written."""
+    if os.path.exists(source_dir):
+        shutil.rmtree(source_dir)
+    os.makedirs(source_dir)
+
+    target_total = 25 * 1024 * 1024 if full else 0
+    written = 0
+
+    files = {
+        "small.txt": b"hello world\n",
+        "medium.txt": b"the quick brown fox jumps over the lazy dog\n" * 5000,
+        "binary.bin": bytes(range(256)) * 1000,
+        "nested/subdir/deep.txt": b"deeply nested file\n",
+        "nested/another.txt": b"another nested file\n" * 50,
+    }
+    for rel_path, content in files.items():
+        full_path = os.path.join(source_dir, rel_path)
+        os.makedirs(os.path.dirname(full_path), exist_ok=True)
+        with open(full_path, "wb") as f:
+            f.write(content)
+        written += len(content)
+
+    if full:
+        os.makedirs(os.path.join(source_dir, "bulk"), exist_ok=True)
+        i = 0
+        while written < target_total:
+            chunk_size = min(5 * 1024 * 1024, target_total - written)
+            with open(os.path.join(source_dir, f"bulk/file_{i}.dat"), "wb") as f:
+                f.write(random.randbytes(chunk_size))
+            written += chunk_size
+            i += 1
+
+    return written
+
+
+def verify_transfer(source_dir, received_dir):
+    """Verify all files from source exist in received_dir and match. Returns (mismatches, missing)."""
+    source_dir = os.path.abspath(source_dir)
+    received_dir = os.path.abspath(received_dir)
+    if not os.path.exists(received_dir):
+        return [], ["no received files found"]
+    mismatches, missing = [], []
+    for root, dirs, files in os.walk(source_dir):
+        for f in files:
+            src_path = os.path.join(root, f)
+            rel = os.path.relpath(src_path, source_dir)
+            dst_path = os.path.join(received_dir, rel)
+            if not os.path.exists(dst_path):
+                missing.append(rel)
+            elif not filecmp.cmp(src_path, dst_path, shallow=False):
+                mismatches.append(rel)
+    return mismatches, missing
+
+
+def clean_dir(path):
+    """Remove and recreate a directory."""
+    if os.path.exists(path):
+        shutil.rmtree(path)
+    os.makedirs(path, exist_ok=True)
+
+
+def make_result(name, success, duration=None, error=""):
+    """Create a standardized result dict."""
+    return {
+        "name": name,
+        "status": "Success" if success else "Failed",
+        "time": f"{duration:.4f}s" if duration is not None else "N/A",
+        "error": error,
+    }
+
+
+def get_dest_received_dir(dest_dir, source_dir):
+    """Get the path where received files land inside dest_dir."""
+    return os.path.join(dest_dir, os.path.abspath(source_dir).lstrip(os.sep))
+
+
+def _find_free_port():
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("", 0))
+        return s.getsockname()[1]
+
+
+def _wait_for_port(port, timeout=5):
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        try:
+            with socket.create_connection(("127.0.0.1", port), timeout=0.3):
+                return
+        except (ConnectionRefusedError, OSError):
+            time.sleep(0.05)
+    raise RuntimeError(f"Server port {port} not ready after {timeout}s")
+
+
+def _wait_proc(proc, timeout=5):
+    try:
+        proc.wait(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait()

tests/integration/test_features.py

@@ -0,0 +1,256 @@
+"""Feature tests: incremental sync, bandwidth limiting, dry run, metadata, filters."""
+import os
+import shutil
+import sys
+import time
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (
+    PROJECT_ROOT, BUILD_DIR, TEST_DATA_DIR,
+    run_client,
+    generate_test_files, verify_transfer, clean_dir, make_result,
+    get_dest_received_dir, CLIENT_CMD,
+)
+
+SOURCE_DIR = os.path.join(TEST_DATA_DIR, "feature_source")
+DEST_DIR = os.path.join(TEST_DATA_DIR, "feature_dest")
+
+
+@pytest.fixture(scope="module", autouse=True)
+def setup_test_data():
+    generate_test_files(SOURCE_DIR, full=False)
+    clean_dir(DEST_DIR)
+    yield
+    shutil.rmtree(TEST_DATA_DIR, ignore_errors=True)
+
+
+class TestDryRun:
+    def test_dry_run(self):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-n"],
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        assert "Dry run:" in result.stdout, f"No dry run output: {result.stdout[:200]}"
+
+
+class TestArchiveMode:
+    def test_archive_mode(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-a"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+
+class TestExclude:
+    def test_exclude_single(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--exclude", "small.txt"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert "small.txt" in missing, "small.txt should be excluded but was transferred"
+        other_missing = [m for m in missing if m != "small.txt"]
+        assert not other_missing, f"Other files missing: {other_missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+    def test_exclude_glob(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--exclude", "*.txt"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(os.path.join(received, "small.txt")), "small.txt should be excluded"
+        assert os.path.exists(os.path.join(received, "binary.bin")), "binary.bin should be present"
+
+
+class TestInclude:
+    def test_include_single(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--include", "binary.bin"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert os.path.exists(os.path.join(received, "binary.bin")), "binary.bin should be included"
+        assert not os.path.exists(os.path.join(received, "small.txt")), "small.txt should not be included"
+
+    def test_include_glob(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--include", "*.bin"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert os.path.exists(os.path.join(received, "binary.bin")), "binary.bin should be included"
+
+
+class TestSizeFilters:
+    def test_max_size(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--max-size", "100"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert os.path.exists(os.path.join(received, "small.txt")), "small.txt should be present"
+        assert not os.path.exists(os.path.join(received, "medium.txt")), "medium.txt should be skipped"
+
+    def test_min_size(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--min-size", "1000"],
+            port=shared_server.port,
+        )
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        assert not os.path.exists(os.path.join(received, "small.txt")), "small.txt should be skipped"
+        assert os.path.exists(os.path.join(received, "medium.txt")), "medium.txt should be present"
+
+
+class TestIncremental:
+    def test_incremental_skips_unchanged(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"First sync failed: {result.stderr[:100]}"
+
+        start = time.monotonic()
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M", "--incremental"],
+            port=shared_server.port,
+        )
+        incremental_time = time.monotonic() - start
+
+        assert result.returncode == 0, f"Incremental sync failed: {(result.stderr or result.stdout)[:200]}"
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+    def test_incremental_detects_changes(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0
+
+        modified_file = os.path.join(SOURCE_DIR, "small.txt")
+        with open(modified_file, "wb") as f:
+            f.write(b"modified content for incremental test\n")
+
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M", "--incremental"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0
+
+        with open(modified_file, "wb") as f:
+            f.write(b"hello world\n")
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        received_file = os.path.join(received, "small.txt")
+        assert os.path.exists(received_file), "Modified file should be present"
+        with open(received_file, "rb") as f:
+            content = f.read()
+        assert b"modified content" in content, f"Modified content not transferred: {content[:50]}"
+
+
+class TestDelete:
+    def test_delete_removes_extra_files(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, _ = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        extra_file = os.path.join(received, "extra_file.txt")
+        extra_dir = os.path.join(received, "extra_dir")
+        with open(extra_file, "w") as f:
+            f.write("should be deleted")
+        os.makedirs(extra_dir, exist_ok=True)
+        with open(os.path.join(extra_dir, "nested.txt"), "w") as f:
+            f.write("nested extra")
+
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["-M", "--delete"],
+            port=shared_server.port,
+        )
+
+        assert result.returncode == 0, f"Delete sync failed: {(result.stderr or result.stdout)[:200]}"
+        assert not os.path.exists(extra_file), "extra_file.txt should be deleted"
+        assert not os.path.exists(extra_dir), "extra_dir should be deleted"
+
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"
+
+
+class TestProgress:
+    def test_progress_output(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--progress"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {result.stderr[:100]}"
+        output = result.stdout + result.stderr
+        assert len(output) >= 0
+
+
+class TestBandwidthLimit:
+    def test_bwlimit_runs(self, shared_server):
+        clean_dir(DEST_DIR)
+        result, dur = run_client(
+            SOURCE_DIR, DEST_DIR,
+            flags=["--bwlimit", "10240"],
+            port=shared_server.port,
+        )
+        assert result.returncode == 0, f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}"
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing: {missing}"
+        assert not mismatches, f"Mismatch: {mismatches}"

tests/integration/test_preflight.py

@@ -0,0 +1,81 @@
+"""CLI validation and preflight checks."""
+import subprocess
+import sys
+import os
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import BUILD_DIR, CLIENT_CMD, SERVER_CMD
+
+
+class TestHelp:
+    def test_client_help(self):
+        r = subprocess.run(CLIENT_CMD + ["--help"], capture_output=True, text=True)
+        assert r.returncode == 0
+        assert "Usage:" in r.stdout
+        assert "SSH transport" in r.stdout
+
+    def test_server_help(self):
+        r = subprocess.run(SERVER_CMD + ["--help"], capture_output=True, text=True)
+        assert r.returncode == 0
+        assert "Usage:" in r.stdout
+
+
+class TestSSHDetection:
+    def test_remote_dest_detected(self):
+        """Posix-style SSH dest should be detected and fail gracefully."""
+        r = subprocess.run(
+            CLIENT_CMD + ["/x", "somehost:/y"],
+            capture_output=True, text=True, timeout=5,
+        )
+        assert r.returncode != 0
+        stderr = (r.stderr or "").lower()
+        assert "ssh" in stderr or "error" in stderr or "could not" in stderr
+
+    def test_local_dest_not_ssh(self):
+        """Local path should not be detected as SSH."""
+        r = subprocess.run(
+            CLIENT_CMD + ["/tmp/x", "/tmp/y"],
+            capture_output=True, text=True, timeout=5,
+        )
+        # Should fail with connection error (no server), not SSH error
+        assert r.returncode != 0
+
+
+class TestServerStdio:
+    def test_stdio_mode_starts(self):
+        """Server --stdio should start and wait for stdin."""
+        try:
+            r = subprocess.run(
+                SERVER_CMD + ["--stdio"],
+                capture_output=True, text=True, timeout=3,
+            )
+            # Should exit with error (no data on stdin) or timeout
+        except subprocess.TimeoutExpired:
+            pass  # Expected: server waiting for stdin
+
+
+class TestServerPort:
+    def test_invalid_port(self):
+        """Server should reject invalid port numbers."""
+        r = subprocess.run(
+            SERVER_CMD + ["-p", "99999"],
+            capture_output=True, text=True, timeout=5,
+        )
+        assert r.returncode != 0
+
+    def test_default_port(self):
+        """Server should start on default port 8080."""
+        proc = subprocess.Popen(
+            SERVER_CMD, stdout=subprocess.DEVNULL, stderr=None,
+        )
+        try:
+            import socket, time
+            time.sleep(0.5)
+            with socket.create_connection(("127.0.0.1", 8080), timeout=2):
+                pass  # Port is listening
+        except (ConnectionRefusedError, OSError):
+            pytest.fail("Server not listening on default port 8080")
+        finally:
+            proc.terminate()
+            proc.wait(timeout=5)

tests/integration/test_ssh.py

@@ -0,0 +1,132 @@
+"""SSH transport tests."""
+import os
+import shutil
+import subprocess
+import sys
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (
+    PROJECT_ROOT, BUILD_DIR, TEST_DATA_DIR,
+    CLIENT_CMD, generate_test_files, verify_transfer, clean_dir, make_result,
+)
+
+SOURCE_DIR = os.path.join(TEST_DATA_DIR, "ssh_source")
+DEST_DIR = os.path.join(TEST_DATA_DIR, "ssh_dest")
+SSH_AVAILABLE = False
+
+
+def _check_ssh():
+    global SSH_AVAILABLE
+    try:
+        r = subprocess.run(
+            ["ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=5",
+             "localhost", "which", "fastsync-server"],
+            capture_output=True, timeout=10,
+        )
+        if r.returncode == 0:
+            SSH_AVAILABLE = True
+            return
+
+        # Try to install server binary into PATH
+        server_path = os.path.join(BUILD_DIR, "server")
+        r = subprocess.run(
+            ["ssh", "-o", "BatchMode=yes", "localhost", 'echo "$PATH"'],
+            capture_output=True, timeout=10, text=True,
+        )
+        if r.returncode != 0:
+            return
+        for d in r.stdout.strip().split(":"):
+            d = d.strip()
+            if not d or "wrappers" in d:
+                continue
+            test = subprocess.run(
+                ["ssh", "-o", "BatchMode=yes", "localhost",
+                 f'test -w "{d}" && ln -sf {server_path} "{d}/fastsync-server" && which fastsync-server'],
+                capture_output=True, timeout=10,
+            )
+            if test.returncode == 0:
+                SSH_AVAILABLE = True
+                return
+    except FileNotFoundError:
+        pass
+
+
+@pytest.fixture(scope="module", autouse=True)
+def setup_test_data():
+    _check_ssh()
+    if SSH_AVAILABLE:
+        generate_test_files(SOURCE_DIR, full=False)
+        clean_dir(DEST_DIR)
+    yield
+    shutil.rmtree(TEST_DATA_DIR, ignore_errors=True)
+
+
+def _run_ssh_test(name, flags, expected_missing=None):
+    """Run an SSH test case (no server process needed, client spawns SSH)."""
+    ssh_dest = f"localhost:{DEST_DIR}"
+    clean_dir(DEST_DIR)
+    cmd = CLIENT_CMD + [SOURCE_DIR, ssh_dest, "--save-to-disk"] + flags
+    start = __import__("time").monotonic()
+    result = subprocess.run(cmd, text=True, capture_output=True)
+    duration = __import__("time").monotonic() - start
+
+    if result.returncode != 0:
+        return make_result(name, False, duration, f"Exit {result.returncode}: {(result.stderr or result.stdout)[:100]}")
+
+    mismatches, missing = verify_transfer(SOURCE_DIR, DEST_DIR)
+    if expected_missing:
+        missing = [m for m in missing if m not in expected_missing]
+    if missing:
+        return make_result(name, False, duration, f"Missing: {', '.join(missing[:5])}")
+    if mismatches:
+        return make_result(name, False, duration, f"Mismatch: {', '.join(mismatches[:3])}")
+    return make_result(name, True, duration)
+
+
+@pytest.mark.skipif(not SSH_AVAILABLE, reason="SSH to localhost not available")
+class TestSSHStandard:
+    def test_standard(self):
+        r = _run_ssh_test("SSH (localhost)", [])
+        assert r["status"] == "Success", r["error"]
+
+    def test_multithreading(self):
+        r = _run_ssh_test("SSH Multithreading (-m)", ["-m"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_compression(self):
+        r = _run_ssh_test("SSH Compression (-c)", ["-c"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_chunk_serialization(self):
+        r = _run_ssh_test("SSH Chunk Serialization (-s)", ["-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_compression_chunk(self):
+        r = _run_ssh_test("SSH Compression + Chunk (-c -s)", ["-c", "-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_multithread_compression(self):
+        r = _run_ssh_test("SSH Multithread + Compression (-m -c)", ["-m", "-c"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_multithread_chunk(self):
+        r = _run_ssh_test("SSH Multithread + Chunk (-m -s)", ["-m", "-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_all_flags(self):
+        r = _run_ssh_test("SSH All Flags (-m -c -s)", ["-m", "-c", "-s"])
+        assert r["status"] == "Success", r["error"]
+
+
+@pytest.mark.skipif(not SSH_AVAILABLE, reason="SSH to localhost not available")
+class TestSSHFeatures:
+    def test_archive(self):
+        r = _run_ssh_test("SSH Archive (-a)", ["-a"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_exclude(self):
+        r = _run_ssh_test("SSH Exclude (--exclude small.txt)",
+                          ["--exclude", "small.txt"],
+                          expected_missing=["small.txt"])
+        assert r["status"] == "Success", r["error"]

tests/integration/test_tcp.py

@@ -0,0 +1,110 @@
+"""TCP transport correctness tests."""
+import os
+import shutil
+import sys
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (
+    PROJECT_ROOT, BUILD_DIR, TEST_DATA_DIR,
+    run_client, run_client_posix,
+    generate_test_files, verify_transfer, clean_dir, make_result,
+    get_dest_received_dir, CLIENT_CMD,
+)
+
+SOURCE_DIR = os.path.join(TEST_DATA_DIR, "tcp_source")
+DEST_DIR = os.path.join(TEST_DATA_DIR, "tcp_dest")
+
+
+@pytest.fixture(scope="module", autouse=True)
+def setup_test_data():
+    generate_test_files(SOURCE_DIR, full=False)
+    clean_dir(DEST_DIR)
+    yield
+    shutil.rmtree(TEST_DATA_DIR, ignore_errors=True)
+
+
+def _run_tcp_test(name, port, flags, use_metadata=True, posix=False):
+    """Run a single TCP test case against a shared server."""
+    clean_dir(DEST_DIR)
+    if posix:
+        result, dur = run_client_posix(SOURCE_DIR, DEST_DIR,
+                                       flags=(["-M"] if use_metadata else []) + flags,
+                                       port=port)
+    else:
+        result, dur = run_client(SOURCE_DIR, DEST_DIR,
+                                 flags=(["-M"] if use_metadata else []) + flags,
+                                 port=port)
+
+    if result.returncode != 0:
+        return make_result(name, False, dur, f"Exit {result.returncode}: {(result.stderr or result.stdout)[:100]}")
+
+    received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+    mismatches, missing = verify_transfer(SOURCE_DIR, received)
+    if missing:
+        return make_result(name, False, dur, f"Missing: {', '.join(missing[:5])}")
+    if mismatches:
+        return make_result(name, False, dur, f"Mismatch: {', '.join(mismatches[:3])}")
+    return make_result(name, True, dur)
+
+
+class TestTCPStandard:
+    def test_standard(self, shared_server):
+        r = _run_tcp_test("Standard", shared_server.port, [])
+        assert r["status"] == "Success", r["error"]
+
+    def test_posix_args(self, shared_server):
+        r = _run_tcp_test("Posix Args", shared_server.port, [], posix=True)
+        assert r["status"] == "Success", r["error"]
+
+    def test_no_metadata(self, shared_server):
+        r = _run_tcp_test("Standard (no metadata)", shared_server.port, [], use_metadata=False)
+        assert r["status"] == "Success", r["error"]
+
+
+class TestTCPFlags:
+    def test_multithreading(self, shared_server):
+        r = _run_tcp_test("Multithreading (-m)", shared_server.port, ["-m"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_compression(self, shared_server):
+        r = _run_tcp_test("Compression (-c)", shared_server.port, ["-c"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_chunk_serialization(self, shared_server):
+        r = _run_tcp_test("Chunk Serialization (-s)", shared_server.port, ["-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_compression_chunk(self, shared_server):
+        r = _run_tcp_test("Compression + Chunk (-c -s)", shared_server.port, ["-c", "-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_multithread_compression(self, shared_server):
+        r = _run_tcp_test("Multithreading + Compression (-m -c)", shared_server.port, ["-m", "-c"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_multithread_chunk(self, shared_server):
+        r = _run_tcp_test("Multithreading + Chunk (-m -s)", shared_server.port, ["-m", "-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_all_flags(self, shared_server):
+        r = _run_tcp_test("Multithread + Compression + Chunk (-m -c -s)", shared_server.port, ["-m", "-c", "-s"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_sendfile(self, shared_server):
+        r = _run_tcp_test("Sendfile (-f)", shared_server.port, ["-f"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_sendfile_multithread(self, shared_server):
+        r = _run_tcp_test("Sendfile + Multithreading (-f -m)", shared_server.port, ["-f", "-m"])
+        assert r["status"] == "Success", r["error"]
+
+
+class TestTCPChunkSize:
+    def test_custom_chunk_size(self, shared_server):
+        r = _run_tcp_test("Chunk size 5MB", shared_server.port, ["--chunk-size", "5242880"])
+        assert r["status"] == "Success", r["error"]
+
+    def test_small_chunk_size(self, shared_server):
+        r = _run_tcp_test("Chunk size 1KB", shared_server.port, ["--chunk-size", "1024"])
+        assert r["status"] == "Success", r["error"]

tests/integration/test_tls.py

@@ -0,0 +1,181 @@
+"""TLS transport tests. Generates self-signed certs for testing."""
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import pytest
+
+sys.path.insert(0, os.path.dirname(__file__))
+from common import (
+    PROJECT_ROOT, BUILD_DIR, SERVER_CMD, TEST_DATA_DIR,
+    ServerManager, run_client,
+    generate_test_files, verify_transfer, clean_dir, make_result,
+    get_dest_received_dir, _find_free_port, _wait_proc,
+)
+
+SOURCE_DIR = os.path.join(TEST_DATA_DIR, "tls_source")
+DEST_DIR = os.path.join(TEST_DATA_DIR, "tls_dest")
+CERT_DIR = os.path.join(TEST_DATA_DIR, "tls_certs")
+
+
+def _generate_certs(cert_dir):
+    """Generate a self-signed CA, server cert, and client cert for testing."""
+    os.makedirs(cert_dir, exist_ok=True)
+    ca_key = os.path.join(cert_dir, "ca.key")
+    ca_cert = os.path.join(cert_dir, "ca.pem")
+    server_key = os.path.join(cert_dir, "server.key")
+    server_cert = os.path.join(cert_dir, "server.pem")
+    client_key = os.path.join(cert_dir, "client.key")
+    client_cert = os.path.join(cert_dir, "client.pem")
+
+    # CA key + cert
+    subprocess.run([
+        "openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes",
+        "-keyout", ca_key, "-out", ca_cert,
+        "-days", "1", "-subj", "/CN=FastSync Test CA",
+    ], check=True, capture_output=True)
+
+    # Server key + CSR + cert (signed by CA)
+    subprocess.run([
+        "openssl", "req", "-newkey", "rsa:2048", "-nodes",
+        "-keyout", server_key, "-out", os.path.join(cert_dir, "server.csr"),
+        "-subj", "/CN=localhost",
+    ], check=True, capture_output=True)
+    subprocess.run([
+        "openssl", "x509", "-req", "-in", os.path.join(cert_dir, "server.csr"),
+        "-CA", ca_cert, "-CAkey", ca_key, "-CAcreateserial",
+        "-out", server_cert, "-days", "1",
+    ], check=True, capture_output=True)
+
+    # Client key + CSR + cert (signed by CA)
+    subprocess.run([
+        "openssl", "req", "-newkey", "rsa:2048", "-nodes",
+        "-keyout", client_key, "-out", os.path.join(cert_dir, "client.csr"),
+        "-subj", "/CN=fastsync-client",
+    ], check=True, capture_output=True)
+    subprocess.run([
+        "openssl", "x509", "-req", "-in", os.path.join(cert_dir, "client.csr"),
+        "-CA", ca_cert, "-CAkey", ca_key, "-CAcreateserial",
+        "-out", client_cert, "-days", "1",
+    ], check=True, capture_output=True)
+
+    return {
+        "ca": ca_cert,
+        "server_cert": server_cert,
+        "server_key": server_key,
+        "client_cert": client_cert,
+        "client_key": client_key,
+    }
+
+
+@pytest.fixture(scope="module")
+def certs():
+    """Generate test certificates once per test module."""
+    if os.path.exists(CERT_DIR):
+        shutil.rmtree(CERT_DIR)
+    c = _generate_certs(CERT_DIR)
+    yield c
+    shutil.rmtree(CERT_DIR, ignore_errors=True)
+
+
+@pytest.fixture(scope="module", autouse=True)
+def setup_test_data():
+    generate_test_files(SOURCE_DIR, full=False)
+    clean_dir(DEST_DIR)
+    yield
+    shutil.rmtree(TEST_DATA_DIR, ignore_errors=True)
+
+
+class TestTLSBasic:
+    def test_tls_server_client(self, certs):
+        """Basic TLS: server with cert/key, client with cert/key + CA."""
+        clean_dir(DEST_DIR)
+        with ServerManager() as server:
+            server.start(extra_args=[
+                "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+            ])
+            result, dur = run_client(
+                SOURCE_DIR, DEST_DIR,
+                flags=["--tls",
+                       "--cert", certs["client_cert"], "--key", certs["client_key"],
+                       "--ca", certs["ca"]],
+                port=server.port,
+            )
+
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing files: {missing}"
+        assert not mismatches, f"Mismatched files: {mismatches}"
+
+    def test_tls_with_compression(self, certs):
+        """TLS + compression."""
+        clean_dir(DEST_DIR)
+        with ServerManager() as server:
+            server.start(extra_args=[
+                "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+            ])
+            result, dur = run_client(
+                SOURCE_DIR, DEST_DIR,
+                flags=["-c", "--tls",
+                       "--cert", certs["client_cert"], "--key", certs["client_key"],
+                       "--ca", certs["ca"]],
+                port=server.port,
+            )
+
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing files: {missing}"
+        assert not mismatches, f"Mismatched files: {mismatches}"
+
+    def test_tls_with_multithreading(self, certs):
+        """TLS + multithreading."""
+        clean_dir(DEST_DIR)
+        with ServerManager() as server:
+            server.start(extra_args=[
+                "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+            ])
+            result, dur = run_client(
+                SOURCE_DIR, DEST_DIR,
+                flags=["-m", "--tls",
+                       "--cert", certs["client_cert"], "--key", certs["client_key"],
+                       "--ca", certs["ca"]],
+                port=server.port,
+            )
+
+        if result.returncode != 0:
+            pytest.fail(f"Exit {result.returncode}: {(result.stderr or result.stdout)[:200]}")
+
+        received = get_dest_received_dir(DEST_DIR, SOURCE_DIR)
+        mismatches, missing = verify_transfer(SOURCE_DIR, received)
+        assert not missing, f"Missing files: {missing}"
+        assert not mismatches, f"Mismatched files: {mismatches}"
+
+
+class TestTLSErrorCases:
+    def test_server_tls_missing_cert_key(self):
+        """Server should fail if --tls is given without --cert/--key."""
+        proc = subprocess.Popen(
+            SERVER_CMD + ["--tls"],
+            stdout=subprocess.DEVNULL, stderr=subprocess.PIPE,
+        )
+        _, stderr = proc.communicate(timeout=5)
+        assert proc.returncode != 0, "Server should fail with --tls but no cert/key"
+
+    def test_client_tls_missing_key(self):
+        """Client should fail if --tls is given without --key."""
+        clean_dir(DEST_DIR)
+        with ServerManager() as server:
+            result, _ = run_client(
+                SOURCE_DIR, DEST_DIR,
+                flags=["--tls",
+                       "--cert", "/nonexistent/cert.pem"],
+                port=server.port,
+            )
+        assert result.returncode != 0, "Client should fail with --tls but no --key"

tests/runner.c

@@ -2,6 +2,7 @@
 #include "test_chunk.h"
 #include "test_compression.h"
 #include "test_config.h"
+#include "test_delta.h"
 #include "test_queue.h"
 #include "test_scanner.h"
 #include "test_shared_utils.h"
@@ -23,6 +24,7 @@ int main() {
   RUN_TEST(test_config);
   RUN_TEST(test_compression);
   RUN_TEST(test_scanner);
+  RUN_TEST(test_delta);
 
   printf("\n\033[1;36m=== TEST SUMMARY ===\033[0m\n");
   printf("Total Tests Run: %d\n", tests_run);

tests/test_array_list.c

@@ -4,28 +4,28 @@
 #include <stdlib.h>
 
 static int destroyer_calls = 0;
-static void test_destroyer(void *item) {
+static void test_destroyer(void* item) {
   destroyer_calls++;
   free(item);
 }
 
 void test_array_list() {
-  ArrayList *list = array_list_create(free);
+  ArrayList* list = array_list_create(free);
   EXPECT_NOT_NULL(list);
   EXPECT_EQ_INT(list->size, 0);
   EXPECT_EQ_INT(list->capacity, 100);
 
   // Test adding
-  int *val1 = malloc(sizeof(int));
+  int* val1 = malloc(sizeof(int));
   *val1 = 42;
   array_list_add(list, val1);
   EXPECT_EQ_INT(list->size, 1);
-  EXPECT_EQ_INT(*(int *)list->items[0], 42);
+  EXPECT_EQ_INT(*(int*)list->items[0], 42);
 
   // Test extending capacity
   // Initial capacity is 100. Let's add 105 elements.
   for (int i = 0; i < 105; i++) {
-    int *val = malloc(sizeof(int));
+    int* val = malloc(sizeof(int));
     *val = i;
     array_list_add(list, val);
   }
@@ -33,15 +33,15 @@ void test_array_list() {
   EXPECT_EQ_INT(list->capacity, 200); // 100 * 2
 
   // Verify contents
-  EXPECT_EQ_INT(*(int *)list->items[0], 42);
+  EXPECT_EQ_INT(*(int*)list->items[0], 42);
-  EXPECT_EQ_INT(*(int *)list->items[1], 0);
+  EXPECT_EQ_INT(*(int*)list->items[1], 0);
-  EXPECT_EQ_INT(*(int *)list->items[105], 104);
+  EXPECT_EQ_INT(*(int*)list->items[105], 104);
 
   // Test array conversion
-  void **arr = array_list_to_array(list);
+  void** arr = array_list_to_array(list);
   EXPECT_NOT_NULL(arr);
-  EXPECT_EQ_INT(*(int *)arr[0], 42);
+  EXPECT_EQ_INT(*(int*)arr[0], 42);
-  EXPECT_EQ_INT(*(int *)arr[105], 104);
+  EXPECT_EQ_INT(*(int*)arr[105], 104);
   free(arr);
 
   // Delete list, verifying the destroyer is called 106 times

tests/test_chunk.c

@@ -7,13 +7,13 @@
 #include <unistd.h>
 
 static void test_file_operations() {
-  char *test_path = "temp_file_test.txt";
+  char* test_path = "temp_file_test.txt";
-  char *test_content = "Hello, Chunk System!";
+  char* test_content = "Hello, Chunk System!";
   unsigned long long test_len = strlen(test_content);
 
   to_disk(test_path, test_content, test_len);
 
-  File *f = file_create(test_path);
+  File* f = file_create(test_path);
   EXPECT_NOT_NULL(f);
   EXPECT_EQ_STR(f->path, test_path);
   EXPECT_NOT_NULL(f->data);
@@ -35,12 +35,12 @@ static void test_file_operations() {
 }
 
 static void test_chunk_operations() {
-  char *path1 = "temp_chunk_1.txt";
+  char* path1 = "temp_chunk_1.txt";
-  char *content1 = "chunk item 1";
+  char* content1 = "chunk item 1";
   unsigned long long len1 = strlen(content1);
 
-  char *path2 = "temp_chunk_2.txt";
+  char* path2 = "temp_chunk_2.txt";
-  char *content2 = "chunk item number 2";
+  char* content2 = "chunk item number 2";
   unsigned long long len2 = strlen(content2);
 
   to_disk(path1, content1, len1);
@@ -50,13 +50,13 @@ static void test_chunk_operations() {
   stat(path1, &st1);
   stat(path2, &st2);
 
-  File *f1 = file_create(path1);
+  File* f1 = file_create(path1);
   f1->data->size = st1.st_size;
-  File *f2 = file_create(path2);
+  File* f2 = file_create(path2);
   f2->data->size = st2.st_size;
 
-  File *files[2] = {f1, f2};
+  File* files[2] = {f1, f2};
-  Chunk *chunk = chunk_create(files, 2);
+  Chunk* chunk = chunk_create(files, 2);
   EXPECT_NOT_NULL(chunk);
   EXPECT_EQ_INT(chunk->element_count, 2);
   EXPECT_NOT_NULL(chunk->items[0]);
@@ -67,10 +67,10 @@ static void test_chunk_operations() {
   file_load_data(f2);
 
   // Test chunk_serialize / chunk_deserialize round-trip
-  Data *serialized = chunk_serialize(chunk, false);
+  Data* serialized = chunk_serialize(chunk, false);
   EXPECT_NOT_NULL(serialized);
 
-  Chunk *deserialized = chunk_deserialize(serialized, false);
+  Chunk* deserialized = chunk_deserialize(serialized, false);
   EXPECT_NOT_NULL(deserialized);
   EXPECT_EQ_INT(deserialized->element_count, 2);
   EXPECT_EQ_STR(deserialized->items[0]->path, path1);

tests/test_compression.c

@@ -9,18 +9,18 @@
 #include <unistd.h>
 
 static void test_data_compress_decompress_roundtrip() {
-  char original[] = "Hello, World! This is test data for compression round-trip!";
+  const char original[] = "Hello, World! This is test data for compression round-trip!";
   size_t len = strlen(original);
 
-  char *buf = malloc(len);
+  char* buf = malloc(len);
   memcpy(buf, original, len);
-  Data *original_data = data_create(buf, len);
+  Data* original_data = data_create(buf, len);
   EXPECT_NOT_NULL(original_data);
 
-  Data *compressed = data_compress(original_data, 3);
+  Data* compressed = data_compress(original_data, 3);
   EXPECT_NOT_NULL(compressed);
 
-  Data *decompressed = data_decompress(compressed);
+  Data* decompressed = data_decompress(compressed);
   EXPECT_NOT_NULL(decompressed);
   EXPECT_EQ_INT((int)decompressed->size, (int)len);
   EXPECT_EQ_INT(memcmp(decompressed->data, original, len), 0);
@@ -32,18 +32,18 @@ static void test_data_compress_decompress_roundtrip() {
 
 static void test_data_compress_decompress_large() {
   size_t size = 1024 * 10;
-  char *original = malloc(size);
+  char* original = malloc(size);
   EXPECT_NOT_NULL(original);
   for (size_t i = 0; i < size; i++)
     original[i] = (char)(i % 256);
 
-  Data *original_data = data_create(original, size);
+  Data* original_data = data_create(original, size);
   EXPECT_NOT_NULL(original_data);
 
-  Data *compressed = data_compress(original_data, 1);
+  Data* compressed = data_compress(original_data, 1);
   EXPECT_NOT_NULL(compressed);
 
-  Data *decompressed = data_decompress(compressed);
+  Data* decompressed = data_decompress(compressed);
   EXPECT_NOT_NULL(decompressed);
   EXPECT_EQ_INT((int)decompressed->size, (int)size);
   EXPECT_EQ_INT(memcmp(decompressed->data, original, size), 0);
@@ -54,12 +54,12 @@ static void test_data_compress_decompress_large() {
 }
 
 static void test_chunk_compress_decompress_roundtrip() {
-  char *path1 = "temp_comp_test_1.txt";
+  char* path1 = "temp_comp_test_1.txt";
-  char *content1 = "chunk compression test file 1";
+  char* content1 = "chunk compression test file 1";
   unsigned long long len1 = strlen(content1);
 
-  char *path2 = "temp_comp_test_2.txt";
+  char* path2 = "temp_comp_test_2.txt";
-  char *content2 = "chunk compression test file 2 with more data";
+  char* content2 = "chunk compression test file 2 with more data";
   unsigned long long len2 = strlen(content2);
 
   to_disk(path1, content1, len1);
@@ -69,9 +69,9 @@ static void test_chunk_compress_decompress_roundtrip() {
   EXPECT_EQ_INT(stat(path1, &st1), 0);
   EXPECT_EQ_INT(stat(path2, &st2), 0);
 
-  File *f1 = file_create(path1);
+  File* f1 = file_create(path1);
   f1->data->size = st1.st_size;
-  File *f2 = file_create(path2);
+  File* f2 = file_create(path2);
   f2->data->size = st2.st_size;
   EXPECT_NOT_NULL(f1);
   EXPECT_NOT_NULL(f2);
@@ -79,17 +79,17 @@ static void test_chunk_compress_decompress_roundtrip() {
   file_load_data(f1);
   file_load_data(f2);
 
-  File *files[2] = {f1, f2};
+  File* files[2] = {f1, f2};
-  Chunk *chunk = chunk_create(files, 2);
+  Chunk* chunk = chunk_create(files, 2);
   EXPECT_NOT_NULL(chunk);
 
-  Data *compressed = chunk_compress(chunk, 3, false);
+  Data* compressed = chunk_compress(chunk, 3, false);
   EXPECT_NOT_NULL(compressed);
 
-  Data *decompressed_data = data_decompress(compressed);
+  Data* decompressed_data = data_decompress(compressed);
   EXPECT_NOT_NULL(decompressed_data);
 
-  Chunk *decompressed_chunk = chunk_deserialize(decompressed_data, false);
+  Chunk* decompressed_chunk = chunk_deserialize(decompressed_data, false);
   EXPECT_NOT_NULL(decompressed_chunk);
   EXPECT_EQ_INT(decompressed_chunk->element_count, 2);
 

tests/test_config.c

@@ -7,8 +7,8 @@
 #include <stdlib.h>
 
 static void test_config_lifecycle() {
-  Config *cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/dst"),
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/dst"), true, true, false,
-                              true, true, false, false, false, 1, false, 0);
+                              false, false, 1, false, 0);
   EXPECT_NOT_NULL(cfg);
   EXPECT_EQ_STR(cfg->version, "1.0");
   EXPECT_EQ_STR(cfg->send_directory, "/src");
@@ -23,8 +23,8 @@ static void test_config_lifecycle() {
 }
 
 static void test_config_ssh_dest() {
-  Config *cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("user@host:/dst"),
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("user@host:/dst"), true,
-                              true, false, false, false, false, 1, false, 0);
+                              false, false, false, false, 1, false, 0);
   EXPECT_NOT_NULL(cfg);
   EXPECT_EQ_INT(cfg->transport, TRANSPORT_TCP);
   EXPECT_NULL(cfg->ssh_destination);
@@ -38,8 +38,8 @@ static void test_config_ssh_dest() {
 }
 
 static void test_config_ssh_dest_local_path() {
-  Config *cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/local/path"),
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/local/path"), true, false,
-                              true, false, false, false, false, 1, false, 0);
+                              false, false, false, 1, false, 0);
   config_parse_ssh_dest(cfg);
   EXPECT_EQ_INT(cfg->transport, TRANSPORT_TCP);
   EXPECT_NULL(cfg->ssh_destination);
@@ -48,8 +48,8 @@ static void test_config_ssh_dest_local_path() {
 }
 
 static void test_config_ssh_dest_no_user() {
-  Config *cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("host:/remote"),
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("host:/remote"), true, false,
-                              true, false, false, false, false, 1, false, 0);
+                              false, false, false, 1, false, 0);
   config_parse_ssh_dest(cfg);
   EXPECT_EQ_INT(cfg->transport, TRANSPORT_SSH);
   EXPECT_EQ_STR(cfg->ssh_destination, "host:/remote");
@@ -58,12 +58,12 @@ static void test_config_ssh_dest_no_user() {
 }
 
 static void test_pipeline_sender_lifecycle() {
-  Config *cfg = config_create(str_dup("2.0"), str_dup("/src2"),
+  Config* cfg = config_create(str_dup("2.0"), str_dup("/src2"), str_dup("/dst2"), false, false,
-                              str_dup("/dst2"), false, false, true, true, false, 1, false, 0);
+                              true, true, false, 1, false, 0);
-  Queue *q1 = queue_create(5, NULL);
+  Queue* q1 = queue_create(5, NULL);
-  Queue *q2 = queue_create(15, NULL);
+  Queue* q2 = queue_create(15, NULL);
 
-  PipelineContextSender *pcs = pipeline_context_sender_create(cfg, q1, q2);
+  PipelineContextSender* pcs = pipeline_context_sender_create(cfg, q1, q2);
   EXPECT_NOT_NULL(pcs);
   EXPECT_EQ_STR(pcs->config->version, "2.0");
   EXPECT_EQ_INT(pcs->queue_scanner->capacity, 5);
@@ -75,11 +75,11 @@ static void test_pipeline_sender_lifecycle() {
 }
 
 static void test_pipeline_receiver_lifecycle() {
-  Config *cfg = config_create(str_dup("3.0"), str_dup("/src3"),
+  Config* cfg = config_create(str_dup("3.0"), str_dup("/src3"), str_dup("/dst3"), true, true, true,
-                              str_dup("/dst3"), true, true, true, true, false, 1, false, 0);
+                              true, false, 1, false, 0);
-  Queue *q = queue_create(20, NULL);
+  Queue* q = queue_create(20, NULL);
 
-  PipelineContextReceiver *pcr = pipeline_context_receiver_create(cfg, q, 42);
+  PipelineContextReceiver* pcr = pipeline_context_receiver_create(cfg, q, 42);
   EXPECT_NOT_NULL(pcr);
   EXPECT_EQ_STR(pcr->config->version, "3.0");
   EXPECT_EQ_INT(pcr->queue->capacity, 20);

tests/test_delta.c

@@ -0,0 +1,341 @@
+#include "test_utils.h"
+#include "delta.h"
+#include <string.h>
+#include <stdlib.h>
+
+static void test_adler32_basic() {
+  const char* data = "Hello";
+  uint32_t h = delta_adler32(data, 5);
+  EXPECT_TRUE(h != 0);
+  uint32_t h2 = delta_adler32(data, 5);
+  EXPECT_EQ_INT((int)h, (int)h2);
+}
+
+static void test_adler32_different_data() {
+  const char* a = "AAAA";
+  const char* b = "BBBB";
+  uint32_t ha = delta_adler32(a, 4);
+  uint32_t hb = delta_adler32(b, 4);
+  EXPECT_TRUE(ha != hb);
+}
+
+static void test_xxhash32_basic() {
+  const char* data = "Hello";
+  uint32_t h = delta_xxhash32(data, 5);
+  EXPECT_TRUE(h != 0);
+  uint32_t h2 = delta_xxhash32(data, 5);
+  EXPECT_EQ_INT((int)h, (int)h2);
+}
+
+static void test_xxhash32_different_data() {
+  const char* a = "AAAA";
+  const char* b = "BBBB";
+  uint32_t ha = delta_xxhash32(a, 4);
+  uint32_t hb = delta_xxhash32(b, 4);
+  EXPECT_TRUE(ha != hb);
+}
+
+static void test_signature_roundtrip() {
+  char old_data[4096];
+  for (int i = 0; i < 4096; i++)
+    old_data[i] = (char)(i % 256);
+
+  DeltaSignature* sig = delta_signature_create(old_data, 4096, 1024);
+  EXPECT_NOT_NULL(sig);
+  EXPECT_EQ_INT((int)sig->block_count, 4);
+  EXPECT_EQ_INT((int)sig->block_size, 1024);
+
+  Data* serialized = delta_signature_serialize(sig);
+  EXPECT_NOT_NULL(serialized);
+
+  DeltaSignature* deserialized = delta_signature_deserialize(serialized);
+  EXPECT_NOT_NULL(deserialized);
+  EXPECT_EQ_INT((int)deserialized->block_count, (int)sig->block_count);
+  EXPECT_EQ_INT((int)deserialized->block_size, (int)sig->block_size);
+
+  for (uint32_t i = 0; i < sig->block_count; i++) {
+    EXPECT_EQ_INT((int)deserialized->blocks[i].adler32, (int)sig->blocks[i].adler32);
+    EXPECT_EQ_INT((int)deserialized->blocks[i].xxhash, (int)sig->blocks[i].xxhash);
+  }
+
+  delta_signature_destroy(sig);
+  data_destroy(serialized);
+  delta_signature_destroy(deserialized);
+}
+
+static void test_delta_identical_files() {
+  char data[2048];
+  for (int i = 0; i < 2048; i++)
+    data[i] = (char)(i % 128);
+
+  DeltaSignature* sig = delta_signature_create(data, 2048, 512);
+  EXPECT_NOT_NULL(sig);
+
+  Delta* delta = delta_compute(data, 2048, sig, 512);
+  EXPECT_NOT_NULL(delta);
+
+  bool has_match = false;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_BLOCK_MATCH) {
+      has_match = true;
+      break;
+    }
+  }
+  EXPECT_TRUE(has_match);
+
+  bool all_match = true;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type != DELTA_INSTR_BLOCK_MATCH) {
+      all_match = false;
+      break;
+    }
+  }
+  EXPECT_TRUE(all_match);
+
+  delta_signature_destroy(sig);
+  delta_destroy(delta);
+}
+
+static void test_delta_small_edit() {
+  char old_data[4096];
+  char new_data[4096];
+  for (int i = 0; i < 4096; i++) {
+    old_data[i] = (char)(i % 256);
+    new_data[i] = old_data[i];
+  }
+  new_data[100] = 'X';
+  new_data[101] = 'Y';
+  new_data[102] = 'Z';
+
+  DeltaSignature* sig = delta_signature_create(old_data, 4096, 1024);
+  EXPECT_NOT_NULL(sig);
+
+  Delta* delta = delta_compute(new_data, 4096, sig, 1024);
+  EXPECT_NOT_NULL(delta);
+
+  uint64_t total_literal = 0;
+  uint32_t match_count = 0;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_LITERAL)
+      total_literal += delta->instructions[i].literal.length;
+    else
+      match_count++;
+  }
+  EXPECT_TRUE(match_count > 0);
+  EXPECT_TRUE(total_literal < 4096);
+
+  void* reconstructed = delta_apply(old_data, 4096, delta, 1024);
+  EXPECT_NOT_NULL(reconstructed);
+  EXPECT_EQ_INT(memcmp(reconstructed, new_data, 4096), 0);
+
+  free(reconstructed);
+  delta_signature_destroy(sig);
+  delta_destroy(delta);
+}
+
+static void test_delta_completely_different() {
+  char old_data[4096];
+  char new_data[4096];
+  for (int i = 0; i < 4096; i++) {
+    old_data[i] = (char)(i * 7 + 3);
+    new_data[i] = (char)(i * 13 + 97);
+  }
+
+  DeltaSignature* sig = delta_signature_create(old_data, 4096, 1024);
+  EXPECT_NOT_NULL(sig);
+
+  Delta* delta = delta_compute(new_data, 4096, sig, 1024);
+  EXPECT_NOT_NULL(delta);
+
+  bool has_match = false;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_BLOCK_MATCH) {
+      has_match = true;
+      break;
+    }
+  }
+  EXPECT_TRUE(!has_match);
+  EXPECT_TRUE(!delta_is_worthwhile(delta, 4096));
+
+  delta_signature_destroy(sig);
+  delta_destroy(delta);
+}
+
+static void test_delta_serialize_roundtrip() {
+  char old_data[4096];
+  char new_data[4096];
+  for (int i = 0; i < 4096; i++) {
+    old_data[i] = (char)(i % 256);
+    new_data[i] = old_data[i];
+  }
+  new_data[500] = 'A';
+  new_data[501] = 'B';
+
+  DeltaSignature* sig = delta_signature_create(old_data, 4096, 1024);
+  Delta* delta = delta_compute(new_data, 4096, sig, 1024);
+  EXPECT_NOT_NULL(delta);
+
+  Data* serialized = delta_serialize(delta);
+  EXPECT_NOT_NULL(serialized);
+
+  Delta* deserialized = delta_deserialize(serialized);
+  EXPECT_NOT_NULL(deserialized);
+  EXPECT_EQ_INT((int)deserialized->new_file_size, (int)delta->new_file_size);
+  EXPECT_EQ_INT((int)deserialized->instruction_count, (int)delta->instruction_count);
+
+  void* reconstructed = delta_apply(old_data, 4096, deserialized, 1024);
+  EXPECT_NOT_NULL(reconstructed);
+  EXPECT_EQ_INT(memcmp(reconstructed, new_data, 4096), 0);
+
+  free(reconstructed);
+  data_destroy(serialized);
+  delta_destroy(deserialized);
+  delta_signature_destroy(sig);
+  delta_destroy(delta);
+}
+
+static void test_delta_file_growth() {
+  char old_data[2048];
+  char new_data[3072];
+  for (int i = 0; i < 2048; i++)
+    old_data[i] = (char)(i % 256);
+  memcpy(new_data, old_data, 2048);
+  for (int i = 2048; i < 3072; i++)
+    new_data[i] = (char)(i % 256);
+
+  DeltaSignature* sig = delta_signature_create(old_data, 2048, 512);
+  EXPECT_NOT_NULL(sig);
+
+  Delta* delta = delta_compute(new_data, 3072, sig, 512);
+  EXPECT_NOT_NULL(delta);
+
+  void* reconstructed = delta_apply(old_data, 2048, delta, 512);
+  EXPECT_NOT_NULL(reconstructed);
+  EXPECT_EQ_INT(delta->new_file_size, 3072);
+  EXPECT_EQ_INT(memcmp(reconstructed, new_data, 3072), 0);
+
+  free(reconstructed);
+  delta_signature_destroy(sig);
+  delta_destroy(delta);
+}
+
+static void test_delta_file_shrink() {
+  char old_data[3072];
+  char new_data[2048];
+  for (int i = 0; i < 3072; i++)
+    old_data[i] = (char)(i % 256);
+  for (int i = 0; i < 2048; i++)
+    new_data[i] = old_data[i];
+
+  DeltaSignature* sig = delta_signature_create(old_data, 3072, 512);
+  EXPECT_NOT_NULL(sig);
+
+  Delta* delta = delta_compute(new_data, 2048, sig, 512);
+  EXPECT_NOT_NULL(delta);
+
+  void* reconstructed = delta_apply(old_data, 3072, delta, 512);
+  EXPECT_NOT_NULL(reconstructed);
+  EXPECT_EQ_INT(delta->new_file_size, 2048);
+  EXPECT_EQ_INT(memcmp(reconstructed, new_data, 2048), 0);
+
+  free(reconstructed);
+  delta_signature_destroy(sig);
+  delta_destroy(delta);
+}
+
+static void test_should_attempt() {
+  EXPECT_TRUE(delta_should_attempt(100000, 100000, DELTA_MAX_FILE_SIZE));
+  EXPECT_TRUE(!delta_should_attempt(100, 100, DELTA_MAX_FILE_SIZE));
+  EXPECT_TRUE(!delta_should_attempt(100000, 10, DELTA_MAX_FILE_SIZE));
+  EXPECT_TRUE(!delta_should_attempt(300000000, 300000000, DELTA_MAX_FILE_SIZE));
+  EXPECT_TRUE(delta_should_attempt(50000, 60000, DELTA_MAX_FILE_SIZE));
+  EXPECT_TRUE(!delta_should_attempt(50000, 600000, DELTA_MAX_FILE_SIZE));
+  EXPECT_TRUE(delta_should_attempt(50000, 60000, 500000));
+  EXPECT_TRUE(!delta_should_attempt(100000, 100000, 50000));
+}
+
+static void test_is_worthwhile() {
+  Delta d;
+  d.instruction_count = 1;
+  DeltaInstruction instr;
+  instr.type = DELTA_INSTR_BLOCK_MATCH;
+  d.instructions = &instr;
+
+  d.delta_size = 100;
+  EXPECT_TRUE(delta_is_worthwhile(&d, 1000));
+
+  d.delta_size = 800;
+  EXPECT_TRUE(!delta_is_worthwhile(&d, 1000));
+
+  d.instruction_count = 1;
+  instr.type = DELTA_INSTR_LITERAL;
+  EXPECT_TRUE(!delta_is_worthwhile(&d, 1000));
+
+  EXPECT_TRUE(!delta_is_worthwhile(NULL, 1000));
+}
+
+static void test_large_file_delta() {
+  uint32_t block_size = 8192;
+  uint64_t old_size = 200000;
+  uint64_t new_size = 200000;
+
+  void* old_data = malloc((size_t)old_size);
+  void* new_data = malloc((size_t)new_size);
+  EXPECT_TRUE(old_data != NULL && new_data != NULL);
+
+  for (uint64_t i = 0; i < old_size; i++)
+    ((uint8_t*)old_data)[i] = (uint8_t)(i % 251);
+  memcpy(new_data, old_data, (size_t)old_size);
+
+  uint64_t offset = 100000;
+  uint32_t change_len = 4096;
+  for (uint32_t i = 0; i < change_len; i++)
+    ((uint8_t*)new_data)[offset + i] = (uint8_t)((i * 7 + 13) % 256);
+
+  DeltaSignature* sig = delta_signature_create(old_data, old_size, block_size);
+  EXPECT_TRUE(sig != NULL);
+  EXPECT_TRUE(sig->block_count == (uint32_t)((old_size + block_size - 1) / block_size));
+
+  Delta* delta = delta_compute(new_data, new_size, sig, block_size);
+  EXPECT_TRUE(delta != NULL);
+
+  uint64_t total_literal = 0;
+  uint32_t match_count = 0;
+  for (uint32_t i = 0; i < delta->instruction_count; i++) {
+    if (delta->instructions[i].type == DELTA_INSTR_LITERAL)
+      total_literal += delta->instructions[i].literal.length;
+    else
+      match_count++;
+  }
+  EXPECT_TRUE(total_literal > 0);
+  EXPECT_TRUE(match_count > 0);
+  EXPECT_TRUE(delta->delta_size < new_size / 2);
+
+  void* result = delta_apply(old_data, old_size, delta, block_size);
+  EXPECT_TRUE(result != NULL);
+  EXPECT_TRUE(delta->new_file_size == new_size);
+  EXPECT_TRUE(memcmp(result, new_data, (size_t)new_size) == 0);
+
+  free(result);
+  delta_destroy(delta);
+  delta_signature_destroy(sig);
+  free(old_data);
+  free(new_data);
+}
+
+void test_delta() {
+  test_adler32_basic();
+  test_adler32_different_data();
+  test_xxhash32_basic();
+  test_xxhash32_different_data();
+  test_signature_roundtrip();
+  test_delta_identical_files();
+  test_delta_small_edit();
+  test_delta_completely_different();
+  test_delta_serialize_roundtrip();
+  test_delta_file_growth();
+  test_delta_file_shrink();
+  test_should_attempt();
+  test_is_worthwhile();
+  test_large_file_delta();
+}

tests/test_delta.h

@@ -0,0 +1,6 @@
+#ifndef TEST_DELTA_H
+#define TEST_DELTA_H
+
+void test_delta(void);
+
+#endif

tests/test_queue.c

@@ -7,12 +7,12 @@
 #include <stdio.h>
 
 static void test_queue_basic() {
-  Queue *q = queue_create(10, NULL);
+  Queue* q = queue_create(10, NULL);
   EXPECT_NOT_NULL(q);
   EXPECT_TRUE(queue_is_empty(q));
   EXPECT_FALSE(queue_is_full(q));
 
-  int *vals[5];
+  int* vals[5];
   for (int i = 0; i < 5; i++) {
     vals[i] = malloc(sizeof(int));
     *vals[i] = (i + 1) * 10;
@@ -23,19 +23,19 @@ static void test_queue_basic() {
   EXPECT_FALSE(queue_is_full(q));
   EXPECT_EQ_INT(q->size, 5);
 
-  int *v1 = (int *)queue_dequeue(q);
+  int* v1 = (int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v1);
   EXPECT_EQ_INT(*v1, 10);
   free(v1);
 
-  int *v2 = (int *)queue_dequeue(q);
+  int* v2 = (int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v2);
   EXPECT_EQ_INT(*v2, 20);
   free(v2);
 
   EXPECT_EQ_INT(q->size, 3);
 
-  int *vals2[3];
+  int* vals2[3];
   for (int i = 0; i < 3; i++) {
     vals2[i] = malloc(sizeof(int));
     *vals2[i] = (i + 6) * 10;
@@ -44,9 +44,9 @@ static void test_queue_basic() {
 
   EXPECT_EQ_INT(q->size, 6);
 
-  int expected_vals[] = {30, 40, 50, 60, 70, 80};
+  const int expected_vals[] = {30, 40, 50, 60, 70, 80};
   for (int i = 0; i < 6; i++) {
-    int *v = (int *)queue_dequeue(q);
+    int* v = (int*)queue_dequeue(q);
     EXPECT_NOT_NULL(v);
     EXPECT_EQ_INT(*v, expected_vals[i]);
     free(v);
@@ -57,7 +57,7 @@ static void test_queue_basic() {
 }
 
 static void test_queue_resize() {
-  Queue *q = queue_create(3, NULL);
+  Queue* q = queue_create(3, NULL);
   EXPECT_NOT_NULL(q);
   EXPECT_EQ_INT(q->capacity, 3);
 
@@ -69,34 +69,34 @@ static void test_queue_resize() {
 
   EXPECT_TRUE(queue_is_full(q));
 
-  int *v1 = (int *)queue_dequeue(q);
+  const int* v1 = (const int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v1);
   EXPECT_EQ_INT(*v1, 1);
 
   // Now front = 1, rear = 0, size = 2 (wrapped state)
-  queue_enqueue(q, &d); 
+  queue_enqueue(q, &d);
   EXPECT_TRUE(queue_is_full(q));
 
   // This enqueue triggers capacity doubling
-  queue_enqueue(q, &e); 
+  queue_enqueue(q, &e);
   EXPECT_FALSE(queue_is_full(q));
   EXPECT_EQ_INT(q->capacity, 6);
   EXPECT_EQ_INT(q->size, 4);
 
   // Dequeue all and check order: B, C, D, E
-  int *v2 = (int *)queue_dequeue(q);
+  const int* v2 = (const int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v2);
   EXPECT_EQ_INT(*v2, 2);
 
-  int *v3 = (int *)queue_dequeue(q);
+  const int* v3 = (const int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v3);
   EXPECT_EQ_INT(*v3, 3);
 
-  int *v4 = (int *)queue_dequeue(q);
+  const int* v4 = (const int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v4);
   EXPECT_EQ_INT(*v4, 4);
 
-  int *v5 = (int *)queue_dequeue(q);
+  const int* v5 = (const int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v5);
   EXPECT_EQ_INT(*v5, 5);
 
@@ -105,23 +105,23 @@ static void test_queue_resize() {
 }
 
 static int destroyer_calls = 0;
-static void my_destroyer(void *item) {
+static void my_destroyer(void* item) {
   destroyer_calls++;
   free(item);
 }
 
 static void test_queue_destroyer() {
   destroyer_calls = 0;
-  Queue *q = queue_create(5, my_destroyer);
+  Queue* q = queue_create(5, my_destroyer);
   EXPECT_NOT_NULL(q);
 
   for (int i = 0; i < 3; i++) {
-    int *val = malloc(sizeof(int));
+    int* val = malloc(sizeof(int));
     *val = i;
     queue_enqueue(q, val);
   }
 
-  int *v = (int *)queue_dequeue(q);
+  int* v = (int*)queue_dequeue(q);
   EXPECT_NOT_NULL(v);
   EXPECT_EQ_INT(*v, 0);
   free(v);
@@ -131,18 +131,19 @@ static void test_queue_destroyer() {
 }
 
 typedef struct {
-  Queue *q;
+  Queue* q;
-  mtx_t *mutex;
+  mtx_t* mutex;
-  cnd_t *cnd_empty;
+  cnd_t* cnd_empty;
-  cnd_t *cnd_full;
+  cnd_t* cnd_full;
   bool done;
   int sum;
 } ThreadContext;
 
-static int consumer_func(void *arg) {
+static int consumer_func(void* arg) {
-  ThreadContext *ctx = (ThreadContext *)arg;
+  ThreadContext* ctx = (ThreadContext*)arg;
   while (true) {
-    int *val = (int *)queue_dequeue_multithreaded(ctx->q, ctx->mutex, ctx->cnd_empty, ctx->cnd_full, &ctx->done);
+    int* val = (int*)queue_dequeue_multithreaded(ctx->q, ctx->mutex, ctx->cnd_empty, ctx->cnd_full,
+                                                 &ctx->done);
     if (val == NULL) {
       break;
     }
@@ -153,7 +154,7 @@ static int consumer_func(void *arg) {
 }
 
 static void test_queue_multithreaded() {
-  Queue *q = queue_create(2, NULL);
+  Queue* q = queue_create(2, NULL);
   mtx_t mutex;
   cnd_t cnd_empty;
   cnd_t cnd_full;
@@ -162,21 +163,19 @@ static void test_queue_multithreaded() {
   cnd_init(&cnd_empty);
   cnd_init(&cnd_full);
 
-  ThreadContext ctx = {
+  ThreadContext ctx = {.q = q,
-    .q = q,
+                       .mutex = &mutex,
-    .mutex = &mutex,
+                       .cnd_empty = &cnd_empty,
-    .cnd_empty = &cnd_empty,
+                       .cnd_full = &cnd_full,
-    .cnd_full = &cnd_full,
+                       .done = false,
-    .done = false,
+                       .sum = 0};
-    .sum = 0
-  };
 
   thrd_t consumer;
   int res = thrd_create(&consumer, consumer_func, &ctx);
   EXPECT_EQ_INT(res, thrd_success);
 
   for (int i = 1; i <= 100; i++) {
-    int *val = malloc(sizeof(int));
+    int* val = malloc(sizeof(int));
     *val = i;
     queue_enqueue_multithreaded(q, val, &mutex, &cnd_empty, &cnd_full);
   }

tests/test_scanner.c

@@ -6,27 +6,28 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-static void create_test_file(const char *path, const char *content) {
+static void create_test_file(const char* path, const char* content) {
   (void)to_disk(path, content, strlen(content));
 }
 
 static void test_scanner_single_file() {
-  const char *dir = "test_scan_dir_single";
+  const char* dir = "test_scan_dir_single";
-  const char *file1 = "test_scan_dir_single/file1.txt";
+  const char* file1 = "test_scan_dir_single/file1.txt";
-  const char *content1 = "hello scanner";
+  const char* content1 = "hello scanner";
 
   mkdir(dir, 0755);
   create_test_file(file1, content1);
 
-  DirectoryScanner *scanner = directory_scanner_create((char *)dir, false, 0, NULL, 0, NULL, 0, 0, 0);
+  DirectoryScanner* scanner =
+      directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0);
   EXPECT_NOT_NULL(scanner);
 
-  Chunk *chunk = directory_scanner_next(scanner);
+  Chunk* chunk = directory_scanner_next(scanner);
   EXPECT_NOT_NULL(chunk);
   EXPECT_EQ_INT(chunk->element_count, 1);
   EXPECT_EQ_STR(chunk->items[0]->path, file1);
 
-  Chunk *next = directory_scanner_next(scanner);
+  const Chunk* next = directory_scanner_next(scanner);
   EXPECT_NULL(next);
 
   chunk_destroy(chunk);
@@ -36,35 +37,38 @@ static void test_scanner_single_file() {
 }
 
 static void test_scanner_multiple_files() {
-  const char *dir = "test_scan_dir_multi";
+  const char* dir = "test_scan_dir_multi";
-  const char *file1 = "test_scan_dir_multi/a.txt";
+  const char* file1 = "test_scan_dir_multi/a.txt";
-  const char *file2 = "test_scan_dir_multi/b.txt";
+  const char* file2 = "test_scan_dir_multi/b.txt";
-  const char *content1 = "alpha";
+  const char* content1 = "alpha";
-  const char *content2 = "beta";
+  const char* content2 = "beta";
 
   mkdir(dir, 0755);
   create_test_file(file1, content1);
   create_test_file(file2, content2);
 
-  DirectoryScanner *scanner = directory_scanner_create((char *)dir, false, 0, NULL, 0, NULL, 0, 0, 0);
+  DirectoryScanner* scanner =
+      directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0);
   EXPECT_NOT_NULL(scanner);
 
-  Chunk *chunk = directory_scanner_next(scanner);
+  const Chunk* chunk = directory_scanner_next(scanner);
   EXPECT_NOT_NULL(chunk);
   EXPECT_EQ_INT(chunk->element_count, 2);
 
   int found1 = 0, found2 = 0;
   for (int i = 0; i < chunk->element_count; i++) {
-    if (strcmp(chunk->items[i]->path, file1) == 0) found1 = 1;
+    if (strcmp(chunk->items[i]->path, file1) == 0)
-    if (strcmp(chunk->items[i]->path, file2) == 0) found2 = 1;
+      found1 = 1;
+    if (strcmp(chunk->items[i]->path, file2) == 0)
+      found2 = 1;
   }
   EXPECT_TRUE(found1);
   EXPECT_TRUE(found2);
 
-  Chunk *next = directory_scanner_next(scanner);
+  const Chunk* next = directory_scanner_next(scanner);
   EXPECT_NULL(next);
 
-  chunk_destroy(chunk);
+  chunk_destroy((void*)chunk);
   directory_scanner_destroy(scanner);
   unlink(file1);
   unlink(file2);
@@ -72,22 +76,23 @@ static void test_scanner_multiple_files() {
 }
 
 static void test_scanner_subdirectory() {
-  const char *root = "test_scan_sub";
+  const char* root = "test_scan_sub";
-  const char *sub = "test_scan_sub/sub";
+  const char* sub = "test_scan_sub/sub";
-  const char *root_file = "test_scan_sub/root.txt";
+  const char* root_file = "test_scan_sub/root.txt";
-  const char *sub_file = "test_scan_sub/sub/sub_file.txt";
+  const char* sub_file = "test_scan_sub/sub/sub_file.txt";
-  const char *content = "nested content";
+  const char* content = "nested content";
 
   mkdir(root, 0755);
   mkdir(sub, 0755);
   create_test_file(root_file, content);
   create_test_file(sub_file, content);
 
-  DirectoryScanner *scanner = directory_scanner_create((char *)root, false, 0, NULL, 0, NULL, 0, 0, 0);
+  DirectoryScanner* scanner =
+      directory_scanner_create((char*)root, false, 0, NULL, 0, NULL, 0, 0, 0);
   EXPECT_NOT_NULL(scanner);
 
   int total_files = 0;
-  Chunk *chunk;
+  Chunk* chunk;
   while ((chunk = directory_scanner_next(scanner)) != NULL) {
     total_files += chunk->element_count;
     chunk_destroy(chunk);
@@ -102,14 +107,15 @@ static void test_scanner_subdirectory() {
 }
 
 static void test_scanner_empty_directory() {
-  const char *dir = "test_scan_empty";
+  const char* dir = "test_scan_empty";
 
   mkdir(dir, 0755);
 
-  DirectoryScanner *scanner = directory_scanner_create((char *)dir, false, 0, NULL, 0, NULL, 0, 0, 0);
+  DirectoryScanner* scanner =
+      directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0);
   EXPECT_NOT_NULL(scanner);
 
-  Chunk *chunk = directory_scanner_next(scanner);
+  const Chunk* chunk = directory_scanner_next(scanner);
   EXPECT_NULL(chunk);
 
   directory_scanner_destroy(scanner);

tests/test_shared_utils.c

@@ -6,56 +6,56 @@
 
 void test_shared_utils() {
   // Test str_dup
-  char *dup_null = str_dup(NULL);
+  const char* dup_null = str_dup(NULL);
   EXPECT_NULL(dup_null);
-  
+
-  char *dup_empty = str_dup("");
+  char* dup_empty = str_dup("");
   EXPECT_NOT_NULL(dup_empty);
   EXPECT_EQ_STR(dup_empty, "");
   free(dup_empty);
-  
+
-  char *dup_normal = str_dup("hello world");
+  char* dup_normal = str_dup("hello world");
   EXPECT_NOT_NULL(dup_normal);
   EXPECT_EQ_STR(dup_normal, "hello world");
   free(dup_normal);
-  
+
   // Test path_cat
-  char *cat1 = path_cat("/foo", "/bar");
+  char* cat1 = path_cat("/foo", "/bar");
   EXPECT_NOT_NULL(cat1);
   EXPECT_EQ_STR(cat1, "/foo/bar");
   free(cat1);
-  
+
-  char *cat2 = path_cat("/foo/", "/bar");
+  char* cat2 = path_cat("/foo/", "/bar");
   EXPECT_NOT_NULL(cat2);
   EXPECT_EQ_STR(cat2, "/foo/bar");
   free(cat2);
-  
+
-  char *cat3 = path_cat("/foo", "bar");
+  char* cat3 = path_cat("/foo", "bar");
   EXPECT_NOT_NULL(cat3);
   EXPECT_EQ_STR(cat3, "/foo/bar");
   free(cat3);
-  
+
-  char *cat4 = path_cat("/foo/", "bar");
+  char* cat4 = path_cat("/foo/", "bar");
   EXPECT_NOT_NULL(cat4);
   EXPECT_EQ_STR(cat4, "/foo/bar");
   free(cat4);
-  
+
-  char *cat_empty1 = path_cat("", "/bar");
+  char* cat_empty1 = path_cat("", "/bar");
   EXPECT_NOT_NULL(cat_empty1);
   EXPECT_EQ_STR(cat_empty1, "/bar");
   free(cat_empty1);
-  
+
-  char *cat_empty2 = path_cat("/foo", "");
+  char* cat_empty2 = path_cat("/foo", "");
   EXPECT_NOT_NULL(cat_empty2);
   EXPECT_EQ_STR(cat_empty2, "/foo");
   free(cat_empty2);
-  
+
-  char *cat_null1 = path_cat(NULL, "/bar");
+  char* cat_null1 = path_cat(NULL, "/bar");
   EXPECT_NOT_NULL(cat_null1);
   EXPECT_EQ_STR(cat_null1, "/bar");
   free(cat_null1);
-  
+
-  char *cat_null2 = path_cat("/foo", NULL);
+  char* cat_null2 = path_cat("/foo", NULL);
   EXPECT_NOT_NULL(cat_null2);
   EXPECT_EQ_STR(cat_null2, "/foo");
   free(cat_null2);

tests/test_utils.h

@@ -11,84 +11,90 @@ extern int tests_failed;
 extern bool current_test_failed;
 
 // Helper to run a test function
-#define RUN_TEST(test_func) \
+#define RUN_TEST(test_func)                                                                        \
-  do { \
+  do {                                                                                             \
-    printf("Running %s...\n", #test_func); \
+    printf("Running %s...\n", #test_func);                                                         \
-    tests_run++; \
+    tests_run++;                                                                                   \
-    current_test_failed = false; \
+    current_test_failed = false;                                                                   \
-    test_func(); \
+    test_func();                                                                                   \
-    if (current_test_failed) { \
+    if (current_test_failed) {                                                                     \
-      tests_failed++; \
+      tests_failed++;                                                                              \
-      printf("  \033[1;31m[FAILED]\033[0m %s\n", #test_func); \
+      printf("  \033[1;31m[FAILED]\033[0m %s\n", #test_func);                                      \
-    } else { \
+    } else {                                                                                       \
-      printf("  \033[1;32m[PASSED]\033[0m %s\n", #test_func); \
+      printf("  \033[1;32m[PASSED]\033[0m %s\n", #test_func);                                      \
-    } \
+    }                                                                                              \
   } while (0)
 
 // Assertion macros
-#define EXPECT_TRUE(condition) \
+#define EXPECT_TRUE(condition)                                                                     \
-  do { \
+  do {                                                                                             \
-    if (!(condition)) { \
+    if (!(condition)) {                                                                            \
-      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Assertion failed: %s is false\n", __FILE__, __LINE__, #condition); \
+      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Assertion failed: %s is false\n", __FILE__,       \
-      current_test_failed = true; \
+             __LINE__, #condition);                                                                \
-      return; \
+      current_test_failed = true;                                                                  \
-    } \
+      return;                                                                                      \
+    }                                                                                              \
   } while (0)
 
-#define EXPECT_FALSE(condition) \
+#define EXPECT_FALSE(condition)                                                                    \
-  do { \
+  do {                                                                                             \
-    if (condition) { \
+    if (condition) {                                                                               \
-      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Assertion failed: %s is true\n", __FILE__, __LINE__, #condition); \
+      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Assertion failed: %s is true\n", __FILE__,        \
-      current_test_failed = true; \
+             __LINE__, #condition);                                                                \
-      return; \
+      current_test_failed = true;                                                                  \
-    } \
+      return;                                                                                      \
+    }                                                                                              \
   } while (0)
 
-#define EXPECT_EQ_INT(actual, expected) \
+#define EXPECT_EQ_INT(actual, expected)                                                            \
-  do { \
+  do {                                                                                             \
-    int act = (actual); \
+    int act = (actual);                                                                            \
-    int exp = (expected); \
+    int exp = (expected);                                                                          \
-    if (act != exp) { \
+    if (act != exp) {                                                                              \
-      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected %d, got %d\n", __FILE__, __LINE__, exp, act); \
+      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected %d, got %d\n", __FILE__, __LINE__, exp,  \
-      current_test_failed = true; \
+             act);                                                                                 \
-      return; \
+      current_test_failed = true;                                                                  \
-    } \
+      return;                                                                                      \
+    }                                                                                              \
   } while (0)
 
-#define EXPECT_EQ_STR(actual, expected) \
+#define EXPECT_EQ_STR(actual, expected)                                                            \
-  do { \
+  do {                                                                                             \
-    const char *act = (actual); \
+    const char* act = (actual);                                                                    \
-    const char *exp = (expected); \
+    const char* exp = (expected);                                                                  \
-    if (act == NULL || exp == NULL) { \
+    if (act == NULL || exp == NULL) {                                                              \
-      if (act != exp) { \
+      if (act != exp) {                                                                            \
-        printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected %s, got %s\n", __FILE__, __LINE__, \
+        printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected %s, got %s\n", __FILE__, __LINE__,     \
-               exp ? exp : "NULL", act ? act : "NULL"); \
+               exp ? exp : "NULL", act ? act : "NULL");                                            \
-        current_test_failed = true; \
+        current_test_failed = true;                                                                \
-        return; \
+        return;                                                                                    \
-      } \
+      }                                                                                            \
-    } else if (strcmp(act, exp) != 0) { \
+    } else if (strcmp(act, exp) != 0) {                                                            \
-      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected \"%s\", got \"%s\"\n", __FILE__, __LINE__, exp, act); \
+      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected \"%s\", got \"%s\"\n", __FILE__,         \
-      current_test_failed = true; \
+             __LINE__, exp, act);                                                                  \
-      return; \
+      current_test_failed = true;                                                                  \
-    } \
+      return;                                                                                      \
+    }                                                                                              \
   } while (0)
 
-#define EXPECT_NOT_NULL(ptr) \
+#define EXPECT_NOT_NULL(ptr)                                                                       \
-  do { \
+  do {                                                                                             \
-    if ((ptr) == NULL) { \
+    if ((ptr) == NULL) {                                                                           \
-      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected non-null pointer, got NULL\n", __FILE__, __LINE__); \
+      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected non-null pointer, got NULL\n", __FILE__, \
-      current_test_failed = true; \
+             __LINE__);                                                                            \
-      return; \
+      current_test_failed = true;                                                                  \
-    } \
+      return;                                                                                      \
+    }                                                                                              \
   } while (0)
 
-#define EXPECT_NULL(ptr) \
+#define EXPECT_NULL(ptr)                                                                           \
-  do { \
+  do {                                                                                             \
-    if ((ptr) != NULL) { \
+    if ((ptr) != NULL) {                                                                           \
-      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected NULL, got %p\n", __FILE__, __LINE__, (void*)(ptr)); \
+      printf("    \033[1;31m[FAIL]\033[0m %s:%d: Expected NULL, got %p\n", __FILE__, __LINE__,     \
-      current_test_failed = true; \
+             (void*)(ptr));                                                                        \
-      return; \
+      current_test_failed = true;                                                                  \
-    } \
+      return;                                                                                      \
+    }                                                                                              \
   } while (0)
 
 #endif