fix: harden remaining review findings

Reviewed-on: #211

README.md

@@ -40,12 +40,10 @@ A high-performance file synchronization system with SSH and TCP transport, TLS e
 - Optional progress display with throughput
 - Bandwidth limiting via token-bucket algorithm
 - Configurable I/O and connection timeouts (`--timeout`, `--contimeout`)
-- Quiet mode (`-q`/`--quiet`) suppresses all non-error output
 - Backup overwritten files (`--backup`) with optional directory (`--backup-dir`)
 - Transfer statistics summary (`--stats`)
 - Maximum directory depth control (`--max-depth`)
 - Log file output (`--log-file`)
-- Configurable multithreaded queue size (`--queue-size`)
 - Exclude patterns from file (`--exclude-from`)
 
 ### Server
@@ -116,8 +114,6 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `-n, --dry-run` | Scan and print what would be transferred |
 | `-p <port>` | SSH port (default: 22) |
 | `-v, --verbose` | Enable debug logging |
-| `-q, --quiet` | Suppress all non-error output |
-| `--silent` | Alias for `--quiet` |
 | `--progress` | Show real-time transfer speed |
 | `--delete` | Delete files on receiver not present in source |
 | `--exclude <pattern>` | Exclude files matching glob pattern (repeatable) |
@@ -135,7 +131,6 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `--stats` | Print transfer statistics at end (bytes, files, timing) |
 | `--max-depth <n>` | Maximum directory depth to recurse (0 = unlimited, default: 0) |
 | `--log-file <path>` | Write log messages to file instead of stderr |
-| `--queue-size <n>` | Queue capacity for multithreaded mode (default: 100) |
 | `--source-dir <path>` | Source directory (overrides `FASTSYNC_SOURCE_DIR`) |
 | `--dest-dir <path>` | Server destination directory (overrides `FASTSYNC_DEST_DIR`) |
 | `--save-to-disk` | Write received files to disk |
@@ -145,6 +140,7 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `--cert <path>` | TLS certificate file (PEM) |
 | `--key <path>` | TLS private key file (PEM) |
 | `--ca <path>` | TLS CA certificate file for verification (PEM) |
+| `--client-cn <name>` | Required TLS client certificate common name |
 
 ### Server
 
@@ -156,6 +152,9 @@ Config negotiation is sender-driven: the client serializes transfer options and
 | `--cert <path>` | TLS certificate file (PEM) |
 | `--key <path>` | TLS private key file (PEM) |
 | `--ca <path>` | TLS CA certificate file for verification (PEM) |
+| `--destination-root <path>` | Authorized destination root (default: `.`) |
+| `--allow-delete` | Permit manifest deletion |
+| `--allow-unauthenticated` | Permit plaintext TCP clients |
 | `-v, --verbose` | Enable debug logging |
 | `--help` | Show help |
 
@@ -193,7 +192,7 @@ Config negotiation is sender-driven: the client serializes transfer options and
 7. **Metadata restoration** — `chmod()`, `chown()`, `utimensat()` on the receiving side
 8. **`--delete`** — sender tracks all sent paths; receiver walks destination tree and removes unlisted files/directories
 9. **SSH transport** — `socketpair()` + `fork()` + `execvp("ssh", ...)` with `ControlMaster` and port support
-10. **TLS transport** — OpenSSL `SSL_CTX` with TLS 1.2 minimum, optional CA verification, transparent `SSL_read`/`SSL_write` via `io_set_ssl()`
+10. **TLS transport** — OpenSSL `SSL_CTX` with TLS 1.2 minimum, mutual CA verification, transparent `SSL_read`/`SSL_write` via `io_set_ssl()`
 11. **Path traversal protection** — `has_path_traversal()` rejects any file path containing `..` components, preventing directory escape attacks
 12. **Connection limiting** — server tracks active connections and rejects new ones beyond `max_connections` (default 100)
 13. **Keep-alive** — idle connections receive periodic `STATUS_KEEPALIVE` to detect half-open TCP connections
@@ -207,7 +206,7 @@ Config negotiation is sender-driven: the client serializes transfer options and
 All received file paths are validated by `has_path_traversal()` before any disk operation. Any path containing `..` components is rejected with `STATUS_ERROR`, preventing directory escape attacks.
 
 ### TLS Certificate Verification
-When `--ca` is provided, the server performs mutual TLS verification (`SSL_VERIFY_PEER` with depth 4). Without `--ca`, TLS is still encrypted but peer certificates are not verified.
+TLS requires `--ca` and performs mutual TLS verification (`SSL_VERIFY_PEER` with depth 4). Connections without certificate verification are rejected.
 
 ### Connection Limits
 The server enforces a maximum of 100 concurrent connections (configurable via `max_connections` in `Server`). When the limit is reached, new connections are immediately rejected and closed.
@@ -249,12 +248,12 @@ cmake -B build -S . && cmake --build build -j$(nproc)
 
 ### Server (TCP mode)
 ```bash
-./build/server
+./build/server --allow-unauthenticated
 ```
 
 ### Server with TLS
 ```bash
-./build/server --tls --cert server.pem --key server-key.pem
+./build/server --tls --cert server.pem --key server-key.pem --ca ca.pem --client-cn fastsync-client
 ```
 
 ### Server via SSH
@@ -270,6 +269,9 @@ Place the `fastsync-server` binary in the remote `$PATH`. The client runs `ssh u
 ./build/client --source-dir /path/to/send --dest-dir /path/to/receive --save-to-disk
 ```
 
+Plain TCP requires the explicit `--allow-unauthenticated` server option. Use TLS for
+authenticated network connections.
+
 ### Client — TCP with TLS
 ```bash
 ./build/client --tls --cert client.pem --key client-key.pem --ca ca.pem \
@@ -296,8 +298,8 @@ Place the `fastsync-server` binary in the remote `$PATH`. The client runs `ssh u
 # Bandwidth limit to 1 MB/s
 ./build/client --bwlimit 1024 /src user@host:/dst
 
-# With timeouts, quiet mode, and stats
+# With timeouts and stats
-./build/client --timeout 60 --contimeout 15 --quiet --stats /src user@host:/dst
+./build/client --timeout 60 --contimeout 15 --stats /src user@host:/dst
 
 # Backup overwritten files to a directory
 ./build/client --backup --backup-dir /backups /src user@host:/dst
@@ -305,9 +307,6 @@ Place the `fastsync-server` binary in the remote `$PATH`. The client runs `ssh u
 # Exclude patterns from file, limit depth
 ./build/client --exclude-from ignore.txt --max-depth 3 /src user@host:/dst
 
-# Custom queue size for multithreading
-./build/client -m --queue-size 200 /src user@host:/dst
-
 # Log to file
 ./build/client --log-file /tmp/fastsync.log /src user@host:/dst
 
@@ -334,7 +333,7 @@ The benchmark prints throughput metrics, best configuration, and speedup vs rsyn
 1. Chunk size (~10 MB default) balances memory and transfer efficiency
 2. Compression level trades CPU for bandwidth
 3. `sendfile()` bypasses userspace — ~2× faster on localhost for large files
-4. Multithreading scales with core count; `--queue-size` controls pipeline buffering
+4. Multithreading scales with core count and uses memory-based pipeline sizing
 5. Metadata transfer adds negligible overhead (~24 bytes per file when enabled)
 6. SSH socketpair buffer set to 1 MB for improved pipe throughput
 7. SSH ControlMaster reuses connections across repeated invocations

RSYNC_COMPAT.md

@@ -6,10 +6,10 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Status | Count | Description |
 |--------|-------|-------------|
-| ✅ Implemented | 39 | Feature works end-to-end |
+| ✅ Implemented | 34 | Feature works end-to-end |
-| 🔀 Alt Arg | 5 | Functionality exists but under different flag/semantics |
+| 🔀 Alt Arg | 3 | Functionality exists but under different flag/semantics |
-| ⚠️ Partial | 30 | Flag parsed/stored but behavior incomplete |
+| ⚠️ Partial | 1 | Flag parsed/stored but behavior incomplete |
-| ❌ Not Implemented | 62 | Flag not recognized or no behavior |
+| ❌ Not Implemented | 98 | Flag not recognized or no behavior |
 | **Total** | **136** | |
 
 ---
@@ -20,31 +20,31 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `-a`, `--archive` | Archive mode is -rlptgoD | 🔀 Alt Arg | Maps to -c -m -M (compression + multithread + metadata) |
 | `-v`, `--verbose` | Increase verbosity | ✅ Implemented | Sets `log_level=DEBUG` |
-| `-q`, `--quiet` | Suppress non-error messages | ✅ Implemented | `quiet` config field |
+| `-q`, `--quiet` | Suppress non-error messages | ❌ Not Implemented | Removed because it had no effect |
-| `-h`, `--help` | Show help | ✅ Implemented | Prints usage and exits |
+| `--help` | Show help | ✅ Implemented | Prints usage and exits; `-h` is not accepted |
-| `-V`, `--version` | Print version | ❌ Not Implemented | |
+| `-V`, `--version` | Print version | ✅ Implemented | |
-| `--info=FLAGS` | Fine-grained info verbosity | ⚠️ Partial | `info_level` stored, not wired |
+| `--info=FLAGS` | Fine-grained info verbosity | ❌ Not Implemented | Removed because it had no effect |
-| `--debug=FLAGS` | Fine-grained debug verbosity | ⚠️ Partial | `debug_level` stored, not wired |
+| `--debug=FLAGS` | Fine-grained debug verbosity | ❌ Not Implemented | Removed because it had no effect |
 | `--stderr=MODE` | Change stderr output mode | ❌ Not Implemented | |
 | `--no-motd` | Suppress daemon MOTD | ❌ Not Implemented | |
 | `--exclude=PATTERN` | Exclude files matching pattern | ✅ Implemented | Glob matching in scanner |
 | `--include=PATTERN` | Include files matching pattern | ✅ Implemented | Glob matching in scanner |
-| `-C`, `--cvs-exclude` | Auto-ignore CVS files | ⚠️ Partial | `cvs_exclude` stored, not wired |
+| `-C`, `--cvs-exclude` | Auto-ignore CVS files | ❌ Not Implemented | Removed because it had no effect |
 
 ## 2. Modifying Output
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `--stats` | Give transfer stats | ✅ Implemented | Prints file/byte counts |
-| `-h`, `--human-readable` | Human-readable numbers | ⚠️ Partial | `human_readable` stored, not wired |
+| `-h`, `--human-readable` | Human-readable numbers | ❌ Not Implemented | Removed because it had no effect |
-| `-i`, `--itemize-changes` | Per-file change summary | ⚠️ Partial | `itemize_changes` stored, not wired |
+| `-i`, `--itemize-changes` | Per-file change summary | ❌ Not Implemented | Removed because it had no effect |
 | `--progress` | Show progress | ✅ Implemented | Progress callback in sender |
 | `-P` | Same as --partial --progress | ❌ Not Implemented | |
-| `--out-format=FORMAT` | Custom output format | ⚠️ Partial | `out_format` stored, not wired |
+| `--out-format=FORMAT` | Custom output format | ❌ Not Implemented | Removed because it had no effect |
 | `--log-file=FILE` | Log to file | ✅ Implemented | `log_file` config field |
 | `--log-file-format=FMT` | Log format | ❌ Not Implemented | |
 | `--8-bit-output` | Leave high-bit chars unescaped | ❌ Not Implemented | |
-| `--list-only` | List files instead of copying | ⚠️ Partial | `list_only` stored, not wired |
+| `--list-only` | List files instead of copying | ❌ Not Implemented | Removed because it had no effect |
 
 ## 3. File Selection
 
@@ -52,8 +52,8 @@ This document maps rsync's full feature set to FastSync's current implementation
 |------|-------------------|-----------------|-------|
 | `--exclude-from=FILE` | Read exclude patterns from file | ✅ Implemented | Reads patterns from file |
 | `--include-from=FILE` | Read include patterns from file | ✅ Implemented | Reads patterns from file |
-| `--filter=RULE` | Add file-filtering rule | ⚠️ Partial | `filters` ArrayList stored, not wired |
+| `--filter=RULE` | Add file-filtering rule | ❌ Not Implemented | Removed because it had no effect |
-| `--files-from=FILE` | Read source file list from file | ⚠️ Partial | `files_from` stored, not wired |
+| `--files-from=FILE` | Read source file list from file | ❌ Not Implemented | Removed because it had no effect |
 | `-0`, `--from0` | Delimit *-from files with NULs | ❌ Not Implemented | |
 | `--max-size=SIZE` | Skip files larger than SIZE | ✅ Implemented | `max_size` in scanner |
 | `--min-size=SIZE` | Skip files smaller than SIZE | ✅ Implemented | `min_size` in scanner |
@@ -69,7 +69,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `-r`, `--recursive` | Recurse into directories | ✅ Implemented | Default behavior |
-| `-R`, `--relative` | Use relative path names | ⚠️ Partial | `relative` stored, not wired |
+| `-R`, `--relative` | Use relative path names | ❌ Not Implemented | Removed because it had no effect |
 | `--no-implied-dirs` | Don't send implied dirs with -R | ❌ Not Implemented | |
 | `-d`, `--dirs` | Transfer dirs without recursing | ❌ Not Implemented | |
 | `--mkpath` | Create missing path components | ❌ Not Implemented | |
@@ -78,10 +78,10 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-u`, `--update` | Skip files newer on receiver | ⚠️ Partial | `update` stored, not wired |
+| `-u`, `--update` | Skip files newer on receiver | ❌ Not Implemented | Removed because it had no effect |
 | `--inplace` | Update files in-place | ✅ Implemented | Direct write mode |
-| `--append` | Append data to shorter files | ⚠️ Partial | `append` stored, not wired |
+| `--append` | Append data to shorter files | ❌ Not Implemented | Removed because it had no effect |
-| `--append-verify` | Append with old-data checksum | ⚠️ Partial | `append_verify` stored, not wired |
+| `--append-verify` | Append with old-data checksum | ❌ Not Implemented | Removed because it had no effect |
 | `-W`, `--whole-file` | Copy whole file (no delta) | ❌ Not Implemented | |
 | `--block-size=SIZE` | Force checksum block-size | ⚠️ Partial | Parsed as `--delta-block`; controls delta transfer block size |
 
@@ -100,15 +100,15 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `--delete` | Delete extraneous files from dest | ✅ Implemented | `use_delete` config field |
-| `--delete-before` | Delete before transfer | ⚠️ Partial | `delete_before` stored, not wired |
+| `--delete-before` | Delete before transfer | ❌ Not Implemented | Removed because it had no effect |
 | `--delete-during` | Delete during transfer | ❌ Not Implemented | |
 | `--delete-delay` | Find deletions during, delete after | ❌ Not Implemented | |
-| `--delete-after` | Delete after transfer | ⚠️ Partial | `delete_after` stored, not wired |
+| `--delete-after` | Delete after transfer | ❌ Not Implemented | Removed because it had no effect |
-| `--delete-excluded` | Also delete excluded files | ⚠️ Partial | `delete_excluded` stored, not wired |
+| `--delete-excluded` | Also delete excluded files | ❌ Not Implemented | Removed because it had no effect |
-| `--max-delete=NUM` | Max files to delete | ⚠️ Partial | `max_delete` stored, not wired |
+| `--max-delete=NUM` | Max files to delete | ❌ Not Implemented | Removed because it had no effect |
 | `--ignore-errors` | Delete even with I/O errors | ❌ Not Implemented | |
 | `--force` | Force deletion of non-empty dirs | ❌ Not Implemented | |
-| `--prune-empty-dirs` | Prune empty dir chains | ⚠️ Partial | `prune_empty_dirs` stored, not wired |
+| `--prune-empty-dirs` | Prune empty dir chains | ❌ Not Implemented | Removed because it had no effect |
 
 ## 8. Metadata Preservation
 
@@ -121,11 +121,11 @@ This document maps rsync's full feature set to FastSync's current implementation
 | `-t`, `--times` | Preserve modification times | ✅ Implemented | Part of -M |
 | `-E`, `--executability` | Preserve executability | ❌ Not Implemented | |
 | `--chmod=CHMOD` | Affect file permissions | ❌ Not Implemented | |
-| `-A`, `--acls` | Preserve ACLs | ⚠️ Partial | `preserve_acls` stored, not wired |
+| `-A`, `--acls` | Preserve ACLs | ❌ Not Implemented | Removed because it had no effect |
-| `-X`, `--xattrs` | Preserve extended attributes | ⚠️ Partial | `preserve_xattrs` stored, not wired |
+| `-X`, `--xattrs` | Preserve extended attributes | ❌ Not Implemented | Removed because it had no effect |
-| `-H`, `--hard-links` | Preserve hard links | ⚠️ Partial | `preserve_hard_links` stored, not wired |
+| `-H`, `--hard-links` | Preserve hard links | ❌ Not Implemented | Removed because it had no effect |
-| `-D` | Same as --devices --specials | 🔀 Alt Arg | Maps to --devices only (no --specials) |
+| `-D` | Same as --devices --specials | ❌ Not Implemented | Removed because device-file handling is not implemented |
-| `--devices` | Preserve device files | ⚠️ Partial | `preserve_devices` stored, not wired |
+| `--devices` | Preserve device files | ❌ Not Implemented | Removed because it had no effect |
 | `--specials` | Preserve special files | ❌ Not Implemented | |
 | `--copy-devices` | Copy device contents as file | ❌ Not Implemented | |
 | `--write-devices` | Write to devices as files | ❌ Not Implemented | |
@@ -159,11 +159,11 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-c`, `--checksum` | Skip based on checksum | 🔀 Alt Arg | `-c` means compression; `--checksum` stored and forwarded to scanner |
+| `--checksum` | Skip based on checksum | ❌ Not Implemented | Removed because it had no effect; `-c` means compression |
 | `--checksum-choice=STR` | Choose checksum algorithm | ❌ Not Implemented | xxHash used internally |
-| `--compare-dest=DIR` | Compare dest files relative to DIR | ⚠️ Partial | `compare_dest` stored, not wired |
+| `--compare-dest=DIR` | Compare dest files relative to DIR | ❌ Not Implemented | Removed because it had no effect |
-| `--copy-dest=DIR` | Include copies of unchanged files | ⚠️ Partial | `copy_dest` stored, not wired |
+| `--copy-dest=DIR` | Include copies of unchanged files | ❌ Not Implemented | Removed because it had no effect |
-| `--link-dest=DIR` | Hardlink to files when unchanged | ⚠️ Partial | `link_dest` stored, not wired |
+| `--link-dest=DIR` | Hardlink to files when unchanged | ❌ Not Implemented | Removed because it had no effect |
 | `--fuzzy`, `--no-fuzzy` | Find similar file for basis | ❌ Not Implemented | |
 
 ## 12. Compression
@@ -171,7 +171,7 @@ This document maps rsync's full feature set to FastSync's current implementation
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
 | `-z`, `--compress` | Compress file data | 🔀 Alt Arg | Always uses zstd (rsync supports multiple algorithms) |
-| `--compress-choice=STR` | Choose compression algorithm | ⚠️ Partial | `compress_choice` stored, always zstd |
+| `--compress-choice=STR` | Choose compression algorithm | ❌ Not Implemented | Removed because it had no effect; FastSync always uses zstd |
 | `--compress-level=NUM` | Set compression level | ✅ Implemented | 1-22, default 5 |
 | `--compress-threads=NUM` | Set compression threads | ❌ Not Implemented | |
 | `--skip-compress=LIST` | Skip compress for suffixes | ❌ Not Implemented | Internal skip for hardcoded types; not user-configurable |
@@ -180,22 +180,22 @@ This document maps rsync's full feature set to FastSync's current implementation
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `-e`, `--rsh=COMMAND` | Remote shell to use | ✅ Implemented | SSH transport support |
+| `-e`, `--rsh=COMMAND` | Remote shell to use | ❌ Not Implemented | Removed; SSH invokes `ssh` directly |
-| `--rsync-path=PROGRAM` | rsync binary on remote | ✅ Implemented | `rsync_path` config field |
+| `--rsync-path=PROGRAM` | rsync binary on remote | ❌ Not Implemented | Removed; use `--fastsync-server-path` |
 | `--port=PORT` | Alternate daemon port | ✅ Implemented | `server_port` config field |
 | `--sockopts=OPTIONS` | Custom TCP options | ❌ Not Implemented | |
 | `--blocking-io` | Use blocking I/O for remote shell | ❌ Not Implemented | |
 | `--outbuf=N\|L\|B` | Set output buffering | ❌ Not Implemented | |
-| `--address=ADDRESS` | Bind address for outgoing socket | ✅ Implemented | `address` config field |
+| `--address=ADDRESS` | Bind address for outgoing socket | ❌ Not Implemented | Removed because it had no effect |
-| `-4`, `--ipv4` | Prefer IPv4 | ✅ Implemented | `ipv4` config field |
+| `-4`, `--ipv4` | Prefer IPv4 | ❌ Not Implemented | Removed because it had no effect |
-| `-6`, `--ipv6` | Prefer IPv6 | ✅ Implemented | `ipv6` config field |
+| `-6`, `--ipv6` | Prefer IPv6 | ❌ Not Implemented | Removed because it had no effect |
 
 ## 14. Daemon Mode
 
 | Flag | Rsync Description | FastSync Status | Notes |
 |------|-------------------|-----------------|-------|
-| `--daemon` | Run as rsync daemon | ⚠️ Partial | `daemon` stored, not wired |
+| `--daemon` | Run as rsync daemon | ❌ Not Implemented | Removed because it had no effect |
-| `--config=FILE` | Alternate rsyncd.conf file | ⚠️ Partial | `daemon_config` stored, not wired |
+| `--config=FILE` | Alternate rsyncd.conf file | ❌ Not Implemented | Removed because it had no effect |
 | `--dparam=OVERRIDE` | Override global daemon config | ❌ Not Implemented | |
 | `--no-detach` | Don't detach from parent | ❌ Not Implemented | |
 | `--password-file=FILE` | Read daemon password from file | ❌ Not Implemented | |
@@ -266,7 +266,6 @@ Ranked by user demand, implementation complexity, and interoperability impact:
 | `-f` / `--sendfile` | Zero-copy sendfile() syscall (TCP only) |
 | `-c [level]` | zstd compression level (1-22) |
 | `--chunk-size` | Configurable chunk size |
-| `--queue-size` | Pipeline queue capacity |
 | `--tls` | TLS encryption (mutual auth) |
 | `--fastsync-server-path` | Path to fastsync-server binary |
 | `--server-host` / `--server-port` | Direct TCP connection |

src/client/client_cli.c

@@ -8,9 +8,11 @@
 #include "utils.h"
 #include <errno.h>
 #include <limits.h>
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include "usage.c"
 
 #ifndef FASTSYNC_TEST_BUILD
 /* Parse environment variables for source/destination directories and save-to-disk flag. */
@@ -25,19 +27,6 @@ static void parse_environment(const char** out_env_source, const char** out_env_
 }
 #endif
 
-/* Parse a string as a positive integer, returning true on success. */
-static bool parse_positive_int(const char* s, int* out_val) {
-  if (!s || *s == '\0')
-    return false;
-  char* endptr;
-  errno = 0;
-  long val = strtol(s, &endptr, 10);
-  if (errno != 0 || *endptr != '\0' || val <= 0 || val > INT_MAX)
-    return false;
-  *out_val = (int)val;
-  return true;
-}
-
 /* Parse a string as a non-negative integer, returning true on success. */
 static bool parse_nonneg_int(const char* s, int* out_val) {
   if (!s || *s == '\0')
@@ -51,7 +40,20 @@ static bool parse_nonneg_int(const char* s, int* out_val) {
   return true;
 }
 
-/* Duplicate a string argument into *dest, freeing the old value. Returns 0 on success, -1 on
+/* Parse a string as a positive integer, returning true on success. */
+static bool parse_positive_int(const char* s, int* out_val) {
+  int temp;
+  if (!parse_nonneg_int(s, &temp)) {
+    return false;
+  }
+  if (temp == 0) {
+    return false;
+  }
+  *out_val = temp;
+  return true;
+}
+
+/* Duplicate a string argument into *dest, freeing the old value. Returns true on success, false on
  * failure. */
 static int set_string_option(char** dest, const char* value, const char* option_name) {
   char* dup = str_dup(value);
@@ -64,7 +66,7 @@ static int set_string_option(char** dest, const char* value, const char* option_
   return 0;
 }
 
-/* Parse a string as a positive integer into *dest. Returns 0 on success, -1 on error. */
+/* Parse a string as a positive integer into *dest. Returns true on success, false on error. */
 static int set_positive_int_option(int* dest, const char* value, const char* option_name) {
   if (!parse_positive_int(value, dest)) {
     fprintf(stderr, "Error: %s must be a positive integer\n", option_name);
@@ -73,7 +75,7 @@ static int set_positive_int_option(int* dest, const char* value, const char* opt
   return 0;
 }
 
-/* Parse a string as a non-negative integer into *dest. Returns 0 on success, -1 on error. */
+/* Parse a string as a non-negative integer into *dest. Returns true on success, false on error. */
 static int set_nonneg_int_option(int* dest, const char* value, const char* option_name) {
   if (!parse_nonneg_int(value, dest)) {
     fprintf(stderr, "Error: %s must be a non-negative integer\n", option_name);
@@ -82,7 +84,6 @@ static int set_nonneg_int_option(int* dest, const char* value, const char* optio
   return 0;
 }
 
-static void print_usage(void);
 static int read_patterns_from_file(const char* filepath, char*** patterns, int* count);
 
 /* Parse CLI arguments into config. Returns 0 on success, -1 on error, 1 for help/clean-exit. */
@@ -103,12 +104,10 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
     } else if (strcmp(argv[i], "-n") == 0 || strcmp(argv[i], "--dry-run") == 0) {
       config->dry_run = true;
     } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
-      if (!parse_positive_int(argv[++i], &config->ssh_port)) {
+      if (set_positive_int_option(&config->ssh_port, argv[++i], "-p") != 0)
-        fprintf(stderr, "Error: invalid --port/-p value: %s\n", argv[i]);
         return -1;
-      }
       if (config->ssh_port > 65535) {
-        fprintf(stderr, "Error: SSH port must be 1-65535\n");
+        log_message(LOG_LEVEL_ERROR, "SSH port must be 1-65535\n");
         return -1;
       }
     } else if (strcmp(argv[i], "--delete") == 0) {
@@ -275,9 +274,6 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
     } else if (strcmp(argv[i], "--contimeout") == 0 && i + 1 < argc) {
       if (set_positive_int_option(&config->contimeout, argv[++i], "--contimeout") != 0)
         return -1;
-    } else if (strcmp(argv[i], "-q") == 0 || strcmp(argv[i], "--quiet") == 0 ||
-               strcmp(argv[i], "--silent") == 0) {
-      config->quiet = true;
     } else if (strcmp(argv[i], "--backup") == 0) {
       config->backup = true;
     } else if (strcmp(argv[i], "--backup-dir") == 0 && i + 1 < argc) {
@@ -301,9 +297,6 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       }
       config->log_file = lf;
       log_set_file(lf);
-    } else if (strcmp(argv[i], "--queue-size") == 0 && i + 1 < argc) {
-      if (set_positive_int_option(&config->queue_size, argv[++i], "--queue-size") != 0)
-        return -1;
     } else if (strcmp(argv[i], "--exclude-from") == 0 && i + 1 < argc) {
       if (read_patterns_from_file(argv[++i], &config->exclude_patterns, &config->exclude_count) !=
           0)
@@ -328,126 +321,21 @@ int parse_args(Config* config, int argc, char* argv[], int* positional_args,
       config->safe_links = true;
     } else if (strcmp(argv[i], "--copy-unsafe-links") == 0) {
       config->copy_unsafe_links = true;
-    } else if (strcmp(argv[i], "-H") == 0 || strcmp(argv[i], "--hard-links") == 0) {
-      config->preserve_hard_links = true;
-    } else if (strcmp(argv[i], "-A") == 0 || strcmp(argv[i], "--acls") == 0) {
-      config->preserve_acls = true;
-    } else if (strcmp(argv[i], "-X") == 0 || strcmp(argv[i], "--xattrs") == 0) {
-      config->preserve_xattrs = true;
-    } else if (strcmp(argv[i], "-D") == 0 || strcmp(argv[i], "--devices") == 0) {
-      config->preserve_devices = true;
     } else if (strcmp(argv[i], "-S") == 0 || strcmp(argv[i], "--sparse") == 0) {
       config->preserve_sparse = true;
-    } else if (strcmp(argv[i], "-i") == 0 || strcmp(argv[i], "--itemize-changes") == 0) {
-      config->itemize_changes = true;
-    } else if (strcmp(argv[i], "--out-format") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->out_format, argv[++i], "--out-format") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--info") == 0 && i + 1 < argc) {
-      if (set_nonneg_int_option(&config->info_level, argv[++i], "--info") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--debug") == 0 && i + 1 < argc) {
-      if (set_nonneg_int_option(&config->debug_level, argv[++i], "--debug") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--list-only") == 0) {
-      config->list_only = true;
-    } else if (strcmp(argv[i], "-h") == 0 || strcmp(argv[i], "--human-readable") == 0) {
-      config->human_readable = true;
-    } else if (strcmp(argv[i], "-u") == 0 || strcmp(argv[i], "--update") == 0) {
-      config->update = true;
     } else if (strcmp(argv[i], "--inplace") == 0) {
       config->inplace = true;
-    } else if (strcmp(argv[i], "--append") == 0) {
-      config->append = true;
-    } else if (strcmp(argv[i], "--append-verify") == 0) {
-      config->append_verify = true;
-    } else if (strcmp(argv[i], "--delete-excluded") == 0) {
-      config->delete_excluded = true;
-    } else if (strcmp(argv[i], "--delete-after") == 0) {
-      config->delete_after = true;
-    } else if (strcmp(argv[i], "--max-delete") == 0 && i + 1 < argc) {
-      if (set_nonneg_int_option(&config->max_delete, argv[++i], "--max-delete") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--filter") == 0 && i + 1 < argc) {
-      if (!config->filters)
-        config->filters = array_list_create(free);
-      char* dup = str_dup(argv[++i]);
-      if (!dup)
-        return -1;
-      array_list_add(config->filters, dup);
-    } else if (strcmp(argv[i], "--files-from") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->files_from, argv[++i], "--files-from") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--cvs-exclude") == 0) {
-      config->cvs_exclude = true;
-    } else if (strcmp(argv[i], "--prune-empty-dirs") == 0) {
-      config->prune_empty_dirs = true;
-    } else if (strcmp(argv[i], "-R") == 0 || strcmp(argv[i], "--relative") == 0) {
-      config->relative = true;
-    } else if (strcmp(argv[i], "-e") == 0 || strcmp(argv[i], "--rsh") == 0) {
-      if (i + 1 < argc) {
-        if (set_string_option(&config->rsh_command, argv[++i], "-e/--rsh") != 0)
-          return -1;
-      } else {
-        fprintf(stderr, "Error: -e/--rsh requires a command argument\n");
-        return -1;
-      }
-    } else if (strcmp(argv[i], "--rsync-path") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->rsync_path, argv[++i], "--rsync-path") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--temp-dir") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->temp_dir, argv[++i], "--temp-dir") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--compare-dest") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->compare_dest, argv[++i], "--compare-dest") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--copy-dest") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->copy_dest, argv[++i], "--copy-dest") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--link-dest") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->link_dest, argv[++i], "--link-dest") != 0)
-        return -1;
     } else if (strcmp(argv[i], "--partial-dir") == 0 && i + 1 < argc) {
       if (set_string_option(&config->partial_dir, argv[++i], "--partial-dir") != 0)
         return -1;
     } else if (strcmp(argv[i], "--suffix") == 0 && i + 1 < argc) {
       if (set_string_option(&config->suffix, argv[++i], "--suffix") != 0)
         return -1;
-    } else if (strcmp(argv[i], "--delete-before") == 0) {
-      config->delete_before = true;
     } else if (strcmp(argv[i], "-T") == 0 && i + 1 < argc) {
       if (set_positive_int_option(&config->timeout, argv[++i], "-T") != 0)
         return -1;
-    } else if (strcmp(argv[i], "--address") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->address, argv[++i], "--address") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--bind-address") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->bind_address, argv[++i], "--bind-address") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--ipv6") == 0) {
-      config->ipv6 = true;
-    } else if (strcmp(argv[i], "--ipv4") == 0) {
-      config->ipv4 = true;
-    } else if (strcmp(argv[i], "--daemon") == 0) {
-      config->daemon = true;
-    } else if (strcmp(argv[i], "--config") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->daemon_config, argv[++i], "--config") != 0)
-        return -1;
-    } else if (strcmp(argv[i], "--server") == 0) {
-      config->server_mode = true;
     } else if (strcmp(argv[i], "--checksum") == 0) {
       config->checksum = true;
-    } else if (strcmp(argv[i], "--compress-choice") == 0 && i + 1 < argc) {
-      if (set_string_option(&config->compress_choice, argv[++i], "--compress-choice") != 0)
-        return -1;
-      if (strcmp(config->compress_choice, "zstd") == 0)
-        config->use_compression = true;
-      else if (strcmp(config->compress_choice, "none") == 0)
-        config->use_compression = false;
-      else {
-        fprintf(stderr, "Error: --compress-choice must be 'zstd' or 'none'\n");
-        return -1;
-      }
     } else if (strcmp(argv[i], "--compress-level") == 0 && i + 1 < argc) {
       if (set_positive_int_option(&config->compression_level, argv[++i], "--compress-level") != 0)
         return -1;
@@ -512,8 +400,8 @@ static bool validate_config(const Config* config) {
     return false;
   }
   if (config->use_tls) {
-    if (!config->tls_cert || !config->tls_key) {
+    if (!config->tls_cert || !config->tls_key || !config->tls_ca) {
-      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      fprintf(stderr, "Error: --tls requires --cert, --key, and --ca\n");
       return false;
     }
   }
@@ -521,116 +409,6 @@ static bool validate_config(const Config* config) {
 }
 #endif /* FASTSYNC_TEST_BUILD */
 
-static void print_usage(void) {
-  printf("Usage:\n");
-  printf("  fastsync [options] <source> <destination>\n");
-  printf("  fastsync [options] --source-dir <src> --dest-dir <dst>\n");
-  printf("\n");
-  printf("Destination formats:\n");
-  printf("  user@host:/path     SSH transport (rsync-style)\n");
-  printf("  host:/path          SSH transport (current user)\n");
-  printf("  /local/path         TCP transport (requires server on localhost:8080)\n");
-  printf("\n");
-  printf("Options:\n");
-  printf("  -c [level]          Enable compression (level 1-22, default 5)\n");
-  printf("  -z [level]          Alias for -c\n");
-  printf("  -a, --archive       Archive mode (-c -m -M)\n");
-  printf("  -n, --dry-run       Show what would be transferred\n");
-  printf("  -p <port>           SSH port (default: 22)\n");
-  printf("  --progress          Show transfer progress\n");
-  printf("  --delete            Delete files on receiver not in source\n");
-  printf("  --exclude <pattern> Exclude files matching pattern\n");
-  printf("  --include <pattern> Only include files matching pattern\n");
-  printf("  --exclude-from <file> Read exclude patterns from file\n");
-  printf("  --include-from <file> Read include patterns from file\n");
-  printf("  --max-size <n>      Skip files larger than n bytes\n");
-  printf("  --min-size <n>      Skip files smaller than n bytes\n");
-  printf("  --incremental       Skip files unchanged since last transfer\n");
-  printf("  --delta             Delta transfer for changed files (requires --incremental)\n");
-  printf("  --delta-block <n>   Delta block size in bytes (default: %d)\n",
-         DELTA_BLOCK_SIZE_DEFAULT);
-  printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
-         DELTA_MAX_FILE_SIZE);
-  printf("  -m                  Enable multithreading\n");
-  printf("  -s                  Enable chunk serialization\n");
-  printf("  -f                  Enable sendfile (TCP only, not with -c or -s)\n");
-  printf("  -v, --verbose       Enable debug logging\n");
-  printf("  -M, --preserve      Preserve file metadata\n");
-  printf("  --chunk-size <n>    Chunk size in bytes (default: %d)\n", DEFAULT_CHUNK_SIZE);
-  printf("  --source-dir <path> Source directory\n");
-  printf("  --dest-dir <path>   Destination directory\n");
-  printf("  --save-to-disk      Write received files to disk\n");
-  printf("  --server-host <ip>  Server IP address (default: 127.0.0.1)\n");
-  printf("  --server-port <n>   Server port (default: 8080)\n");
-  printf("  --bwlimit <KB/s>    Bandwidth limit in kilobytes per second\n");
-  printf("  --tls               Enable TLS encryption\n");
-  printf("  --cert <path>       TLS certificate file (PEM)\n");
-  printf("  --key <path>        TLS private key file (PEM)\n");
-  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
-  printf("  --timeout <sec>     I/O timeout in seconds (default: 30)\n");
-  printf("  -T <sec>            Alias for --timeout\n");
-  printf("  --contimeout <sec>  Connection timeout in seconds (default: 10)\n");
-  printf("  --address <host>    Server hostname/IP to connect to\n");
-  printf("  --bind-address <ip> Bind to specific local address\n");
-  printf("  --ipv6              Prefer IPv6 connections\n");
-  printf("  --ipv4              Prefer IPv4 connections\n");
-  printf("  -q, --quiet         Suppress non-error output\n");
-  printf("  --silent            Alias for --quiet\n");
-  printf("  --backup            Backup existing files before overwriting\n");
-  printf("  --backup-dir <dir>  Directory for backups (requires --backup)\n");
-  printf("  --suffix <str>      Backup suffix (default: ~)\n");
-  printf("  --stats             Print transfer statistics at end\n");
-  printf("  --max-depth <n>     Maximum directory depth (0=unlimited)\n");
-  printf("  --log-file <path>   Write log messages to file\n");
-  printf("  --queue-size <n>    Queue capacity for multithreaded mode (default: 100)\n");
-  printf("  --partial           Keep partial files on interrupted transfer\n");
-  printf("  --partial-dir <dir> Directory for partial files\n");
-  printf("  --fastsync-server-path <path>\n");
-  printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
-  printf("  -l, --links         Copy symlinks as symlinks\n");
-  printf("  --copy-links        Transform symlinks into referent files\n");
-  printf("  --safe-links        Skip symlinks that point outside transfer tree\n");
-  printf("  --copy-unsafe-links  Only transform unsafe symlinks into referent files\n");
-  printf("  -H, --hard-links    Preserve hard links\n");
-  printf("  -A, --acls          Preserve ACLs\n");
-  printf("  -X, --xattrs        Preserve extended attributes\n");
-  printf("  -D, --devices       Preserve device files\n");
-  printf("  -S, --sparse        Handle sparse files efficiently\n");
-  printf("  -i, --itemize-changes  Show per-file change summary\n");
-  printf("  --out-format <fmt>  Custom output format string\n");
-  printf("  --info <flags>      Info verbosity level\n");
-  printf("  --debug <flags>     Debug verbosity level\n");
-  printf("  --list-only         List files without transferring\n");
-  printf("  -h, --human-readable  Human-readable numbers\n");
-  printf("  -u, --update        Skip files newer on destination\n");
-  printf("  --inplace           Update files in-place (no temp+rename)\n");
-  printf("  --append            Append data to shorter files\n");
-  printf("  --append-verify     Append with verify\n");
-  printf("  --delete-before     Delete before transfer\n");
-  printf("  --delete-excluded   Also delete excluded files\n");
-  printf("  --delete-after      Delete after transfer, not before\n");
-  printf("  --max-delete <n>    Maximum number of files to delete\n");
-  printf("  --filter <rule>     Add file filtering rule\n");
-  printf("  --files-from <file> Read file list from file\n");
-  printf("  --cvs-exclude       Auto-ignore CVS files\n");
-  printf("  --prune-empty-dirs  Omit empty directories from transfer\n");
-  printf("  -R, --relative      Use relative paths\n");
-  printf("  -e, --rsh <cmd>     Specify remote shell\n");
-  printf("  --rsync-path <path> Path to remote binary\n");
-  printf("  --daemon            Run in daemon mode\n");
-  printf("  --config <path>     Path to configuration file\n");
-  printf("  --server            Run in server mode\n");
-  printf("  --checksum          Skip files based on checksum, not mod-time/size\n");
-  printf("  --compress-choice <alg>  Compression algorithm (default: zstd)\n");
-  printf("  --compress-level <n>    Compression level (default: 5)\n");
-  printf("  --temp-dir <dir>    Temporary directory for files\n");
-  printf("  --compare-dest <dir>  Compare destination\n");
-  printf("  --copy-dest <dir>   Copy destination\n");
-  printf("  --link-dest <dir>   Link destination\n");
-  printf("  --help              Show this help\n");
-  printf("  -V, --version       Show version\n");
-}
-
 static int read_patterns_from_file(const char* filepath, char*** patterns, int* count) {
   FILE* fp = fopen(filepath, "r");
   if (!fp) {

src/client/usage.c

@@ -0,0 +1,73 @@
+#include "stdio.h"
+#include <delta.h>
+#include <chunk.h>
+
+static __attribute__((unused)) void print_usage() {
+  printf("Usage:\n");
+  printf("  fastsync [options] <source> <destination>\n");
+  printf("  fastsync [options] --source-dir <src> --dest-dir <dst>\n");
+  printf("\n");
+  printf("Destination formats:\n");
+  printf("  user@host:/path     SSH transport (rsync-style)\n");
+  printf("  host:/path          SSH transport (current user)\n");
+  printf("  /local/path         TCP transport (requires server on localhost:8080)\n");
+  printf("\n");
+  printf("Options:\n");
+  printf("  -c [level]          Enable compression (level 1-22, default 5)\n");
+  printf("  -z [level]          Alias for -c\n");
+  printf("  -a, --archive       Archive mode (-c -m -M)\n");
+  printf("  -n, --dry-run       Show what would be transferred\n");
+  printf("  -p <port>           SSH port (default: 22)\n");
+  printf("  --progress          Show transfer progress\n");
+  printf("  --delete            Delete files on receiver not in source\n");
+  printf("  --exclude <pattern> Exclude files matching pattern\n");
+  printf("  --include <pattern> Only include files matching pattern\n");
+  printf("  --exclude-from <file> Read exclude patterns from file\n");
+  printf("  --include-from <file> Read include patterns from file\n");
+  printf("  --max-size <n>      Skip files larger than n bytes\n");
+  printf("  --min-size <n>      Skip files smaller than n bytes\n");
+  printf("  --incremental       Skip files unchanged since last transfer\n");
+  printf("  --delta             Delta transfer for changed files (requires --incremental)\n");
+  printf("  --delta-block <n>   Delta block size in bytes (default: %d)\n",
+         DELTA_BLOCK_SIZE_DEFAULT);
+  printf("  --delta-max <n>     Max file size for delta transfer (default: %llu)\n",
+         DELTA_MAX_FILE_SIZE);
+  printf("  -m                  Enable multithreading\n");
+  printf("  -s                  Enable chunk serialization\n");
+  printf("  -f                  Enable sendfile (TCP only, not with -c or -s)\n");
+  printf("  -v, --verbose       Enable debug logging\n");
+  printf("  -M, --preserve      Preserve file metadata\n");
+  printf("  --chunk-size <n>    Chunk size in bytes (default: %d)\n", DEFAULT_CHUNK_SIZE);
+  printf("  --source-dir <path> Source directory\n");
+  printf("  --dest-dir <path>   Destination directory\n");
+  printf("  --save-to-disk      Write received files to disk\n");
+  printf("  --server-host <ip>  Server IP address (default: 127.0.0.1)\n");
+  printf("  --server-port <n>   Server port (default: 8080)\n");
+  printf("  --bwlimit <KB/s>    Bandwidth limit in kilobytes per second\n");
+  printf("  --tls               Enable TLS encryption\n");
+  printf("  --cert <path>       TLS certificate file (PEM)\n");
+  printf("  --key <path>        TLS private key file (PEM)\n");
+  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
+  printf("  --timeout <sec>     I/O timeout in seconds (default: 30)\n");
+  printf("  -T <sec>            Alias for --timeout\n");
+  printf("  --contimeout <sec>  Connection timeout in seconds (default: 10)\n");
+  printf("  --backup            Backup existing files before overwriting\n");
+  printf("  --backup-dir <dir>  Directory for backups (requires --backup)\n");
+  printf("  --suffix <str>      Backup suffix (default: ~)\n");
+  printf("  --stats             Print transfer statistics at end\n");
+  printf("  --max-depth <n>     Maximum directory depth (0=unlimited)\n");
+  printf("  --log-file <path>   Write log messages to file\n");
+  printf("  --partial           Keep partial files on interrupted transfer\n");
+  printf("  --partial-dir <dir> Directory for partial files\n");
+  printf("  --fastsync-server-path <path>\n");
+  printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
+  printf("  -l, --links         Copy symlinks as symlinks\n");
+  printf("  --copy-links        Transform symlinks into referent files\n");
+  printf("  --safe-links        Skip symlinks that point outside transfer tree\n");
+  printf("  --copy-unsafe-links  Only transform unsafe symlinks into referent files\n");
+  printf("  -S, --sparse        Handle sparse files efficiently\n");
+  printf("  --inplace           Update files in-place (no temp+rename)\n");
+  printf("  --compress-level <n>    Compression level (default: 5)\n");
+  printf("  --help              Show this help\n");
+  printf("  -V, --version       Show version\n");
+}

src/server/server.c

@@ -19,10 +19,28 @@
 #include <fcntl.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#include <openssl/x509.h>
 
 static char* authorized_root;
 static int authorized_root_fd = -1;
 static bool allow_delete;
+static bool allow_unauthenticated;
+static const char* required_client_cn;
+
+static bool tls_client_identity_allowed(SSL* ssl) {
+  if (!ssl || !required_client_cn)
+    return false;
+  X509* certificate = SSL_get1_peer_certificate(ssl);
+  if (!certificate)
+    return false;
+  char common_name[256];
+  int length = X509_NAME_get_text_by_NID(X509_get_subject_name(certificate), NID_commonName,
+                                         common_name, sizeof(common_name));
+  bool allowed = length >= 0 && (size_t)length < sizeof(common_name) &&
+                 strcmp(common_name, required_client_cn) == 0;
+  X509_free(certificate);
+  return allowed;
+}
 
 static bool path_is_within(const char* root, const char* path) {
   size_t n = strlen(root);
@@ -48,7 +66,7 @@ static bool __attribute__((unused)) configure_authorization(const char* root) {
     return false;
   }
   file_set_authorized_root(authorized_root_fd, authorized_root);
-  utils_set_authorized_root_fd(authorized_root_fd);
+  utils_set_authorized_root(authorized_root_fd, authorized_root);
   return true;
 }
 
@@ -118,9 +136,9 @@ int receive_files(Config* config, int fd) {
           send_status(fd, STATUS_ERROR);
           return -1;
         }
-        char* full_path = path_cat(config->receive_root_directory, check_path);
         struct stat st;
-        bool has_old = full_path && lstat(full_path, &st) == 0;
+        char* full_path = path_cat(config->receive_root_directory, check_path);
+        bool has_old = full_path && file_stat_secure(full_path, &st);
         bool match = has_old && (unsigned long long)st.st_size == check_size &&
                      (long long)st.st_mtime == check_mtime;
         bool sent = send_status(fd, match ? STATUS_OK : STATUS_NEXT);
@@ -179,6 +197,18 @@ void handler(int file_descriptor) {
     close(file_descriptor);
     return;
   }
+  if (!allow_unauthenticated && ssl == NULL) {
+    log_message(LOG_LEVEL_ERROR, "Rejected unauthenticated plaintext connection");
+    config_delete(config);
+    close(file_descriptor);
+    return;
+  }
+  if (ssl && required_client_cn && !tls_client_identity_allowed(ssl)) {
+    log_message(LOG_LEVEL_ERROR, "Rejected TLS client with unauthorized identity");
+    config_delete(config);
+    close(file_descriptor);
+    return;
+  }
   char resolved_destination[PATH_MAX];
   char* canonical_destination = realpath(config->receive_root_directory, NULL);
   const char* destination =
@@ -281,8 +311,10 @@ static void print_server_usage(void) {
   printf("  --cert <path>       TLS certificate file (PEM)\n");
   printf("  --key <path>        TLS private key file (PEM)\n");
   printf("  --ca <path>         TLS CA certificate file (PEM)\n");
+  printf("  --client-cn <name>  Required TLS client certificate CN\n");
   printf("  --destination-root <path>  Authorized destination root (default: .)\n");
   printf("  --allow-delete      Permit manifest deletion\n");
+  printf("  --allow-unauthenticated  Allow plaintext/anonymous network clients\n");
   printf("  -v, --verbose       Enable debug logging\n");
   printf("  --help              Show this help\n");
 }
@@ -313,10 +345,14 @@ int main(int argc, char* argv[]) {
       tls_key = argv[++i];
     } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
       tls_ca = argv[++i];
+    } else if (strcmp(argv[i], "--client-cn") == 0 && i + 1 < argc) {
+      required_client_cn = argv[++i];
     } else if (strcmp(argv[i], "--destination-root") == 0 && i + 1 < argc) {
       destination_root = argv[++i];
     } else if (strcmp(argv[i], "--allow-delete") == 0) {
       allow_delete = true;
+    } else if (strcmp(argv[i], "--allow-unauthenticated") == 0) {
+      allow_unauthenticated = true;
     } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
       char* end;
       long p = strtol(argv[++i], &end, 10);
@@ -343,10 +379,12 @@ int main(int argc, char* argv[]) {
     return 1;
   }
   if (stdio_mode) {
+    /* SSH authenticates the stdio transport outside of FastSync. */
+    allow_unauthenticated = true;
     io_set_fds(STDIN_FILENO, STDOUT_FILENO);
     handler(STDIN_FILENO);
     file_set_authorized_root(-1, NULL);
-    utils_set_authorized_root_fd(-1);
+    utils_set_authorized_root(-1, NULL);
     close(authorized_root_fd);
     free(authorized_root);
     return 0;
@@ -357,8 +395,8 @@ int main(int argc, char* argv[]) {
     return 1;
   }
   if (use_tls) {
-    if (!tls_cert || !tls_key) {
+    if (!tls_cert || !tls_key || !tls_ca || !required_client_cn) {
-      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      fprintf(stderr, "Error: --tls requires --cert, --key, --ca, and --client-cn\n");
       server_delete(&g_server);
       return 1;
     }

src/shared/chunk.c

@@ -1,4 +1,6 @@
 #include <stddef.h>
+#include <stdint.h>
+#include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -14,19 +16,30 @@
 
 /* Maximum individual file data size within a chunk (64 MB) */
 #define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
+#define MAX_FILES_PER_CHUNK 65536U
 
 Chunk* chunk_create(File** items, int element_count) {
+  if (element_count < 0 || (element_count > 0 && items == NULL))
+    return NULL;
   Chunk* chunk = (Chunk*)malloc(sizeof(Chunk));
   if (chunk == NULL) {
     perror("ERROR: Could not allocate memory for chunk structure");
     return NULL;
   }
 
-  chunk->items = (File**)malloc(element_count * sizeof(File*));
+  if (element_count == 0) {
+    chunk->items = NULL;
+  } else {
+    if ((size_t)element_count > SIZE_MAX / sizeof(File*)) {
+      free(chunk);
+      return NULL;
+    }
+    chunk->items = (File**)malloc((size_t)element_count * sizeof(File*));
     if (chunk->items == NULL) {
       free(chunk);
       return NULL;
     }
+  }
 
   for (int i = 0; i < element_count; i++) {
     chunk->items[i] = items[i];
@@ -50,15 +63,31 @@ void chunk_destroy(void* item) {
 }
 
 static unsigned long long per_file_serialize_size(File* file, bool use_metadata) {
-  return sizeof(size_t) + strlen(file->path) +
+  unsigned long long size = sizeof(size_t);
-         (use_metadata ? sizeof(int) + (file->metadata ? FILE_METADATA_WIRE_SIZE : 0) : 0) +
+  size_t path_len = strlen(file->path);
-         sizeof(size_t) + file->data->size;
+  unsigned long long metadata_size =
+      use_metadata ? sizeof(int) + (file->metadata ? FILE_METADATA_WIRE_SIZE : 0) : 0;
+  if ((unsigned long long)path_len > ULLONG_MAX - size)
+    return 0;
+  size += path_len;
+  if (metadata_size > ULLONG_MAX - size)
+    return 0;
+  size += metadata_size;
+  if (sizeof(size_t) > ULLONG_MAX - size)
+    return 0;
+  size += sizeof(size_t);
+  if ((unsigned long long)file->data->size > ULLONG_MAX - size)
+    return 0;
+  return size + file->data->size;
 }
 
 Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
   unsigned long long data_size = 0;
   for (int i = 0; i < chunk->element_count; i++) {
-    data_size += per_file_serialize_size(chunk->items[i], use_metadata);
+    unsigned long long file_size = per_file_serialize_size(chunk->items[i], use_metadata);
+    if (file_size == 0 || file_size > ULLONG_MAX - data_size || data_size + file_size > SIZE_MAX)
+      return NULL;
+    data_size += file_size;
   }
   Data* data = data_create_empty(data_size);
   if (data == NULL) {
@@ -88,10 +117,17 @@ Data* chunk_serialize(Chunk* chunk, bool use_metadata) {
 
 Chunk* chunk_deserialize(Data* data, bool use_metadata) {
   ArrayList* files = array_list_create(file_destroy);
+  if (files == NULL)
+    return NULL;
   char* data_pointer = data->data;
   size_t remaining_size = data->size;
 
   while (remaining_size > 0) {
+    if ((unsigned int)files->size >= MAX_FILES_PER_CHUNK) {
+      log_message(LOG_LEVEL_ERROR, "Chunk contains too many files");
+      array_list_delete(files);
+      return NULL;
+    }
     if (remaining_size < sizeof(size_t)) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for path length");
       array_list_delete(files);
@@ -109,6 +145,10 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
       return NULL;
     }
 
+    if (path_len == SIZE_MAX) {
+      array_list_delete(files);
+      return NULL;
+    }
     char* path = malloc(path_len + 1);
     if (path == NULL) {
       perror("Could not allocate memory for file path");
@@ -117,34 +157,53 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     }
     memcpy(path, data_pointer, path_len);
     path[path_len] = '\0';
+    if (memchr(path, '\0', path_len) != NULL) {
+      free(path);
+      array_list_delete(files);
+      return NULL;
+    }
     data_pointer += path_len;
     remaining_size -= path_len;
 
     File* file = file_create(path);
     free(path);
+    if (file == NULL) {
+      array_list_delete(files);
+      return NULL;
+    }
 
     if (use_metadata) {
       if (remaining_size < sizeof(int)) {
         log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata");
+        file_destroy(file);
         array_list_delete(files);
         return NULL;
       }
       // Peek at present flag to determine total size needed before reading
       int present_flag;
       memcpy(&present_flag, data_pointer, sizeof(int));
-      if (present_flag && remaining_size < sizeof(int) + FILE_METADATA_WIRE_SIZE) {
+      if ((present_flag != 0 && present_flag != 1) ||
+          (present_flag == 1 && remaining_size < sizeof(int) + FILE_METADATA_WIRE_SIZE)) {
         log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for metadata body");
+        file_destroy(file);
         array_list_delete(files);
         return NULL;
       }
       file->metadata = metadata_from_buf(&data_pointer);
       remaining_size -= sizeof(int);
-      if (file->metadata)
+      if (present_flag == 1) {
+        if (file->metadata == NULL) {
+          file_destroy(file);
+          array_list_delete(files);
+          return NULL;
+        }
         remaining_size -= FILE_METADATA_WIRE_SIZE;
       }
+    }
 
     if (remaining_size < sizeof(size_t)) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for data size");
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
@@ -156,6 +215,7 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
 
     if (remaining_size < file_data_size) {
       log_message(LOG_LEVEL_ERROR, "Invalid chunk format: not enough data for file content");
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
@@ -164,29 +224,47 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     if (file_data_size > MAX_FILE_DATA_SIZE) {
       log_message(LOG_LEVEL_ERROR, "File data size %zu exceeds maximum %llu", file_data_size,
                   (unsigned long long)MAX_FILE_DATA_SIZE);
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
 
-    void* file_data = malloc(file_data_size);
+    size_t allocation_size = file_data_size > 0 ? file_data_size : 1;
+    void* file_data = malloc(allocation_size);
     if (file_data == NULL) {
       perror("Could not allocate memory for file data");
+      file_destroy(file);
       array_list_delete(files);
       return NULL;
     }
     memcpy(file_data, data_pointer, file_data_size);
+    Data* replacement = data_create(file_data, file_data_size);
+    if (replacement == NULL) {
+      file_destroy(file);
+      array_list_delete(files);
+      return NULL;
+    }
     data_destroy(file->data);
-    file->data = data_create(file_data, file_data_size);
+    file->data = replacement;
     data_pointer += file_data_size;
     remaining_size -= file_data_size;
 
-    array_list_add(files, file);
+    if (!array_list_add(files, file)) {
+      file_destroy(file);
+      array_list_delete(files);
+      return NULL;
+    }
   }
 
   File** file_array = (File**)array_list_to_array(files);
+  if (files->size > 0 && file_array == NULL) {
+    array_list_delete(files);
+    return NULL;
+  }
   Chunk* chunk = chunk_create(file_array, files->size);
 
   free(file_array);
+  if (chunk != NULL)
     files->item_destroyer = NULL;
   array_list_delete(files);
 

src/shared/config.c

@@ -100,6 +100,35 @@ static void config_set_defaults(Config* config) {
   config->compress_choice = NULL;
 }
 
+static bool valid_wire_bool(int value) {
+  return value == 0 || value == 1;
+}
+
+static bool validate_received_config(const Config* config) {
+  return valid_wire_bool(config->save_to_disk) && valid_wire_bool(config->use_multithreading) &&
+         valid_wire_bool(config->use_chunk_serialization) &&
+         valid_wire_bool(config->use_compression) && valid_wire_bool(config->use_metadata) &&
+         valid_wire_bool(config->use_sendfile) && valid_wire_bool(config->use_delete) &&
+         valid_wire_bool(config->use_incremental) && valid_wire_bool(config->use_delta) &&
+         valid_wire_bool(config->backup) && valid_wire_bool(config->follow_symlinks) &&
+         valid_wire_bool(config->copy_links) && valid_wire_bool(config->safe_links) &&
+         valid_wire_bool(config->copy_unsafe_links) &&
+         valid_wire_bool(config->preserve_hard_links) && valid_wire_bool(config->preserve_acls) &&
+         valid_wire_bool(config->preserve_xattrs) && valid_wire_bool(config->preserve_devices) &&
+         valid_wire_bool(config->preserve_sparse) && valid_wire_bool(config->update) &&
+         valid_wire_bool(config->inplace) && valid_wire_bool(config->append) &&
+         valid_wire_bool(config->append_verify) && valid_wire_bool(config->delete_excluded) &&
+         valid_wire_bool(config->delete_after) && valid_wire_bool(config->relative) &&
+         valid_wire_bool(config->prune_empty_dirs) && valid_wire_bool(config->partial) &&
+         valid_wire_bool(config->delete_before) && valid_wire_bool(config->checksum) &&
+         (!config->use_compression ||
+          (config->compression_level >= 1 && config->compression_level <= 22)) &&
+         config->chunk_size > 0 && config->chunk_size <= MAX_CHUNK_SIZE &&
+         config->delta_block_size >= DELTA_BLOCK_SIZE_MIN &&
+         config->delta_block_size <= DELTA_BLOCK_SIZE_MAX &&
+         config->delta_max_file_size <= DELTA_MAX_FILE_SIZE && config->max_delete >= 0;
+}
+
 Config* config_create(void) {
   Config* config = malloc(sizeof(Config));
   if (!config)
@@ -320,18 +349,26 @@ Config* config_receive(int file_descriptor) {
   int tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->save_to_disk = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_multithreading = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
   config->use_chunk_serialization = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_compression = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_metadata = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
@@ -340,15 +377,23 @@ Config* config_receive(int file_descriptor) {
     goto error;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_sendfile = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_delete = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_incremental = tmp;
   if (!receive_int(file_descriptor, &tmp))
     goto error;
+  if (!valid_wire_bool(tmp))
+    goto error;
   config->use_delta = tmp;
   if (!receive_n_data(file_descriptor, &config->delta_block_size, sizeof(config->delta_block_size)))
     goto error;
@@ -440,6 +485,11 @@ Config* config_receive(int file_descriptor) {
     send_status(file_descriptor, STATUS_ERROR);
     goto error;
   }
+  if (!validate_received_config(config)) {
+    fprintf(stderr, "Invalid configuration received from client\n");
+    send_status(file_descriptor, STATUS_ERROR);
+    goto error;
+  }
   if (!send_status(file_descriptor, STATUS_OK))
     goto error;
   return config;

src/shared/delta.c

@@ -36,6 +36,9 @@ DeltaSignature* delta_signature_create(const void* old_file_data, uint64_t old_f
   if (old_file_data == NULL || old_file_size == 0 || block_size == 0)
     return NULL;
 
+  if (old_file_size > DELTA_MAX_FILE_SIZE || old_file_size > UINT32_MAX * (uint64_t)block_size)
+    return NULL;
+
   uint32_t block_count = (uint32_t)((old_file_size + block_size - 1) / block_size);
 
   DeltaSignature* sig = malloc(sizeof(DeltaSignature));
@@ -118,6 +121,13 @@ DeltaSignature* delta_signature_deserialize(const Data* data) {
     return NULL;
   }
 
+  if (sig->block_size == 0 || sig->block_size > DELTA_BLOCK_SIZE_MAX ||
+      sig->file_size > DELTA_MAX_FILE_SIZE || sig->file_size == 0 ||
+      (sig->file_size + sig->block_size - 1) / sig->block_size != sig->block_count) {
+    free(sig);
+    return NULL;
+  }
+
   uint64_t expected = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) +
                       (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
   if (data->size < expected) {
@@ -463,7 +473,8 @@ Delta* delta_deserialize(const Data* data) {
 void* delta_apply(const void* old_data, uint64_t old_size, const Delta* delta,
                   uint32_t block_size) {
   if (!old_data || !delta || (delta->new_file_size > 0 && delta->instructions == NULL) ||
-      (delta->instruction_count > 0 && block_size == 0))
+      (delta->instruction_count > 0 && block_size == 0) ||
+      delta->new_file_size > DELTA_MAX_FILE_SIZE || delta->new_file_size > SIZE_MAX)
     return NULL;
 
   void* output = malloc((size_t)delta->new_file_size);

src/shared/file.c

@@ -23,6 +23,9 @@
 #include "protocol.h"
 #include "utils.h"
 
+#define MAX_SERVER_DELETE_COUNT 100000U
+#define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
+
 bool file_checksum(File* file, uint64_t* checksum) {
   if (!file || !checksum || !file->data)
     return false;
@@ -155,7 +158,28 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
 
 static bool to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                            bool inplace, bool sparse, const FileMetadata* metadata);
-static int open_secure_parent(const char* path, char** leaf_out);
+static int open_secure_parent(const char* path, char** leaf_out, bool create_dirs);
+
+bool file_path_exists_secure(const char* path) {
+  struct stat st;
+  return file_stat_secure(path, &st);
+}
+
+bool file_stat_secure(const char* path, struct stat* st) {
+  if (!path || !st)
+    return false;
+  char* leaf = NULL;
+  int parent_fd = open_secure_parent(path, &leaf, false);
+  if (parent_fd < 0)
+    return false;
+  int fd = openat(parent_fd, leaf, O_RDONLY | O_NONBLOCK | O_CLOEXEC | O_NOFOLLOW);
+  bool exists = fd >= 0 && fstat(fd, st) == 0 && S_ISREG(st->st_mode);
+  if (fd >= 0)
+    close(fd);
+  close(parent_fd);
+  free(leaf);
+  return exists;
+}
 static bool rename_secure(const char* old_path, const char* new_path);
 static int authorized_root_fd = -1;
 static char* authorized_root_path;
@@ -440,8 +464,16 @@ static File* receive_delta_file(int fd, const Config* config, const char* check_
       }
     }
 
+    Data* replacement = data_create(new_data, (size_t)new_size);
+    if (replacement == NULL) {
+      file_destroy(file);
+      free(old_data);
+      delta_signature_destroy(sig);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
     data_destroy(file->data);
-    file->data = data_create(new_data, (size_t)new_size);
+    file->data = replacement;
 
     free(old_data);
     delta_signature_destroy(sig);
@@ -483,6 +515,12 @@ static File* receive_delta_file(int fd, const Config* config, const char* check_
         send_status(fd, STATUS_ERROR);
         return NULL;
       }
+      if (uncompressed->size > MAX_FILE_DATA_SIZE) {
+        data_destroy(uncompressed);
+        file_destroy(file);
+        send_status(fd, STATUS_ERROR);
+        return NULL;
+      }
       file_data = uncompressed;
     }
 
@@ -493,6 +531,7 @@ static File* receive_delta_file(int fd, const Config* config, const char* check_
 
   delta_signature_destroy(sig);
   free(old_data);
+  send_status(fd, STATUS_ERROR);
   return NULL;
 }
 
@@ -532,7 +571,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
   int old_fd = -1;
   if (full_path) {
     char* leaf = NULL;
-    int parent_fd = open_secure_parent(full_path, &leaf);
+    int parent_fd = open_secure_parent(full_path, &leaf, false);
     if (parent_fd >= 0) {
       old_fd = openat(parent_fd, leaf, O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
       free(leaf);
@@ -542,7 +581,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
   }
   unsigned long long old_size = has_old_file ? (unsigned long long)st.st_size : 0;
   void* old_data = NULL;
-  if (has_old_file && old_size > 0) {
+  if (has_old_file && old_size > 0 && old_size <= DELTA_MAX_FILE_SIZE && old_size <= SIZE_MAX) {
     old_data = malloc((size_t)old_size);
     if (old_data) {
       size_t got = 0;
@@ -643,6 +682,12 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
       send_status(fd, STATUS_ERROR);
       return NULL;
     }
+    if (uncompressed->size > MAX_FILE_DATA_SIZE) {
+      data_destroy(uncompressed);
+      file_destroy(file);
+      send_status(fd, STATUS_ERROR);
+      return NULL;
+    }
     file_data = uncompressed;
   }
 
@@ -651,7 +696,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
   return file;
 }
 
-static int open_secure_parent(const char* path, char** leaf_out) {
+static int open_secure_parent(const char* path, char** leaf_out, bool create_dirs) {
   char* copy = str_dup(path);
   if (!copy)
     return -1;
@@ -691,7 +736,7 @@ static int open_secure_parent(const char* path, char** leaf_out) {
   while (component) {
     if (strcmp(component, ".") != 0 && strcmp(component, "..") != 0) {
       int next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
-      if (next < 0 && errno == ENOENT && mkdirat(fd, component, 0755) == 0)
+      if (create_dirs && next < 0 && errno == ENOENT && mkdirat(fd, component, 0755) == 0)
         next = openat(fd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       if (next < 0) {
         close(fd);
@@ -711,8 +756,8 @@ static int open_secure_parent(const char* path, char** leaf_out) {
 
 static bool rename_secure(const char* old_path, const char* new_path) {
   char *old_leaf = NULL, *new_leaf = NULL;
-  int old_parent = open_secure_parent(old_path, &old_leaf);
+  int old_parent = open_secure_parent(old_path, &old_leaf, true);
-  int new_parent = open_secure_parent(new_path, &new_leaf);
+  int new_parent = open_secure_parent(new_path, &new_leaf, true);
   bool ok = old_parent >= 0 && new_parent >= 0 &&
             renameat(old_parent, old_leaf, new_parent, new_leaf) == 0;
   if (old_parent >= 0)
@@ -741,7 +786,7 @@ static bool write_all(int fd, const void* data, unsigned long long size) {
 static bool to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                            bool inplace, bool sparse, const FileMetadata* metadata) {
   char* leaf = NULL;
-  int dirfd = open_secure_parent(path, &leaf);
+  int dirfd = open_secure_parent(path, &leaf, true);
   if (dirfd < 0)
     return false;
   int fd = -1;
@@ -1011,6 +1056,11 @@ File* file_receive(const Config* config, int file_descriptor) {
       file_destroy(file);
       return NULL;
     }
+    if (file_data_uncompressed->size > MAX_FILE_DATA_SIZE) {
+      data_destroy(file_data_uncompressed);
+      file_destroy(file);
+      return NULL;
+    }
     file_data = file_data_uncompressed;
   }
   data_destroy(file->data);
@@ -1068,7 +1118,8 @@ int receive_manifest(int fd, const Config* config, int* next_status) {
     return *status_out == STATUS_FINISHED ? 0 : -1;
   }
   fprintf(stderr, "Deleting files not in manifest...\n");
-  bool deletion_ok = delete_extras(config->receive_root_directory, manifest);
+  bool deletion_ok =
+      delete_extras_limited(config->receive_root_directory, manifest, MAX_SERVER_DELETE_COUNT);
   array_list_delete(manifest);
   return deletion_ok ? 0 : -1;
 }

src/shared/file.h

@@ -40,6 +40,8 @@ bool to_disk(const char* path, const void* data, unsigned long long data_size, b
 bool file_save_to_disk(const char* root_directory, const File* file, const Config* config);
 void file_set_authorized_root(int fd, const char* canonical_path);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
+bool file_path_exists_secure(const char* path);
+bool file_stat_secure(const char* path, struct stat* st);
 int receive_manifest(int fd, const Config* config, int* next_status);
 
 #endif

src/shared/log.c

@@ -15,6 +15,15 @@ void log_set_file(FILE* fp) {
   log_fp = fp;
 }
 
+static inline void write_message(FILE* dest_io, LogLevel log_level, struct tm t, const char* format,
+                                 va_list args) {
+  fprintf(dest_io, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t.tm_year + 1900, t.tm_mon + 1,
+          t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, log_level_strings[log_level]);
+
+  vfprintf(dest_io, format, args);
+  fprintf(dest_io, "\n");
+}
+
 void log_message(LogLevel log_level, const char* format, ...) {
   if (log_level < current_log_level)
     return;
@@ -25,22 +34,19 @@ void log_message(LogLevel log_level, const char* format, ...) {
   if (!localtime_r(&now, &t))
     return;
 
-  fprintf(stderr, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t.tm_year + 1900, t.tm_mon + 1, t.tm_mday,
+  FILE* dest_io = stdout;
-          t.tm_hour, t.tm_min, t.tm_sec, log_level_strings[log_level]);
+  if (log_level == LOG_LEVEL_ERROR) {
+    dest_io = stderr;
+  }
 
   va_list args;
   va_start(args, format);
-  vfprintf(stderr, format, args);
+  write_message(dest_io, log_level, t, format, args);
   va_end(args);
-  fprintf(stderr, "\n");
 
   if (log_fp) {
-    fprintf(log_fp, "%04d-%02d-%02d %02d:%02d:%02d [%s]: ", t.tm_year + 1900, t.tm_mon + 1,
-            t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec, log_level_strings[log_level]);
     va_start(args, format);
-    vfprintf(log_fp, format, args);
+    write_message(log_fp, log_level, t, format, args);
     va_end(args);
-    fprintf(log_fp, "\n");
-    fflush(log_fp);
   }
 }

src/shared/metadata.c

@@ -76,6 +76,11 @@ FileMetadata* metadata_from_buf(char** buf) {
   memcpy(&mtime_nsec, *buf, sizeof(mtime_nsec));
   *buf += sizeof(mtime_nsec);
   m->mtime_nsec = (long)mtime_nsec;
+  if (present != 1 || mtime_nsec < 0 || mtime_nsec >= 1000000000LL || mode < 0 || uid < 0 ||
+      gid < 0) {
+    free(m);
+    return NULL;
+  }
   return m;
 }
 
@@ -175,7 +180,8 @@ FileMetadata* metadata_receive(int file_descriptor, int* ok) {
 void file_restore_metadata(const char* path, const FileMetadata* metadata) {
   if (metadata == NULL)
     return;
-  if (chmod(path, metadata->mode & 07777 & ~(S_ISUID | S_ISGID)) != 0)
+  mode_t safe_mode = metadata->mode & 0777 & ~(S_IWGRP | S_IWOTH);
+  if (chmod(path, safe_mode) != 0)
     log_message(LOG_LEVEL_WARNING, "Failed to chmod %s: %s", path, strerror(errno));
   /* Never apply client-supplied ownership.  The descriptor API below is the
      receiver write path; retain this legacy API only for compatibility. */
@@ -192,7 +198,8 @@ bool file_restore_metadata_fd(int fd, const FileMetadata* metadata) {
   if (fd < 0 || metadata == NULL)
     return metadata == NULL;
   bool ok = true;
-  if (fchmod(fd, metadata->mode & 07777 & ~(S_ISUID | S_ISGID)) != 0)
+  mode_t safe_mode = metadata->mode & 0777 & ~(S_IWGRP | S_IWOTH);
+  if (fchmod(fd, safe_mode) != 0)
     ok = false;
   /* Client uid/gid values are deliberately not authoritative. */
   struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},

src/shared/multiprocessing.c

@@ -234,9 +234,9 @@ int receive_thread(void* pipeline_context) {
         }
         char* full_path = path_cat(config->receive_root_directory, check_path);
         struct stat st;
-        bool has_old = full_path && lstat(full_path, &st) == 0;
+        bool has_old = full_path && file_stat_secure(full_path, &st);
         bool match = has_old && (unsigned long long)st.st_size == check_size &&
-                     (long long)st.st_mtime == check_mtime;
+                     (long long)st.st_mtime == check_mtime && S_ISREG(st.st_mode);
         if (!send_status(file_descriptor, match ? STATUS_OK : STATUS_NEXT))
           RECEIVE_THREAD_FAIL();
         free(full_path);

src/shared/protocol.c

@@ -13,7 +13,7 @@
 
 #define RECEIVE_TIMEOUT_SEC 60 /* 60 second per-message timeout */
 #define SEND_TIMEOUT_SEC 60
-#define MAX_CONNECTION_MEMORY (1024ULL * 1024 * 1024) /* 1 GB total per connection */
+#define MAX_CONNECTION_MEMORY (256ULL * 1024 * 1024) /* bounded cumulative receive budget */
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
@@ -25,7 +25,7 @@ static struct timespec bw_last_refill = {0, 0};
 static mtx_t bw_mutex;
 static once_flag bw_mutex_once = ONCE_FLAG_INIT;
 
-static __thread unsigned long long total_allocated_bytes = 0;
+static __thread unsigned long long total_allocated_bytes;
 
 void io_set_fds(int read_fd, int write_fd) {
   io_read_fd = read_fd;
@@ -260,6 +260,11 @@ char* receive_str(int file_descriptor) {
     free(data);
     return NULL;
   }
+  if (memchr(data, '\0', size) != NULL) {
+    free(data);
+    log_message(LOG_LEVEL_ERROR, "Received string contains an embedded NUL");
+    return NULL;
+  }
   data[size] = '\0';
   total_allocated_bytes += size + 1;
   log_message(LOG_LEVEL_DEBUG, "Received String: %s", data);
@@ -287,9 +292,7 @@ Data* receive_data(int file_descriptor) {
   }
   size_t allocation_size = size == 0 ? 1 : (size_t)size;
   if (allocation_size > MAX_CONNECTION_MEMORY - total_allocated_bytes) {
-    log_message(LOG_LEVEL_ERROR, "Per-connection memory limit exceeded (%llu + %llu > %llu)",
+    log_message(LOG_LEVEL_ERROR, "Per-connection memory limit exceeded");
-                (unsigned long long)total_allocated_bytes, size,
-                (unsigned long long)MAX_CONNECTION_MEMORY);
     return NULL;
   }
   void* data = malloc(allocation_size);

src/shared/transport_tls.c

@@ -11,6 +11,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
@@ -34,6 +35,10 @@ static void log_ssl_errors(void) {
 
 static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key,
                                const char* ca_path) {
+  if (!is_server && !ca_path) {
+    log_message(LOG_LEVEL_ERROR, "TLS clients require a CA certificate path");
+    return NULL;
+  }
   const SSL_METHOD* method = is_server ? TLS_server_method() : TLS_client_method();
   SSL_CTX* ctx = SSL_CTX_new(method);
   if (!ctx) {
@@ -42,9 +47,23 @@ static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key
     return NULL;
   }
 
-  SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
+  if (SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION) != 1) {
+    SSL_CTX_free(ctx);
+    return NULL;
+  }
+  if (SSL_CTX_set_cipher_list(ctx, "HIGH:!aNULL:!eNULL:!MD5:!RC4:!3DES") != 1) {
+    SSL_CTX_free(ctx);
+    return NULL;
+  }
 
   if (cert && key) {
+    struct stat key_stat;
+    if (stat(key, &key_stat) != 0 || !S_ISREG(key_stat.st_mode) || key_stat.st_uid != geteuid() ||
+        (key_stat.st_mode & (S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH))) {
+      log_message(LOG_LEVEL_ERROR, "TLS private key must be owned by the current user and private");
+      SSL_CTX_free(ctx);
+      return NULL;
+    }
     if (SSL_CTX_use_certificate_file(ctx, cert, SSL_FILETYPE_PEM) <= 0) {
       log_message(LOG_LEVEL_ERROR, "Failed to load certificate: %s", cert);
       log_ssl_errors();
@@ -91,7 +110,10 @@ static SSL* wrap_fd_with_ssl(int fd, SSL_CTX* ctx, bool is_server, const char* h
   // Enable hostname verification for client connections when a hostname is provided.
   // Must be done before SSL_connect to take effect during the handshake.
   if (!is_server && hostname) {
-    SSL_set1_host(ssl, hostname);
+    if (SSL_set1_host(ssl, hostname) != 1) {
+      SSL_free(ssl);
+      return NULL;
+    }
   }
 
   // Retry SSL_accept/SSL_connect on WANT_READ/WANT_WRITE (non-blocking handshake)

src/shared/utils.c

@@ -7,13 +7,67 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <stdint.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 static int authorized_root_fd = -1;
+static char* authorized_root_path;
+
+void utils_set_authorized_root(int fd, const char* canonical_path) {
+  authorized_root_fd = fd;
+  free(authorized_root_path);
+  authorized_root_path = canonical_path ? str_dup(canonical_path) : NULL;
+}
 
 void utils_set_authorized_root_fd(int fd) {
-  authorized_root_fd = fd;
+  utils_set_authorized_root(fd, NULL);
+}
+
+static bool path_is_within_root(const char* root, const char* path) {
+  size_t root_len = strlen(root);
+  return strncmp(root, path, root_len) == 0 && (path[root_len] == '\0' || path[root_len] == '/');
+}
+
+static int open_authorized_destination(const char* dest_root) {
+  if (authorized_root_fd < 0 || !authorized_root_path || !dest_root ||
+      !path_is_within_root(authorized_root_path, dest_root))
+    return -1;
+
+  int dirfd = dup(authorized_root_fd);
+  if (dirfd < 0)
+    return -1;
+
+  const char* relative_path = dest_root + strlen(authorized_root_path);
+  while (*relative_path == '/')
+    relative_path++;
+  char* relative = str_dup(*relative_path ? relative_path : ".");
+  if (!relative) {
+    close(dirfd);
+    return -1;
+  }
+
+  char* saveptr = NULL;
+  char* component = strtok_r(relative, "/", &saveptr);
+  while (component) {
+    if (strcmp(component, ".") == 0 || strcmp(component, "..") == 0) {
+      free(relative);
+      close(dirfd);
+      return -1;
+    }
+    int next = openat(dirfd, component, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    if (next < 0) {
+      free(relative);
+      close(dirfd);
+      return -1;
+    }
+    close(dirfd);
+    dirfd = next;
+    component = strtok_r(NULL, "/", &saveptr);
+  }
+
+  free(relative);
+  return dirfd;
 }
 
 bool mkdir_r(const char* path) {
@@ -143,7 +197,8 @@ static bool is_dir_in_manifest(const char* rel_path, ArrayList* manifest) {
   return false;
 }
 
-static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifest) {
+static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifest,
+                             size_t max_delete, size_t* deleted_count) {
   int scanfd = dup(dirfd);
   if (scanfd < 0)
     return false;
@@ -173,12 +228,17 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
       int childfd = openat(dirfd, entry->d_name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
       bool child_removed = false;
       if (childfd >= 0) {
-        child_removed = delete_extras_fd(childfd, child_rel, manifest);
+        child_removed = delete_extras_fd(childfd, child_rel, manifest, max_delete, deleted_count);
         close(childfd);
       }
-      if (child_removed && !is_dir_in_manifest(child_rel, manifest) &&
+      if (child_removed && !is_dir_in_manifest(child_rel, manifest)) {
-          unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0 && errno != ENOENT) {
+        if (*deleted_count >= max_delete) {
           operation_ok = false;
+        } else if (unlinkat(dirfd, entry->d_name, AT_REMOVEDIR) != 0 && errno != ENOENT) {
+          operation_ok = false;
+        } else {
+          (*deleted_count)++;
+        }
       } else if (!child_removed) {
         all_removed = false;
       }
@@ -192,8 +252,15 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
         }
       }
       if (!found) {
+        if (*deleted_count >= max_delete) {
+          operation_ok = false;
+          free(child_rel);
+          continue;
+        }
         if (unlinkat(dirfd, entry->d_name, 0) != 0 && errno != ENOENT)
           operation_ok = false;
+        else
+          (*deleted_count)++;
         fprintf(stderr, "  Deleted: %s\n", child_rel);
       } else {
         all_removed = false;
@@ -206,18 +273,27 @@ static bool delete_extras_fd(int dirfd, const char* rel_path, ArrayList* manifes
   return operation_ok;
 }
 
-bool delete_extras(const char* dest_root, ArrayList* manifest) {
+bool delete_extras_limited(const char* dest_root, ArrayList* manifest, size_t max_delete) {
-  int rootfd = authorized_root_fd >= 0
+  int rootfd;
-                   ? dup(authorized_root_fd)
+  if (authorized_root_fd >= 0) {
-                   : open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+    rootfd =
+        authorized_root_path ? open_authorized_destination(dest_root) : dup(authorized_root_fd);
+  } else {
+    rootfd = open(dest_root, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+  }
   if (rootfd < 0)
     return false;
-  bool ok = delete_extras_fd(rootfd, "", manifest);
+  size_t deleted_count = 0;
+  bool ok = delete_extras_fd(rootfd, "", manifest, max_delete, &deleted_count);
   if (close(rootfd) != 0)
     ok = false;
   return ok;
 }
 
+bool delete_extras(const char* dest_root, ArrayList* manifest) {
+  return delete_extras_limited(dest_root, manifest, SIZE_MAX);
+}
+
 bool has_path_traversal(const char* path) {
   if (!path)
     return false;

src/shared/utils.h

@@ -2,6 +2,7 @@
 #define UTILS_H
 
 #include "array_list.h"
+#include <stddef.h>
 #include <stdbool.h>
 
 bool mkdir_r(const char* path);
@@ -9,6 +10,8 @@ char* str_dup(const char* string);
 char* path_cat(const char* path1, const char* path2);
 bool glob_match(const char* pattern, const char* str);
 bool delete_extras(const char* dest_root, ArrayList* manifest);
+bool delete_extras_limited(const char* dest_root, ArrayList* manifest, size_t max_delete);
+void utils_set_authorized_root(int fd, const char* canonical_path);
 void utils_set_authorized_root_fd(int fd);
 bool has_path_traversal(const char* path);
 

tests/integration/common.py

@@ -25,7 +25,9 @@ class ServerManager:
     def start(self, extra_args=None):
         self.stop()
         self._port = _find_free_port()
-        cmd = SERVER_CMD + ["-p", str(self._port)]
+        # Plain TCP is intentionally explicit in the server; integration tests
+        # exercise that opt-in mode rather than relying on the secure default.
+        cmd = SERVER_CMD + ["-p", str(self._port), "--allow-unauthenticated"]
         if extra_args:
             cmd += extra_args
         self._proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

tests/integration/test_tls.py

@@ -102,6 +102,7 @@ class TestTLSBasic:
         with ServerManager() as server:
             server.start(extra_args=[
                 "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,
@@ -125,6 +126,7 @@ class TestTLSBasic:
         with ServerManager() as server:
             server.start(extra_args=[
                 "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,
@@ -149,6 +151,7 @@ class TestTLSBasic:
         with ServerManager() as server:
             server.start(extra_args=[
                 "--tls", "--cert", certs["server_cert"], "--key", certs["server_key"],
+                "--ca", certs["ca"], "--client-cn", "fastsync-client",
             ])
             result, dur = run_client(
                 SOURCE_DIR, DEST_DIR,

tests/test_client_cli.c

@@ -207,6 +207,69 @@ static void test_parse_args_unknown_option() {
   config_delete(cfg);
 }
 
+/* Parsed-but-unimplemented options must fail instead of being silently accepted. */
+static void test_parse_args_rejects_unimplemented_options() {
+  static const char* const options[] = {"-q",
+                                        "--quiet",
+                                        "--silent",
+                                        "--queue-size",
+                                        "-H",
+                                        "--hard-links",
+                                        "-A",
+                                        "--acls",
+                                        "-X",
+                                        "--xattrs",
+                                        "-D",
+                                        "--devices",
+                                        "-i",
+                                        "--itemize-changes",
+                                        "--out-format",
+                                        "--info",
+                                        "--debug",
+                                        "--list-only",
+                                        "-h",
+                                        "--human-readable",
+                                        "-u",
+                                        "--update",
+                                        "--append",
+                                        "--append-verify",
+                                        "--delete-excluded",
+                                        "--delete-after",
+                                        "--max-delete",
+                                        "--filter",
+                                        "--files-from",
+                                        "--cvs-exclude",
+                                        "--prune-empty-dirs",
+                                        "-R",
+                                        "--relative",
+                                        "-e",
+                                        "--rsh",
+                                        "--rsync-path",
+                                        "--temp-dir",
+                                        "--compare-dest",
+                                        "--copy-dest",
+                                        "--link-dest",
+                                        "--delete-before",
+                                        "--address",
+                                        "--bind-address",
+                                        "--ipv6",
+                                        "--ipv4",
+                                        "--daemon",
+                                        "--config",
+                                        "--server",
+                                        "--compress-choice"};
+
+  for (size_t i = 0; i < sizeof(options) / sizeof(options[0]); i++) {
+    Config* cfg = config_create();
+    char* argv[] = {"fastsync", (char*)options[i], "dummy", "/src", "/dst"};
+    int positional_args[2];
+    int positional_count = 0;
+
+    EXPECT_EQ_INT(parse_args(cfg, 5, argv, positional_args, &positional_count), -1);
+    config_delete(cfg);
+  }
+}
+
 /* Test parse_args with --archive flag */
 static void test_parse_args_archive() {
   Config* cfg = config_create();
@@ -238,5 +301,6 @@ void test_client_cli() {
   test_parse_args_invalid_compression_level();
   test_parse_args_valid_compression_level();
   test_parse_args_unknown_option();
+  test_parse_args_rejects_unimplemented_options();
   test_parse_args_archive();
 }