fix: security issues #192 #191 #190 #189 #188 #187

2026-07-30 18:49:25 +02:00
26 changed files with 193 additions and 534 deletions
@@ -402,72 +402,6 @@ static int parse_args(Config* config, int argc, char* argv[], int* positional_ar
        return -1;
      free(config->link_dest);
      config->link_dest = dup;
-    } else if (strcmp(argv[i], "--partial-dir") == 0 && i + 1 < argc) {
-      char* dup = str_dup(argv[++i]);
-      if (!dup) {
-        fprintf(stderr, "Error: memory allocation failed for --partial-dir\n");
-        return -1;
-      }
-      free(config->partial_dir);
-      config->partial_dir = dup;
-    } else if (strcmp(argv[i], "--suffix") == 0 && i + 1 < argc) {
-      char* dup = str_dup(argv[++i]);
-      if (!dup) {
-        fprintf(stderr, "Error: memory allocation failed for --suffix\n");
-        return -1;
-      }
-      free(config->suffix);
-      config->suffix = dup;
-    } else if (strcmp(argv[i], "--delete-before") == 0) {
-      config->delete_before = true;
-    } else if (strcmp(argv[i], "-T") == 0 && i + 1 < argc) {
-      int val;
-      if (!parse_positive_int(argv[++i], &val)) {
-        fprintf(stderr, "Error: -T must be a positive integer\n");
-        return -1;
-      }
-      config->timeout = val;
-    } else if (strcmp(argv[i], "--address") == 0 && i + 1 < argc) {
-      char* dup = str_dup(argv[++i]);
-      if (!dup)
-        return -1;
-      free(config->address);
-      config->address = dup;
-    } else if (strcmp(argv[i], "--bind-address") == 0 && i + 1 < argc) {
-      char* dup = str_dup(argv[++i]);
-      if (!dup)
-        return -1;
-      free(config->bind_address);
-      config->bind_address = dup;
-    } else if (strcmp(argv[i], "--ipv6") == 0) {
-      config->ipv6 = true;
-    } else if (strcmp(argv[i], "--ipv4") == 0) {
-      config->ipv4 = true;
-    } else if (strcmp(argv[i], "--daemon") == 0) {
-      config->daemon = true;
-    } else if (strcmp(argv[i], "--config") == 0 && i + 1 < argc) {
-      char* dup = str_dup(argv[++i]);
-      if (!dup)
-        return -1;
-      free(config->daemon_config);
-      config->daemon_config = dup;
-    } else if (strcmp(argv[i], "--server") == 0) {
-      config->server_mode = true;
-    } else if (strcmp(argv[i], "--checksum") == 0) {
-      config->checksum = true;
-    } else if (strcmp(argv[i], "--compress-choice") == 0 && i + 1 < argc) {
-      char* dup = str_dup(argv[++i]);
-      if (!dup)
-        return -1;
-      free(config->compress_choice);
-      config->compress_choice = dup;
-    } else if (strcmp(argv[i], "--compress-level") == 0 && i + 1 < argc) {
-      int val;
-      if (!parse_positive_int(argv[++i], &val)) {
-        fprintf(stderr, "Error: --compress-level must be a positive integer\n");
-        return -1;
-      }
-      config->compression_level = val;
    } else if (argv[i][0] == '-') {
      fprintf(stderr, "Unknown option: %s\n", argv[i]);
      print_usage();
@@ -573,23 +507,16 @@ static void print_usage(void) {
  printf("  --key <path>        TLS private key file (PEM)\n");
  printf("  --ca <path>         TLS CA certificate file (PEM)\n");
  printf("  --timeout <sec>     I/O timeout in seconds (default: 30)\n");
-  printf("  -T <sec>            Alias for --timeout\n");
  printf("  --contimeout <sec>  Connection timeout in seconds (default: 10)\n");
-  printf("  --address <host>    Server hostname/IP to connect to\n");
-  printf("  --bind-address <ip> Bind to specific local address\n");
-  printf("  --ipv6              Prefer IPv6 connections\n");
-  printf("  --ipv4              Prefer IPv4 connections\n");
  printf("  -q, --quiet         Suppress non-error output\n");
  printf("  --silent            Alias for --quiet\n");
  printf("  --backup            Backup existing files before overwriting\n");
  printf("  --backup-dir <dir>  Directory for backups (requires --backup)\n");
-  printf("  --suffix <str>      Backup suffix (default: ~)\n");
  printf("  --stats             Print transfer statistics at end\n");
  printf("  --max-depth <n>     Maximum directory depth (0=unlimited)\n");
  printf("  --log-file <path>   Write log messages to file\n");
  printf("  --queue-size <n>    Queue capacity for multithreaded mode (default: 100)\n");
  printf("  --partial           Keep partial files on interrupted transfer\n");
-  printf("  --partial-dir <dir> Directory for partial files\n");
  printf("  --fastsync-server-path <path>\n");
  printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
  printf("  -l, --links         Copy symlinks as symlinks\n");
@@ -611,7 +538,6 @@ static void print_usage(void) {
  printf("  --inplace           Update files in-place (no temp+rename)\n");
  printf("  --append            Append data to shorter files\n");
  printf("  --append-verify     Append with verify\n");
-  printf("  --delete-before     Delete before transfer\n");
  printf("  --delete-excluded   Also delete excluded files\n");
  printf("  --delete-after      Delete after transfer, not before\n");
  printf("  --max-delete <n>    Maximum number of files to delete\n");
@@ -622,12 +548,6 @@ static void print_usage(void) {
  printf("  -R, --relative      Use relative paths\n");
  printf("  -e, --rsh <cmd>     Specify remote shell\n");
  printf("  --rsync-path <path> Path to remote binary\n");
-  printf("  --daemon            Run in daemon mode\n");
-  printf("  --config <path>     Path to configuration file\n");
-  printf("  --server            Run in server mode\n");
-  printf("  --checksum          Skip files based on checksum, not mod-time/size\n");
-  printf("  --compress-choice <alg>  Compression algorithm (default: zstd)\n");
-  printf("  --compress-level <n>    Compression level (default: 5)\n");
  printf("  --temp-dir <dir>    Temporary directory for files\n");
  printf("  --compare-dest <dir>  Compare destination\n");
  printf("  --copy-dest <dir>   Copy destination\n");
@@ -25,16 +25,13 @@

 #define STREAM_THRESHOLD (64ULL * 1024 * 1024)

-/* Forward declaration for progress-reporting thread used in multithreaded send. */
-static int progress_thread_fn(void* arg);
-
 /* Print dry-run manifest showing files that would be transferred. Returns 0 on success. */
 static int send_dry_run_manifest(Config* config) {
  DirectoryScanner* scanner = directory_scanner_create(
      config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
      config->exclude_count, config->include_patterns, config->include_count, config->max_size,
      config->min_size, config->max_depth, config->follow_symlinks, config->copy_links,
-      config->safe_links, config->copy_unsafe_links, config->checksum);
+      config->safe_links, config->copy_unsafe_links);
  if (!scanner)
    return -1;
  Chunk* chunk;
@@ -274,9 +271,6 @@ static int send_chunks_multithreaded(void* pipeline_context) {
  if (context->config->transport == TRANSPORT_SSH) {
    if (context->config->use_sendfile) {
      fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
      return 1;
    }
    client = client_connect_ssh(context->config->ssh_destination, context->config->ssh_port,
@@ -289,9 +283,6 @@ static int send_chunks_multithreaded(void* pipeline_context) {
      if (client)
        client_delete(client);
      fprintf(stderr, "Error: could not connect to server via TLS\n");
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
      return thrd_error;
    }
  } else {
@@ -301,18 +292,12 @@ static int send_chunks_multithreaded(void* pipeline_context) {
      if (client)
        client_delete(client);
      fprintf(stderr, "Error: could not connect to server\n");
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
      return thrd_error;
    }
  }
  if (!config_send(client->file_descriptor, context->config)) {
    client_disconnect(client);
    client_delete(client);
-    mtx_lock(&context->mutex_progress);
-    context->sender_done = true;
-    mtx_unlock(&context->mutex_progress);
    return thrd_error;
  }

@@ -331,38 +316,19 @@ static int send_chunks_multithreaded(void* pipeline_context) {
      int ok = receive_status(client->file_descriptor, &s) && s == STATUS_OK;
      client_disconnect(client);
      client_delete(client);
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
      return ok ? thrd_success : thrd_error;

    send_fail:
      client_disconnect(client);
      client_delete(client);
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
      return thrd_error;
    }
    if (send_chunk(client, current_chunk, context->config) != 0) {
      fprintf(stderr, "Error: unexpected error while sending chunk\n");
      client_disconnect(client);
      client_delete(client);
-      mtx_lock(&context->mutex_progress);
-      context->sender_done = true;
-      mtx_unlock(&context->mutex_progress);
      return thrd_error;
    }
-    if (context->config->show_progress) {
-      unsigned long long chunk_bytes = 0;
-      for (int i = 0; i < current_chunk->element_count; i++) {
-        if (current_chunk->items[i] && current_chunk->items[i]->data)
-          chunk_bytes += current_chunk->items[i]->data->size;
-      }
-      mtx_lock(&context->mutex_progress);
-      context->progress_bytes += chunk_bytes;
-      mtx_unlock(&context->mutex_progress);
-    }
    chunk_destroy(current_chunk);
  }
 }
@@ -374,7 +340,7 @@ static int scan_directory_multithreaded(void* pipeline_context) {
      context->config->exclude_patterns, context->config->exclude_count,
      context->config->include_patterns, context->config->include_count, context->config->max_size,
      context->config->min_size, context->config->max_depth, 4, context->config->follow_symlinks,
-      context->config->copy_links, context->config->safe_links, context->config->copy_unsafe_links, context->config->checksum);
+      context->config->copy_links, context->config->safe_links, context->config->copy_unsafe_links);

  Chunk* current_chunk;
  while ((current_chunk = parallel_scanner_next(scanner)) != NULL) {
@@ -432,42 +398,6 @@ static int load_files_multithreaded(void* pipeline_context) {
  }
 }

-/* Progress-reporting thread for multithreaded send. Runs in parallel with
-   the scanner/loader/sender threads and prints periodic progress to stderr. */
-static int progress_thread_fn(void* arg) {
-  PipelineContextSender* context = (PipelineContextSender*)arg;
-  time_t last_progress = 0;
-  time_t start = time(NULL);
-
-  while (true) {
-    mtx_lock(&context->mutex_progress);
-    bool done = context->sender_done;
-    unsigned long long total = context->progress_bytes;
-    mtx_unlock(&context->mutex_progress);
-
-    if (done) {
-      time_t now = time(NULL);
-      double elapsed = difftime(now, start);
-      double rate = elapsed > 0.0 ? total / (1048576.0 * elapsed) : 0.0;
-      fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  Done.\n", total / 1048576.0, rate);
-      break;
-    }
-
-    time_t now = time(NULL);
-    if (now - last_progress >= 1) {
-      last_progress = now;
-      double elapsed = difftime(now, start);
-      double rate = elapsed > 0.0 ? total / (1048576.0 * elapsed) : 0.0;
-      fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  ", total / 1048576.0, rate);
-      fflush(stderr);
-    }
-
-    struct timespec ts = {0, 100 * 1000000L}; /* 100 ms */
-    thrd_sleep(&ts, NULL);
-  }
-  return thrd_success;
-}
-
 int send_files(Config* config) {
  if (config->dry_run)
    return send_dry_run_manifest(config);
@@ -509,10 +439,9 @@ int send_files(Config* config) {
      config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
      config->exclude_count, config->include_patterns, config->include_count, config->max_size,
      config->min_size, config->max_depth, config->follow_symlinks, config->copy_links,
-      config->safe_links, config->copy_unsafe_links, config->checksum);
+      config->safe_links, config->copy_unsafe_links);
  Chunk* current_chunk;
  unsigned long long total_bytes = 0;
-  int total_files = 0;
  time_t last_progress = 0;
  time_t start = time(NULL);
  ArrayList* manifest = config->use_delete ? array_list_create(free) : NULL;
@@ -520,7 +449,6 @@ int send_files(Config* config) {
    unsigned long long chunk_bytes = 0;
    for (int i = 0; i < current_chunk->element_count; i++) {
      chunk_bytes += current_chunk->items[i]->data->size;
-      total_files++;
      if (manifest) {
        const char* p = current_chunk->items[i]->path;
        if (*p == '/')
@@ -568,16 +496,11 @@ int send_files(Config* config) {
    goto send_fail;
  Status s;
  int ok = receive_status(client->file_descriptor, &s) && s == STATUS_OK;
-  double elapsed_total = difftime(time(NULL), start);
  if (config->show_progress) {
-    double rate = elapsed_total > 0 ? total_bytes / (1048576.0 * elapsed_total) : 0;
+    double elapsed = difftime(time(NULL), start);
+    double rate = elapsed > 0 ? total_bytes / (1048576.0 * elapsed) : 0;
    fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  Done.\n", total_bytes / 1048576.0, rate);
  }
-  if (config->stats) {
-    double rate = elapsed_total > 0 ? total_bytes / (1048576.0 * elapsed_total) : 0;
-    fprintf(stderr, "Stats: %d files, %.1f MB, %.1f MB/s\n", total_files,
-            total_bytes / 1048576.0, rate);
-  }
  directory_scanner_destroy(scanner);
  client_disconnect(client);
  client_delete(client);
@@ -624,7 +547,7 @@ int send_files_multithreaded(Config* config) {
  if (config->use_delete)
    context->manifest = array_list_create(free);

-  thrd_t scanner, loader, sender, progress;
+  thrd_t scanner, loader, sender;
  if (thrd_create(&scanner, scan_directory_multithreaded, context) != thrd_success ||
      thrd_create(&loader, load_files_multithreaded, context) != thrd_success ||
      thrd_create(&sender, send_chunks_multithreaded, context) != thrd_success) {
@@ -633,26 +556,11 @@ int send_files_multithreaded(Config* config) {
    return 1;
  }

-  if (config->show_progress) {
-    if (thrd_create(&progress, progress_thread_fn, context) != thrd_success) {
-      perror("Error creating progress thread.\n");
-      /* Non-fatal; continue without progress reporting */
-    }
-  }
-
  int sender_result;
  thrd_join(scanner, NULL);
  thrd_join(loader, NULL);
  thrd_join(sender, &sender_result);

-  if (config->show_progress) {
-    /* Signal progress thread to exit if it hasn't already */
-    mtx_lock(&context->mutex_progress);
-    context->sender_done = true;
-    mtx_unlock(&context->mutex_progress);
-    thrd_join(progress, NULL);
-  }
-
  pipeline_context_sender_destroy(context);
  return sender_result == thrd_success ? 0 : 1;
 }
@@ -40,7 +40,7 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
                                           int include_count, unsigned long long max_size,
                                           unsigned long long min_size, int max_depth,
                                           bool follow_symlinks, bool copy_links, bool safe_links,
-                                           bool copy_unsafe_links, bool checksum) {
+                                           bool copy_unsafe_links) {
  DirectoryScanner* scanner = malloc(sizeof(DirectoryScanner));
  if (scanner == NULL)
    return NULL;
@@ -61,7 +61,6 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
  scanner->copy_links = copy_links;
  scanner->safe_links = safe_links;
  scanner->copy_unsafe_links = copy_unsafe_links;
-  scanner->checksum = checksum;
  queue_enqueue(scanner->directories, dir_entry_create(root_directory, 0));
  return scanner;
 }
@@ -277,7 +276,6 @@ typedef struct {
  bool copy_links;
  bool safe_links;
  bool copy_unsafe_links;
-  bool checksum;
 } ParallelWorkerArg;

 static int parallel_worker_thread(void* arg) {
@@ -286,7 +284,7 @@ static int parallel_worker_thread(void* arg) {
    DirectoryScanner* ds = directory_scanner_create(
        wa->dirs[i], wa->use_metadata, wa->chunk_size, wa->exclude_patterns, wa->exclude_count,
        wa->include_patterns, wa->include_count, wa->max_size, wa->min_size, wa->max_depth,
-        wa->follow_symlinks, wa->copy_links, wa->safe_links, wa->copy_unsafe_links, wa->checksum);
+        wa->follow_symlinks, wa->copy_links, wa->safe_links, wa->copy_unsafe_links);
    Chunk* chunk;
    while ((chunk = directory_scanner_next(ds)) != NULL) {
      queue_enqueue_multithreaded(wa->ps->result_queue, chunk, &wa->ps->result_mutex,
@@ -314,7 +312,7 @@ ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata
                                         int include_count, unsigned long long max_size,
                                         unsigned long long min_size, int max_depth,
                                         int num_threads, bool follow_symlinks, bool copy_links,
-                                          bool safe_links, bool copy_unsafe_links, bool checksum) {
+                                         bool safe_links, bool copy_unsafe_links) {
  ParallelScanner* ps = calloc(1, sizeof(ParallelScanner));
  if (!ps)
    return NULL;
@@ -347,11 +345,63 @@ ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata
    char* cur_path = path_cat(root_directory, entry->d_name);
    if (!cur_path)
      continue;
+    struct stat lstats;
+    if (lstat(cur_path, &lstats) != 0) {
+      free(cur_path);
+      continue;
+    }
+    bool is_symlink = S_ISLNK(lstats.st_mode);
+
+    // Skip symlinks unless the user explicitly enabled following/copying them.
+    if (is_symlink && !follow_symlinks && !copy_links && !safe_links &&
+        !copy_unsafe_links) {
+      free(cur_path);
+      continue;
+    }
+
+    // --safe-links: reject symlinks pointing outside the source tree.
+    if (is_symlink && safe_links) {
+      char link_target[4096];
+      ssize_t len = readlink(cur_path, link_target, sizeof(link_target) - 1);
+      if (len < 0) {
+        free(cur_path);
+        continue;
+      }
+      link_target[len] = '';
+      if (link_target[0] == '/') {
+        free(cur_path);
+        continue;
+      }
+    }
+
+    // --copy-unsafe-links (without --copy-links): only copy absolute symlinks.
+    if (is_symlink && copy_unsafe_links && !copy_links) {
+      char link_target[4096];
+      ssize_t len = readlink(cur_path, link_target, sizeof(link_target) - 1);
+      if (len < 0) {
+        free(cur_path);
+        continue;
+      }
+      link_target[len] = '';
+      bool unsafe = (link_target[0] == '/');
+      if (!unsafe) {
+        free(cur_path);
+        continue;
+      }
+    }
+
+    // Determine whether to use lstat or stat results for the entry.
    struct stat st;
+    bool use_lstat_res = is_symlink && follow_symlinks && !copy_links;
+    if (use_lstat_res) {
+      st = lstats;
+    } else {
      if (stat(cur_path, &st) != 0) {
        free(cur_path);
        continue;
      }
+    }
+
    if (S_ISDIR(st.st_mode)) {
      array_list_add(subdirs, cur_path);
    } else {
@@ -477,7 +527,6 @@ ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata
      wa->copy_links = copy_links;
      wa->safe_links = safe_links;
      wa->copy_unsafe_links = copy_unsafe_links;
-      wa->checksum = checksum;
      start += count;
      if (thrd_create(&ps->threads[t], parallel_worker_thread, wa) != thrd_success) {
        for (int j = 0; j < count; j++)
@@ -25,7 +25,6 @@ typedef struct {
  bool copy_links;
  bool safe_links;
  bool copy_unsafe_links;
-  bool checksum;
 } DirectoryScanner;

 typedef struct {
@@ -46,7 +45,7 @@ DirectoryScanner* directory_scanner_create(const char* root_directory, bool use_
                                           int include_count, unsigned long long max_size,
                                           unsigned long long min_size, int max_depth,
                                           bool follow_symlinks, bool copy_links, bool safe_links,
-                                           bool copy_unsafe_links, bool checksum);
+                                           bool copy_unsafe_links);
 Chunk* directory_scanner_next(DirectoryScanner* scanner);
 void directory_scanner_destroy(DirectoryScanner* scanner);

@@ -56,7 +55,7 @@ ParallelScanner* parallel_scanner_create(char* root_directory, bool use_metadata
                                         int include_count, unsigned long long max_size,
                                         unsigned long long min_size, int max_depth,
                                         int num_threads, bool follow_symlinks, bool copy_links,
-                                          bool safe_links, bool copy_unsafe_links, bool checksum);
+                                         bool safe_links, bool copy_unsafe_links);
 Chunk* parallel_scanner_next(ParallelScanner* scanner);
 void parallel_scanner_destroy(ParallelScanner* scanner);

@@ -12,6 +12,9 @@
 #include "metadata.h"
 #include "protocol.h"

+/* Maximum individual file data size within a chunk (64 MB) */
+#define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
+
 Chunk* chunk_create(File** items, int element_count) {
  Chunk* chunk = (Chunk*)malloc(sizeof(Chunk));
  if (chunk == NULL) {
@@ -157,6 +160,14 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
      return NULL;
    }

+    // Reject individual file data larger than the maximum allowed size.
+    if (file_data_size > MAX_FILE_DATA_SIZE) {
+      log_message(LOG_LEVEL_ERROR, "File data size %zu exceeds maximum %llu",
+                  file_data_size, (unsigned long long)MAX_FILE_DATA_SIZE);
+      array_list_delete(files);
+      return NULL;
+    }
+
    void* file_data = malloc(file_data_size);
    if (file_data == NULL) {
      perror("Could not allocate memory for file data");
@@ -210,6 +221,15 @@ Chunk* receive_chunk_data(int fd, const Config* config) {
      return NULL;
    }
  }
+
+  // Reject chunks larger than the maximum allowed size to prevent OOM.
+  if (data_to_process->size > MAX_CHUNK_SIZE) {
+    log_message(LOG_LEVEL_ERROR, "Chunk size %zu exceeds maximum %llu",
+                data_to_process->size, (unsigned long long)MAX_CHUNK_SIZE);
+    data_destroy(data_to_process);
+    return NULL;
+  }
+
  Chunk* chunk = chunk_deserialize(data_to_process, config->use_metadata);
  data_destroy(data_to_process);
  if (chunk == NULL)
@@ -89,18 +89,6 @@ Config* config_create(void) {
  config->compare_dest = NULL;
  config->copy_dest = NULL;
  config->link_dest = NULL;
-  config->partial_dir = NULL;
-  config->suffix = NULL;
-  config->delete_before = false;
-  config->address = NULL;
-  config->bind_address = NULL;
-  config->ipv6 = false;
-  config->ipv4 = false;
-  config->daemon = false;
-  config->daemon_config = NULL;
-  config->server_mode = false;
-  config->checksum = false;
-  config->compress_choice = NULL;
  return config;
 }

@@ -155,12 +143,6 @@ void config_delete(Config* config) {
  free(config->compare_dest);
  free(config->copy_dest);
  free(config->link_dest);
-  free(config->partial_dir);
-  free(config->suffix);
-  free(config->address);
-  free(config->bind_address);
-  free(config->daemon_config);
-  free(config->compress_choice);
  if (config->filters) {
    array_list_delete(config->filters);
  }
@@ -242,18 +224,6 @@ bool config_send(int file_descriptor, const Config* config) {
    return false;
  if (!send_str(file_descriptor, config->temp_dir ? config->temp_dir : ""))
    return false;
-  if (!send_int(file_descriptor, config->partial))
-    return false;
-  if (!send_str(file_descriptor, config->partial_dir ? config->partial_dir : ""))
-    return false;
-  if (!send_str(file_descriptor, config->suffix ? config->suffix : ""))
-    return false;
-  if (!send_int(file_descriptor, config->delete_before))
-    return false;
-  if (!send_int(file_descriptor, config->checksum))
-    return false;
-  if (!send_str(file_descriptor, config->compress_choice ? config->compress_choice : ""))
-    return false;
  Status status;
  if (!receive_status(file_descriptor, &status))
    return false;
@@ -451,31 +421,6 @@ Config* config_receive(int file_descriptor) {
  config->temp_dir = receive_str(file_descriptor);
  if (config->temp_dir == NULL)
    goto error;
-  if (!receive_int(file_descriptor, &tmp))
-    goto error;
-  config->partial = tmp;
-  config->partial_dir = receive_str(file_descriptor);
-  if (config->partial_dir == NULL)
-    goto error;
-  config->suffix = receive_str(file_descriptor);
-  if (config->suffix == NULL)
-    goto error;
-  if (!receive_int(file_descriptor, &tmp))
-    goto error;
-  config->delete_before = tmp;
-  if (!receive_int(file_descriptor, &tmp))
-    goto error;
-  config->checksum = tmp;
-  config->compress_choice = receive_str(file_descriptor);
-  if (config->compress_choice == NULL)
-    goto error;
-  config->address = NULL;
-  config->bind_address = NULL;
-  config->ipv6 = false;
-  config->ipv4 = false;
-  config->daemon = false;
-  config->daemon_config = NULL;
-  config->server_mode = false;
  config->server_host = str_dup("127.0.0.1");
  config->server_port = 8080;
  if (!send_status(file_descriptor, STATUS_OK))
@@ -489,9 +434,6 @@ error:
  free(config->server_host);
  free(config->backup_dir);
  free(config->temp_dir);
-  free(config->partial_dir);
-  free(config->suffix);
-  free(config->compress_choice);
  free(config);
  return NULL;
 }
@@ -100,32 +100,6 @@ typedef struct Config {
  char* compare_dest;
  char* copy_dest;
  char* link_dest;
-
-  // PR #174: Partial transfer resumption
-  char* partial_dir;
-
-  // PR #178: Backup versioning
-  char* suffix;
-
-  // PR #179: Delete policies
-  bool delete_before;
-
-  // PR #181: IPv6 and bind address
-  char* address;
-  char* bind_address;
-  bool ipv6;
-  bool ipv4;
-
-  // PR #182: Daemon/server mode
-  bool daemon;
-  char* daemon_config;
-  bool server_mode;
-
-  // PR #183: Checksum comparison
-  bool checksum;
-
-  // PR #184: Compression algorithm negotiation
-  char* compress_choice;
 } Config;

 #define PROTOCOL_VERSION "1.3.0"
@@ -129,28 +129,22 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
 }

 bool file_save_to_disk(const char* root_directory, File* file, const Config* config) {
-  bool backup_enabled = config && config->backup;
-  bool inplace = config && config->inplace;
-  bool sparse = config && config->preserve_sparse;
-  const char* backup_suffix = (config && config->suffix) ? config->suffix : "~";
-  const char* backup_dir = (config && config->backup_dir) ? config->backup_dir : NULL;
-  const char* partial_dir = (config && config->partial_dir) ? config->partial_dir : NULL;
-
+  (void)config;
  if (has_path_traversal(file->path)) {
    log_message(LOG_LEVEL_ERROR, "Path traversal detected in file path: %s", file->path);
    return false;
  }

-  char* resolved_root = NULL;
-  const char* actual_root = (partial_dir && config && config->partial) ? partial_dir : root_directory;
-  resolved_root = realpath(actual_root, NULL);
+  // Resolve the destination root to its real path, preventing symlink-based escapes.
+  // If the root does not yet exist, try to create it so realpath can succeed.
+  char* resolved_root = realpath(root_directory, NULL);
  if (resolved_root == NULL) {
-    if (mkdir_r(actual_root)) {
-      resolved_root = realpath(actual_root, NULL);
+    if (mkdir_r(root_directory)) {
+      resolved_root = realpath(root_directory, NULL);
    }
  }
  if (resolved_root == NULL) {
-    log_message(LOG_LEVEL_ERROR, "Failed to resolve destination root: %s", actual_root);
+    log_message(LOG_LEVEL_ERROR, "Failed to resolve destination root: %s", root_directory);
    return false;
  }

@@ -160,43 +154,7 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
    return false;
  }

-  if (backup_enabled) {
-    struct stat backup_stat;
-    if (stat(disk_path, &backup_stat) == 0) {
-      char* backup_path = NULL;
-      if (backup_dir) {
-        char* resolved_backup_dir = realpath(backup_dir, NULL);
-        if (!resolved_backup_dir) {
-          mkdir_r(backup_dir);
-          resolved_backup_dir = realpath(backup_dir, NULL);
-        }
-        if (resolved_backup_dir) {
-          backup_path = path_cat(resolved_backup_dir, file->path);
-          free(resolved_backup_dir);
-        }
-      }
-      if (!backup_path) {
-        size_t path_len = strlen(disk_path);
-        size_t suffix_len = strlen(backup_suffix);
-        backup_path = malloc(path_len + suffix_len + 1);
-        if (backup_path) {
-          memcpy(backup_path, disk_path, path_len);
-          memcpy(backup_path + path_len, backup_suffix, suffix_len + 1);
-        }
-      }
-      if (backup_path) {
-        char* backup_dir_path = str_dup(backup_path);
-        if (backup_dir_path) {
-          char* bdir = dirname(backup_dir_path);
-          mkdir_r(bdir);
-          free(backup_dir_path);
-        }
-        rename(disk_path, backup_path);
-        free(backup_path);
-      }
-    }
-  }
-
+  // Ensure the target directory exists so the parent can be resolved for path safety.
  char* dir_dup = str_dup(disk_path);
  if (!dir_dup) {
    free(resolved_root);
@@ -204,6 +162,7 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
    return false;
  }
  char* dir_str = dirname(dir_dup);
+  // Create the directory if needed (no-op if it already exists) so realpath can resolve it.
  if (!mkdir_r(dir_str)) {
    free(dir_dup);
    free(resolved_root);
@@ -219,11 +178,13 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
    return false;
  }

+  // Verify that the resolved directory is inside the resolved root.
+  // Both are canonical absolute paths — this prevents symlink-based escapes.
  size_t root_len = strlen(resolved_root);
  if (strncmp(resolved_dir, resolved_root, root_len) != 0 ||
      (resolved_dir[root_len] != '\0' && resolved_dir[root_len] != '/')) {
    log_message(LOG_LEVEL_ERROR, "Path escape detected: %s is outside %s", disk_path,
-                actual_root);
+                root_directory);
    free(resolved_dir);
    free(resolved_root);
    free(disk_path);
@@ -232,7 +193,7 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
  free(resolved_dir);
  free(resolved_root);

-  bool ok = to_disk(disk_path, file->data->data, file->data->size, inplace, sparse);
+  bool ok = to_disk(disk_path, file->data->data, file->data->size);
  if (ok)
    file_restore_metadata(disk_path, file->metadata);
  free(disk_path);
@@ -517,8 +478,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
  return file;
 }

-bool to_disk(const char* path, const void* data, unsigned long long data_size,
-             bool inplace, bool sparse) {
+bool to_disk(const char* path, const void* data, unsigned long long data_size) {
  char* tmp_path = NULL;
  char* directory = NULL;

@@ -535,39 +495,6 @@ bool to_disk(const char* path, const void* data, unsigned long long data_size,
  if (!mkdir_r(directory))
    goto done;

-  if (inplace) {
-    FILE* file_pointer = fopen(path, "wb");
-    if (file_pointer == NULL) {
-      perror("Could not open file for inplace write");
-      ok = false;
-      goto done;
-    }
-    if (sparse && data_size > 0) {
-      if (fseek(file_pointer, data_size - 1, SEEK_SET) != 0) {
-        perror("Failed to seek for sparse file");
-        fclose(file_pointer);
-        ok = false;
-        goto done;
-      }
-      if (fwrite("", 1, 1, file_pointer) != 1) {
-        perror("Failed to write sparse file");
-        fclose(file_pointer);
-        ok = false;
-        goto done;
-      }
-      rewind(file_pointer);
-    }
-    if (data_size > 0 && fwrite(data, 1, data_size, file_pointer) != data_size) {
-      perror("Failed to write all data to file");
-      fclose(file_pointer);
-      ok = false;
-      goto done;
-    }
-    fclose(file_pointer);
-    free(directory);
-    return true;
-  }
-
  size_t path_len = strlen(path);
  tmp_path = malloc(path_len + 5);
  if (!tmp_path) {
@@ -583,21 +510,6 @@ bool to_disk(const char* path, const void* data, unsigned long long data_size,
    ok = false;
    goto done;
  }
-  if (sparse && data_size > 0) {
-    if (fseek(file_pointer, data_size - 1, SEEK_SET) != 0) {
-      perror("Failed to seek for sparse file");
-      fclose(file_pointer);
-      ok = false;
-      goto done;
-    }
-    if (fwrite("", 1, 1, file_pointer) != 1) {
-      perror("Failed to write sparse file");
-      fclose(file_pointer);
-      ok = false;
-      goto done;
-    }
-    rewind(file_pointer);
-  }
  if (fwrite(data, 1, data_size, file_pointer) != data_size) {
    perror("Failed to write all data to temporary file");
    fclose(file_pointer);
@@ -622,6 +534,13 @@ done:

 bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int compression_level,
                        bool send_path) {
+  // sendfile is incompatible with compression (kernel zero-copy).
+  // If compression is requested, fall back to the regular send path.
+  // NOTE: This is a safety net only — callers must ensure compression_level == 0
+  // before calling file_send_sendfile. The fallback to file_send_single_calls
+  // preserves the send_path contract, but callers should not rely on it for
+  // correctness (the --sendfile flag is validated to be mutually exclusive with
+  // -c/--compress at the CLI layer).
  if (compression_level > 0)
    return file_send_single_calls(file, file_descriptor, use_metadata, compression_level,
                                  send_path);
@@ -34,8 +34,7 @@ bool file_send_sendfile(File* file, int file_descriptor, bool use_metadata, int
 size_t file_content_to_buffer(File* file);
 FileMetadata* file_metadata_create(const struct stat* stats);
 void file_metadata_destroy(void* metadata);
-bool to_disk(const char* path, const void* data, unsigned long long data_size,
-             bool inplace, bool sparse);
+bool to_disk(const char* path, const void* data, unsigned long long data_size);
 bool file_save_to_disk(const char* root_directory, File* file, const Config* config);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
 int receive_manifest(int fd, const Config* config, int* next_status);
@@ -24,14 +24,11 @@ PipelineContextSender* pipeline_context_sender_create(Config* config, Queue* que
  context->scanner_done = false;
  context->loader_done = false;
  context->manifest = NULL;
-  context->progress_bytes = 0;
-  context->sender_done = false;
  if (mtx_init(&context->mutex_scanner, mtx_plain) != thrd_success ||
      cnd_init(&context->condition_not_full_scanner) != thrd_success ||
      cnd_init(&context->condition_not_empty_scanner) != thrd_success ||
      mtx_init(&context->mutex_loader, mtx_plain) != thrd_success ||
      cnd_init(&context->condition_not_full_loader) != thrd_success ||
-      mtx_init(&context->mutex_progress, mtx_plain) != thrd_success ||
      cnd_init(&context->condition_not_empty_loader) != thrd_success) {
    perror("Error initializing synchronization objects");
    free(context);
@@ -53,7 +50,6 @@ void pipeline_context_sender_destroy(PipelineContextSender* context) {
  mtx_destroy(&context->mutex_loader);
  cnd_destroy(&context->condition_not_full_loader);
  cnd_destroy(&context->condition_not_empty_loader);
-  mtx_destroy(&context->mutex_progress);
  free(context);
 }

@@ -23,9 +23,6 @@ typedef struct {
  cnd_t condition_not_empty_loader;
  bool loader_done;
  ArrayList* manifest;
-  mtx_t mutex_progress;
-  unsigned long long progress_bytes;
-  bool sender_done;
 } PipelineContextSender;

 typedef struct PipelineContextReceiver {
@@ -11,6 +11,9 @@
 /* Maximum allowed data payload size for receive_data (100 MB) */
 #define MAX_DATA_PAYLOAD_SIZE (100ULL * 1024 * 1024)

+/* Maximum chunk size (64 MB) — prevents unbounded allocation from the wire */
+#define MAX_CHUNK_SIZE (64ULL * 1024 * 1024)
+
 typedef struct ssl_st SSL;

 typedef int Status;
@@ -182,7 +182,7 @@ Client* client_connect_ssh(const char* destination, int port, const char* server
    return NULL;
  }
  client->file_descriptor = sv[0];
-  client->address.ss_family = AF_UNIX;
+  client->address.sin_family = AF_UNIX;
  client->address_length = 0;
  client->ssh_child_pid = pid;
  client->ssl = NULL;
@@ -3,7 +3,6 @@
 #include "protocol.h"
 #include <arpa/inet.h>
 #include <errno.h>
-#include <netdb.h>
 #include <openssl/ssl.h>
 #include <signal.h>
 #include <stdio.h>
@@ -144,10 +143,6 @@ void tcp_set_timeouts(int timeout_sec, int contimeout_sec) {
    g_contimeout_sec = contimeout_sec;
 }

-int tcp_get_contimeout_sec(void) {
-  return g_contimeout_sec;
-}
-
 static void tcp_apply_socket_timeout(int fd) {
  struct timeval tv;
  tv.tv_sec = g_timeout_sec;
@@ -157,12 +152,19 @@ static void tcp_apply_socket_timeout(int fd) {
 }

 Client* client_create() {
-  Client* client = (Client*)malloc(sizeof(Client));
-  if (client == NULL) {
+  int file_descriptor = socket(AF_INET, SOCK_STREAM, 0);
+  if (file_descriptor < 0) {
+    perror("Could not create Socket!");
    return NULL;
  }
-  client->file_descriptor = -1;
-  memset(&client->address, 0, sizeof(client->address));
+
+  Client* client = (Client*)malloc(sizeof(Client));
+  if (client == NULL) {
+    close(file_descriptor);
+    return NULL;
+  }
+  client->file_descriptor = file_descriptor;
+  client->address.sin_family = AF_INET;
  client->address_length = sizeof(client->address);
  client->ssh_child_pid = -1;
  client->ssl = NULL;
@@ -171,50 +173,23 @@ Client* client_create() {
 }

 bool client_connect(Client* client, char* host, int port) {
-  struct addrinfo hints;
-  struct addrinfo* result;
-  memset(&hints, 0, sizeof(hints));
-  hints.ai_family = AF_UNSPEC;
-  hints.ai_socktype = SOCK_STREAM;
-  hints.ai_protocol = IPPROTO_TCP;
+  client->address.sin_port = htons(port);
+  client->address.sin_family = AF_INET;
+  client->address_length = sizeof(client->address);

-  char port_str[16];
-  snprintf(port_str, sizeof(port_str), "%d", port);
-
-  int err = getaddrinfo(host, port_str, &hints, &result);
-  if (err != 0 || result == NULL) {
-    fprintf(stderr, "Could not resolve host: %s (%s)\n", host, gai_strerror(err));
+  if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
+    perror("Could not convert host address!");
    return false;
  }

-  struct addrinfo* rp;
-  bool connected = false;
-  for (rp = result; rp != NULL; rp = rp->ai_next) {
-    if (client->file_descriptor >= 0)
-      close(client->file_descriptor);
-
-    client->file_descriptor = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
-    if (client->file_descriptor < 0)
-      continue;
-
  struct timeval ct;
  ct.tv_sec = g_contimeout_sec;
  ct.tv_usec = 0;
  setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
  setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));

-    memcpy(&client->address, rp->ai_addr, rp->ai_addrlen);
-    client->address_length = rp->ai_addrlen;
-
-    if (connect(client->file_descriptor, (struct sockaddr*)&client->address,
-                client->address_length) == 0) {
-      connected = true;
-      break;
-    }
-  }
-  freeaddrinfo(result);
-
-  if (!connected) {
+  if (connect(client->file_descriptor, (struct sockaddr*)&client->address, client->address_length) <
+      0) {
    perror("Could not connect to Server!");
    return false;
  }
@@ -230,10 +205,7 @@ void client_disconnect(Client* client) {
    client->ssl = NULL;
    io_set_ssl(NULL);
  }
-  if (client->file_descriptor >= 0) {
  close(client->file_descriptor);
-    client->file_descriptor = -1;
-  }
  if (client->ssh_child_pid > 0) {
    int status;
    waitpid(client->ssh_child_pid, &status, 0);
@@ -15,7 +15,7 @@ typedef struct Server {
 } Server;

 typedef struct Client {
-  struct sockaddr_storage address;
+  struct sockaddr_in address;
  unsigned int address_length;
  int file_descriptor;
  pid_t ssh_child_pid;
@@ -33,6 +33,5 @@ bool client_connect(Client* client, char* host, int port);
 void client_disconnect(Client* client);
 void client_delete(Client* client);
 void tcp_set_timeouts(int timeout_sec, int contimeout_sec);
-int tcp_get_contimeout_sec(void);

 #endif
@@ -3,7 +3,6 @@
 #include "protocol.h"
 #include "transport_tcp.h"
 #include <arpa/inet.h>
-#include <netdb.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <signal.h>
@@ -149,50 +148,13 @@ bool server_listen_tls(Server* server, void (*handler)(int file_descriptor)) {

 bool client_connect_tls(Client* client, char* host, int port, const char* cert_path,
                        const char* key_path, const char* ca_path) {
-  struct addrinfo hints;
-  struct addrinfo* result;
-  memset(&hints, 0, sizeof(hints));
-  hints.ai_family = AF_UNSPEC;
-  hints.ai_socktype = SOCK_STREAM;
-  hints.ai_protocol = IPPROTO_TCP;
-
-  char port_str[16];
-  snprintf(port_str, sizeof(port_str), "%d", port);
-
-  int err = getaddrinfo(host, port_str, &hints, &result);
-  if (err != 0 || result == NULL) {
-    fprintf(stderr, "Could not resolve host: %s (%s)\n", host, gai_strerror(err));
+  client->address.sin_port = htons(port);
+  if (inet_pton(AF_INET, host, &client->address.sin_addr) <= 0) {
+    perror("Could not convert host address!");
    return false;
  }
-
-  struct addrinfo* rp;
-  bool connected = false;
-  for (rp = result; rp != NULL; rp = rp->ai_next) {
-    if (client->file_descriptor >= 0)
-      close(client->file_descriptor);
-
-    client->file_descriptor = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
-    if (client->file_descriptor < 0)
-      continue;
-
-    struct timeval ct;
-    ct.tv_sec = tcp_get_contimeout_sec();
-    ct.tv_usec = 0;
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &ct, sizeof(ct));
-    setsockopt(client->file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &ct, sizeof(ct));
-
-    memcpy(&client->address, rp->ai_addr, rp->ai_addrlen);
-    client->address_length = rp->ai_addrlen;
-
-    if (connect(client->file_descriptor, (struct sockaddr*)&client->address,
-                client->address_length) == 0) {
-      connected = true;
-      break;
-    }
-  }
-  freeaddrinfo(result);
-
-  if (!connected) {
+  if (connect(client->file_descriptor, (struct sockaddr*)&client->address, client->address_length) <
+      0) {
    perror("Could not connect to Server!");
    return false;
  }
@@ -11,7 +11,7 @@ static void test_file_operations() {
  char* test_content = "Hello, Chunk System!";
  unsigned long long test_len = strlen(test_content);

-  to_disk(test_path, test_content, test_len, false, false);
+  to_disk(test_path, test_content, test_len);

  File* f = file_create(test_path);
  EXPECT_NOT_NULL(f);
@@ -43,8 +43,8 @@ static void test_chunk_operations() {
  char* content2 = "chunk item number 2";
  unsigned long long len2 = strlen(content2);

-  to_disk(path1, content1, len1, false, false);
-  to_disk(path2, content2, len2, false, false);
+  to_disk(path1, content1, len1);
+  to_disk(path2, content2, len2);

  struct stat st1, st2;
  stat(path1, &st1);
@@ -62,8 +62,8 @@ static void test_chunk_compress_decompress_roundtrip() {
  char* content2 = "chunk compression test file 2 with more data";
  unsigned long long len2 = strlen(content2);

-  to_disk(path1, content1, len1, false, false);
-  to_disk(path2, content2, len2, false, false);
+  to_disk(path1, content1, len1);
+  to_disk(path2, content2, len2);

  struct stat st1, st2;
  EXPECT_EQ_INT(stat(path1, &st1), 0);
@@ -34,7 +34,7 @@ static void test_file_destroy_normal() {

 static void test_file_load_data() {
  const char* content = "Hello Load Test";
-  EXPECT_TRUE(to_disk("test_file_load_data.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(to_disk("test_file_load_data.txt", content, strlen(content)));

  struct stat st;
  EXPECT_EQ_INT(stat("test_file_load_data.txt", &st), 0);
@@ -89,7 +89,7 @@ static void test_file_save_to_disk() {

 static void test_to_disk_basic() {
  const char* content = "Basic to_disk test";
-  EXPECT_TRUE(to_disk("test_to_disk_basic.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(to_disk("test_to_disk_basic.txt", content, strlen(content)));

  struct stat st;
  EXPECT_EQ_INT(stat("test_to_disk_basic.txt", &st), 0);
@@ -108,7 +108,7 @@ static void test_to_disk_basic() {

 static void test_to_disk_creates_dirs() {
  const char* content = "Nested dir test";
-  EXPECT_TRUE(to_disk("test_nested_tmp/nested/file.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(to_disk("test_nested_tmp/nested/file.txt", content, strlen(content)));

  struct stat st;
  EXPECT_EQ_INT(stat("test_nested_tmp/nested/file.txt", &st), 0);
@@ -128,7 +128,7 @@ static void test_to_disk_creates_dirs() {

 static void test_file_content_to_buffer() {
  const char* content = "Buffer content test";
-  EXPECT_TRUE(to_disk("test_buffer_file.txt", content, strlen(content), false, false));
+  EXPECT_TRUE(to_disk("test_buffer_file.txt", content, strlen(content)));

  File* f = file_create("test_buffer_file.txt");
  EXPECT_NOT_NULL(f);
@@ -250,7 +250,7 @@ static void test_file_send_no_path() {
 }

 static void test_file_metadata_create() {
-  EXPECT_TRUE(to_disk("test_meta_file.txt", "metadata test", 13, false, false));
+  EXPECT_TRUE(to_disk("test_meta_file.txt", "metadata test", 13));
  struct stat st;
  EXPECT_EQ_INT(stat("test_meta_file.txt", &st), 0);

@@ -359,7 +359,7 @@ static void test_file_send_single_calls_metadata_and_path() {
  /* Create a real file on disk so we can have metadata */
  const char* content = "File with metadata";
  size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_meta_send.txt", content, len, false, false));
+  EXPECT_TRUE(to_disk("test_meta_send.txt", content, len));

  struct stat st;
  EXPECT_EQ_INT(stat("test_meta_send.txt", &st), 0);
@@ -15,7 +15,7 @@
 static void test_sendfile_basic() {
  const char* content = "Hello from sendfile test!";
  size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_sendfile_basic.txt", content, len, false, false));
+  EXPECT_TRUE(to_disk("test_sendfile_basic.txt", content, len));

  File* file = file_create("test_sendfile_basic.txt");
  EXPECT_NOT_NULL(file);
@@ -77,7 +77,7 @@ static void test_sendfile_basic() {
 static void test_sendfile_empty_file() {
  const char* content = "";
  size_t len = 0;
-  EXPECT_TRUE(to_disk("test_sendfile_empty.txt", content, len, false, false));
+  EXPECT_TRUE(to_disk("test_sendfile_empty.txt", content, len));

  File* file = file_create("test_sendfile_empty.txt");
  EXPECT_NOT_NULL(file);
@@ -156,7 +156,7 @@ static void test_sendfile_missing_file() {
 static void test_sendfile_compression_fallback() {
  const char* content = "Compression fallback content";
  size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_sendfile_comp.txt", content, len, false, false));
+  EXPECT_TRUE(to_disk("test_sendfile_comp.txt", content, len));

  struct stat st;
  EXPECT_EQ_INT(stat("test_sendfile_comp.txt", &st), 0);
@@ -222,7 +222,7 @@ static void test_sendfile_compression_fallback() {
 static void test_sendfile_no_path() {
  const char* content = "No path sendfile test";
  size_t len = strlen(content);
-  EXPECT_TRUE(to_disk("test_sendfile_nopath.txt", content, len, false, false));
+  EXPECT_TRUE(to_disk("test_sendfile_nopath.txt", content, len));

  File* file = file_create("test_sendfile_nopath.txt");
  EXPECT_NOT_NULL(file);
@@ -101,7 +101,7 @@ static void test_fuzz_delta_deserialize() {
 /* Smoke test for metadata_from_buf fuzz target */
 static void test_fuzz_metadata_from_buf() {
  /* Create a real file to get metadata from */
-  EXPECT_TRUE(to_disk("fuzz_meta_test.txt", "metadata test", 13, false, false));
+  EXPECT_TRUE(to_disk("fuzz_meta_test.txt", "metadata test", 13));

  struct stat st;
  EXPECT_EQ_INT(stat("fuzz_meta_test.txt", &st), 0);
@@ -112,7 +112,7 @@ static void test_metadata_send_null() {
 static void test_file_restore_metadata() {
  const char* path = "temp_meta_restore_test.txt";
  const char* content = "test content";
-  EXPECT_TRUE(to_disk(path, content, strlen(content), false, false));
+  EXPECT_TRUE(to_disk(path, content, strlen(content)));

  FileMetadata m;
  m.mode = 0644;
@@ -84,7 +84,7 @@ static void test_property_chunk_roundtrip() {
    for (int i = 0; i < content_len; i++)
      content[i] = (char)(rand() % 256);

-    to_disk(path, content, content_len, false, false);
+    to_disk(path, content, content_len);

    struct stat st;
    stat(path, &st);
@@ -13,7 +13,7 @@
 static void test_chunk_deserialize_truncated() {
  char* path = "test_rob_trunc.txt";
  char* content = "hello";
-  to_disk(path, content, strlen(content), false, false);
+  to_disk(path, content, strlen(content));

  struct stat st;
  stat(path, &st);
@@ -7,7 +7,7 @@
 #include <unistd.h>

 static void create_test_file(const char* path, const char* content) {
-  (void)to_disk(path, content, strlen(content), false, false);
+  (void)to_disk(path, content, strlen(content));
 }

 static void test_scanner_single_file() {
@@ -19,7 +19,7 @@ static void test_scanner_single_file() {
  create_test_file(file1, content1);

  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -48,7 +48,7 @@ static void test_scanner_multiple_files() {
  create_test_file(file2, content2);

  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  const Chunk* chunk = directory_scanner_next(scanner);
@@ -88,7 +88,7 @@ static void test_scanner_subdirectory() {
  create_test_file(sub_file, content);

  DirectoryScanner* scanner = directory_scanner_create((char*)root, false, 0, NULL, 0, NULL, 0, 0,
-                                                       0, 0, false, false, false, false, false);
+                                                       0, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  int total_files = 0;
@@ -112,7 +112,7 @@ static void test_scanner_empty_directory() {
  EXPECT_EQ_INT(mkdir(dir, 0755), 0);

  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  const Chunk* chunk = directory_scanner_next(scanner);
@@ -136,7 +136,7 @@ static void test_scanner_exclude_pattern() {

  char* exclude[] = {"*.tmp"};
  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, exclude, 1, NULL, 0, 0,
-                                                       0, 0, false, false, false, false, false);
+                                                       0, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -169,7 +169,7 @@ static void test_scanner_exclude_subdirectory() {

  char* exclude[] = {"*.tmp"};
  DirectoryScanner* scanner = directory_scanner_create((char*)root, false, 0, exclude, 1, NULL, 0,
-                                                       0, 0, 0, false, false, false, false, false);
+                                                       0, 0, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  int total = 0;
@@ -207,7 +207,7 @@ static void test_scanner_include_and_exclude() {
  char* exclude[] = {"*.bak"};
  char* include[] = {"*.txt", "*.log"};
  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, exclude, 1, include, 2,
-                                                       0, 0, 0, false, false, false, false, false);
+                                                       0, 0, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -244,7 +244,7 @@ static void test_scanner_max_size() {

  /* max_size = 10 — only files <= 10 bytes */
  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 10,
-                                                       0, 0, false, false, false, false, false);
+                                                       0, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -272,7 +272,7 @@ static void test_scanner_min_size() {

  /* min_size = 1 — only files >= 1 byte */
  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 1,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -302,7 +302,7 @@ static void test_scanner_size_range() {

  /* Only files between 3 and 20 bytes */
  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 20,
-                                                       3, 0, false, false, false, false, false);
+                                                       3, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -338,7 +338,7 @@ static void test_scanner_mixed_patterns() {
  char* exclude[] = {"*.bak"};
  char* include[] = {"*.txt"};
  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, exclude, 1, include, 1,
-                                                       10, 3, 0, false, false, false, false, false);
+                                                       10, 3, 0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -369,7 +369,7 @@ static void test_scanner_no_patterns() {
  create_test_file(f2, "second");

  DirectoryScanner* scanner = directory_scanner_create((char*)dir, false, 0, NULL, 0, NULL, 0, 0, 0,
-                                                       0, false, false, false, false, false);
+                                                       0, false, false, false, false);
  EXPECT_NOT_NULL(scanner);

  Chunk* chunk = directory_scanner_next(scanner);
@@ -23,8 +23,8 @@ static void test_server_delete_null() {
 static void test_client_create() {
  Client* c = client_create();
  EXPECT_NOT_NULL(c);
-  EXPECT_TRUE(c->file_descriptor == -1);
-  EXPECT_EQ_INT(c->address.ss_family, 0);
+  EXPECT_TRUE(c->file_descriptor >= 0);
+  EXPECT_EQ_INT(c->address.sin_family, AF_INET);
  EXPECT_EQ_INT(c->ssh_child_pid, -1);
  EXPECT_NULL(c->ssl);
  EXPECT_NULL(c->ssl_ctx);