fix: resolve all security issues (#154, #156, #157, #159, #160, #161, #162, #170)

src/client/client_cli.c

@@ -105,71 +105,27 @@ static int read_patterns_from_file(const char* filepath, char*** patterns, int*
   return 0;
 }
 
-static bool validate_config(Config* config) {
-  if (!config->send_directory || !config->receive_root_directory) {
-    fprintf(stderr, "Error: source and destination directories are required\n");
-    print_usage();
-    return false;
-  }
-  if (config->use_sendfile && (config->use_chunk_serialization || config->use_compression)) {
-    fprintf(stderr, "Error: -f/--sendfile cannot be combined with -c (compression) or -s "
-                    "(chunk serialization)\n");
-    return false;
-  }
-  if (config->transport == TRANSPORT_SSH && config->use_sendfile) {
-    fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
-    return false;
-  }
-  if (config->use_incremental && config->use_chunk_serialization) {
-    fprintf(stderr, "Error: --incremental is not supported with -s (chunk serialization)\n");
-    return false;
-  }
-  if (config->use_incremental && !config->use_metadata) {
-    log_message(LOG_LEVEL_INFO, "Enabling metadata preservation for --incremental");
-    config->use_metadata = true;
-  }
-  if (config->use_delta && !config->use_incremental) {
-    fprintf(stderr, "Error: --delta requires --incremental\n");
-    return false;
-  }
-  if (config->use_delta && config->use_chunk_serialization) {
-    fprintf(stderr, "Error: --delta cannot be combined with -s (chunk serialization)\n");
-    return false;
-  }
-  if (config->use_delta && config->use_sendfile) {
-    fprintf(stderr, "Error: --delta cannot be combined with -f (sendfile)\n");
-    return false;
-  }
-  if (config->use_delta && !config->use_metadata) {
-    log_message(LOG_LEVEL_INFO, "Enabling metadata preservation for --delta");
-    config->use_metadata = true;
-  }
-  if (config->use_tls) {
-    if (!config->tls_cert || !config->tls_key) {
-      fprintf(stderr, "Error: --tls requires --cert and --key\n");
-      return false;
-    }
-    tls_global_init();
-  }
-  return true;
-}
-
 int main(int argc, char* argv[]) {
   const char* env_source = getenv("FASTSYNC_SOURCE_DIR");
   const char* env_dest = getenv("FASTSYNC_DEST_DIR");
   const char* env_save = getenv("FASTSYNC_SAVE_TO_DISK");
 
+  bool save_to_disk = false;
+  if (env_save && (strcmp(env_save, "true") == 0 || strcmp(env_save, "1") == 0)) {
+    save_to_disk = true;
+  }
+
   int exit_code = 0;
   Config* config = NULL;
   bool config_owned_by_pipeline = false;
 
-  config = config_create();
+  char* config_version = str_dup(PROTOCOL_VERSION);
-  if (!config) {
+  if (!config_version) {
     exit_code = 1;
     goto cleanup;
   }
-  if (env_save && (strcmp(env_save, "true") == 0 || strcmp(env_save, "1") == 0))
+  config = config_create(config_version, NULL, NULL, save_to_disk, false, false, false, false, 5,
-    config->save_to_disk = true;
+                         false, 0);
 
   int positional_args[2];
   int positional_count = 0;
@@ -385,6 +341,7 @@ int main(int argc, char* argv[]) {
     config->send_directory = str_dup(argv[positional_args[0]]);
     config->receive_root_directory = str_dup(argv[positional_args[1]]);
     config->save_to_disk = true;
+
     config_parse_ssh_dest(config);
   } else if (positional_count == 1) {
     fprintf(stderr, "Error: missing destination argument\n");
@@ -398,10 +355,64 @@ int main(int argc, char* argv[]) {
       config->receive_root_directory = str_dup((char*)env_dest);
   }
 
-  if (!validate_config(config)) {
+  if (!config->send_directory || !config->receive_root_directory) {
+    fprintf(stderr, "Error: source and destination directories are required\n");
+    print_usage();
     exit_code = 1;
     goto cleanup;
   }
+  if (config->use_sendfile && (config->use_chunk_serialization || config->use_compression)) {
+    fprintf(stderr, "Error: -f/--sendfile cannot be combined with -c (compression) or -s (chunk "
+                    "serialization)\n");
+    exit_code = 1;
+    goto cleanup;
+  }
+
+  if (config->transport == TRANSPORT_SSH && config->use_sendfile) {
+    fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
+    exit_code = 1;
+    goto cleanup;
+  }
+
+  if (config->use_incremental && config->use_chunk_serialization) {
+    fprintf(stderr, "Error: --incremental is not supported with -s (chunk serialization)\n");
+    exit_code = 1;
+    goto cleanup;
+  }
+
+  if (config->use_incremental && !config->use_metadata) {
+    log_message(LOG_LEVEL_INFO, "Enabling metadata preservation for --incremental");
+    config->use_metadata = true;
+  }
+
+  if (config->use_delta && !config->use_incremental) {
+    fprintf(stderr, "Error: --delta requires --incremental\n");
+    exit_code = 1;
+    goto cleanup;
+  }
+  if (config->use_delta && config->use_chunk_serialization) {
+    fprintf(stderr, "Error: --delta cannot be combined with -s (chunk serialization)\n");
+    exit_code = 1;
+    goto cleanup;
+  }
+  if (config->use_delta && config->use_sendfile) {
+    fprintf(stderr, "Error: --delta cannot be combined with -f (sendfile)\n");
+    exit_code = 1;
+    goto cleanup;
+  }
+  if (config->use_delta && !config->use_metadata) {
+    log_message(LOG_LEVEL_INFO, "Enabling metadata preservation for --delta");
+    config->use_metadata = true;
+  }
+
+  if (config->use_tls) {
+    if (!config->tls_cert || !config->tls_key) {
+      fprintf(stderr, "Error: --tls requires --cert and --key\n");
+      exit_code = 1;
+      goto cleanup;
+    }
+    tls_global_init();
+  }
 
   tcp_set_timeouts(config->timeout, config->contimeout);
 

src/client/client_send.c

@@ -364,13 +364,12 @@ static int load_files_multithreaded(void* pipeline_context) {
   }
 }
 
-static int run_dry_run(Config* config) {
+int send_files(Config* config) {
+  if (config->dry_run) {
     DirectoryScanner* scanner = directory_scanner_create(
         config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
         config->exclude_count, config->include_patterns, config->include_count, config->max_size,
         config->min_size, config->max_depth);
-  if (!scanner)
-    return -1;
     Chunk* chunk;
     int file_count = 0;
     unsigned long long total_bytes = 0;
@@ -386,64 +385,41 @@ static int run_dry_run(Config* config) {
     directory_scanner_destroy(scanner);
     printf("Total: %d files, %.1f MB\n", file_count, total_bytes / 1048576.0);
     return 0;
-}
+  }
 
-static Client* connect_to_server(Config* config) {
+  Client* client;
   if (config->transport == TRANSPORT_SSH) {
     if (config->use_sendfile) {
       fprintf(stderr, "Error: -f/--sendfile is not supported with SSH transport\n");
-      return NULL;
+      return 1;
     }
-    return client_connect_ssh(config->ssh_destination, config->ssh_port,
+    client =
-                              config->fastsync_server_path);
+        client_connect_ssh(config->ssh_destination, config->ssh_port, config->fastsync_server_path);
-  }
-  Client* client = client_create();
-  if (!client)
-    return NULL;
-  bool ok;
-  if (config->use_tls) {
-    ok = client_connect_tls(client, config->server_host, config->server_port, config->tls_cert,
-                            config->tls_key, config->tls_ca);
-  } else {
-    ok = client_connect(client, config->server_host, config->server_port);
-  }
-  if (!ok) {
-    client_delete(client);
-    fprintf(stderr, "Error: could not connect to server\n");
-    return NULL;
-  }
-  return client;
-}
-
-static bool send_manifest(int fd, ArrayList* manifest) {
-  if (!send_status(fd, STATUS_MANIFEST))
-    return false;
-  if (!send_int(fd, manifest->size))
-    return false;
-  for (int i = 0; i < manifest->size; i++) {
-    if (!send_str(fd, (char*)manifest->items[i]))
-      return false;
-  }
-  return true;
-}
-
-static void print_progress(unsigned long long total_bytes, time_t start) {
-  double elapsed = difftime(time(NULL), start);
-  double rate = elapsed > 0 ? total_bytes / (1048576.0 * elapsed) : 0;
-  fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  ", total_bytes / 1048576.0, rate);
-  fflush(stderr);
-}
-
-int send_files(Config* config) {
-  if (config->dry_run)
-    return run_dry_run(config);
-
-  Client* client = connect_to_server(config);
     if (!client)
       return 1;
-  if (!config_send(client->file_descriptor, config))
+  } else if (config->use_tls) {
-    goto send_fail;
+    client = client_create();
-
+    if (!client || !client_connect_tls(client, config->server_host, config->server_port,
+                                       config->tls_cert, config->tls_key, config->tls_ca)) {
+      if (client)
+        client_delete(client);
+      fprintf(stderr, "Error: could not connect to server via TLS\n");
+      return 1;
+    }
+  } else {
+    client = client_create();
+    if (!client || !client_connect(client, config->server_host, config->server_port)) {
+      if (client)
+        client_delete(client);
+      fprintf(stderr, "Error: could not connect to server\n");
+      return 1;
+    }
+  }
+  if (!config_send(client->file_descriptor, config)) {
+    client_disconnect(client);
+    client_delete(client);
+    return 1;
+  }
   DirectoryScanner* scanner = directory_scanner_create(
       config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
       config->exclude_count, config->include_patterns, config->include_count, config->max_size,
@@ -485,26 +461,40 @@ int send_files(Config* config) {
       time_t now = time(NULL);
       if (now - last_progress >= 1) {
         last_progress = now;
-        print_progress(total_bytes, start);
+        double elapsed = difftime(now, start);
+        double rate = elapsed > 0 ? total_bytes / (1048576.0 * elapsed) : 0;
+        fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  ", total_bytes / 1048576.0, rate);
+        fflush(stderr);
       }
     }
     chunk_destroy(current_chunk);
   }
   if (config->use_delete) {
-    if (!send_manifest(client->file_descriptor, manifest)) {
+    if (!send_status(client->file_descriptor, STATUS_MANIFEST)) {
       array_list_delete(manifest);
       goto send_fail;
     }
+    if (!send_int(client->file_descriptor, manifest->size)) {
+      array_list_delete(manifest);
+      goto send_fail;
+    }
+    for (int i = 0; i < manifest->size; i++) {
+      if (!send_str(client->file_descriptor, (char*)manifest->items[i])) {
+        array_list_delete(manifest);
+        goto send_fail;
+      }
+    }
     array_list_delete(manifest);
   }
   if (!send_status(client->file_descriptor, STATUS_FINISHED))
     goto send_fail;
   Status s;
   int ok = receive_status(client->file_descriptor, &s) && s == STATUS_OK;
-  if (config->show_progress)
+  if (config->show_progress) {
-    print_progress(total_bytes, start);
+    double elapsed = difftime(time(NULL), start);
-  if (config->show_progress)
+    double rate = elapsed > 0 ? total_bytes / (1048576.0 * elapsed) : 0;
-    fprintf(stderr, "Done.\n");
+    fprintf(stderr, "\rSent %.1f MB  (%.1f MB/s)  Done.\n", total_bytes / 1048576.0, rate);
+  }
   directory_scanner_destroy(scanner);
   client_disconnect(client);
   client_delete(client);
@@ -518,8 +508,27 @@ send_fail:
 }
 
 int send_files_multithreaded(Config* config) {
-  if (config->dry_run)
+  if (config->dry_run) {
-    return run_dry_run(config);
+    DirectoryScanner* scanner = directory_scanner_create(
+        config->send_directory, config->use_metadata, config->chunk_size, config->exclude_patterns,
+        config->exclude_count, config->include_patterns, config->include_count, config->max_size,
+        config->min_size, config->max_depth);
+    Chunk* chunk;
+    int file_count = 0;
+    unsigned long long total_bytes = 0;
+    printf("Dry run: files to be transferred\n");
+    while ((chunk = directory_scanner_next(scanner)) != NULL) {
+      for (int i = 0; i < chunk->element_count; i++) {
+        printf("  %s (%zu bytes)\n", chunk->items[i]->path, chunk->items[i]->data->size);
+        total_bytes += chunk->items[i]->data->size;
+        file_count++;
+      }
+      chunk_destroy(chunk);
+    }
+    directory_scanner_destroy(scanner);
+    printf("Total: %d files, %.1f MB\n", file_count, total_bytes / 1048576.0);
+    return 0;
+  }
 
   long pages = sysconf(_SC_AVPHYS_PAGES);
   long page_size = sysconf(_SC_PAGE_SIZE);

src/server/server.c

@@ -69,7 +69,7 @@ int receive_files(Config* config, int fd) {
         }
         char* full_path = path_cat(config->receive_root_directory, check_path);
         struct stat st;
-        bool has_old = full_path && stat(full_path, &st) == 0;
+        bool has_old = full_path && lstat(full_path, &st) == 0;
         bool match = has_old && (unsigned long long)st.st_size == check_size &&
                      (long long)st.st_mtime == check_mtime;
         if (match)

src/shared/compression.c

@@ -78,14 +78,21 @@ Data* data_decompress(Data* compressed_data) {
     return NULL;
   }
 
+  // ZSTD_CONTENTSIZE_UNKNOWN (~2^64) can cause massive allocation;
+  // fall back to a conservative estimate (3x compressed size) when unknown.
+  if (dst_size == ZSTD_CONTENTSIZE_UNKNOWN) {
+    dst_size = compressed_data->size * 3;
+    if (dst_size < INITIAL_DECOMPRESS_BUF_SIZE)
+      dst_size = INITIAL_DECOMPRESS_BUF_SIZE;
+  }
+
   ZSTD_DCtx* dctx = ZSTD_createDCtx();
   if (!dctx) {
     log_message(LOG_LEVEL_ERROR, "Failed to create ZSTD decompression context");
     return NULL;
   }
 
-  size_t buf_size =
+  size_t buf_size = (dst_size > 0) ? (size_t)dst_size : INITIAL_DECOMPRESS_BUF_SIZE;
-      (!ZSTD_isError(dst_size) && dst_size > 0) ? (size_t)dst_size : INITIAL_DECOMPRESS_BUF_SIZE;
   Data* uncompressed_data = data_create_empty(buf_size);
   if (!uncompressed_data) {
     log_message(LOG_LEVEL_ERROR, "Failed to allocate decompression buffer");

src/shared/config.c

@@ -8,21 +8,57 @@
 #include <stdlib.h>
 #include <string.h>
 
-Config* config_create(void) {
+Config* config_create(char* version, char* send_directory, char* receive_directory,
-  Config* config = calloc(1, sizeof(Config));
+                      bool save_to_disk, bool use_multithreading, bool use_chunk_serialization,
+                      bool use_compression, bool use_metadata, int compression_level,
+                      bool use_sendfile, unsigned long long chunk_size) {
+
+  Config* config = malloc(sizeof(Config));
   if (!config)
     return NULL;
-  config->version = str_dup(PROTOCOL_VERSION);
+  config->version = version;
-  config->compression_level = 5;
+  config->send_directory = send_directory;
-  config->chunk_size = DEFAULT_CHUNK_SIZE;
+  config->receive_root_directory = receive_directory;
+  config->save_to_disk = save_to_disk;
+  config->use_multithreading = use_multithreading;
+  config->use_chunk_serialization = use_chunk_serialization;
+  config->use_compression = use_compression;
+  config->use_metadata = use_metadata;
+  config->show_progress = false;
+  config->dry_run = false;
+  config->use_delete = false;
+  config->compression_level = compression_level;
+  config->use_sendfile = use_sendfile;
+  config->chunk_size = chunk_size > 0 ? chunk_size : DEFAULT_CHUNK_SIZE;
   config->ssh_port = 22;
-  config->server_port = 8080;
+  config->transport = TRANSPORT_TCP;
-  config->server_host = str_dup("127.0.0.1");
+  config->ssh_destination = NULL;
-  config->timeout = 30;
+  config->fastsync_server_path = NULL;
-  config->contimeout = 10;
+  config->exclude_patterns = NULL;
-  config->queue_size = 100;
+  config->exclude_count = 0;
+  config->include_patterns = NULL;
+  config->include_count = 0;
+  config->max_size = 0;
+  config->min_size = 0;
+  config->use_incremental = false;
+  config->use_delta = false;
   config->delta_block_size = DELTA_BLOCK_SIZE_DEFAULT;
   config->delta_max_file_size = DELTA_MAX_FILE_SIZE;
+  config->use_tls = false;
+  config->tls_cert = NULL;
+  config->tls_key = NULL;
+  config->tls_ca = NULL;
+  config->server_host = str_dup("127.0.0.1");
+  config->server_port = 8080;
+  config->timeout = 30;
+  config->contimeout = 10;
+  config->quiet = false;
+  config->backup = false;
+  config->backup_dir = NULL;
+  config->stats = false;
+  config->max_depth = 0;
+  config->log_file = NULL;
+  config->queue_size = 100;
   return config;
 }
 

src/shared/config.h

@@ -58,7 +58,10 @@ typedef struct Config {
 #define PROTOCOL_VERSION "1.3.0"
 #define DEFAULT_CHUNK_SIZE (10 * 1024 * 1024)
 
-Config* config_create(void);
+Config* config_create(char* version, char* send_directory, char* receive_directory,
+                      bool save_to_disk, bool use_multithreading, bool use_chunk_serialization,
+                      bool use_compression, bool use_metadata, int compression_level,
+                      bool use_sendfile, unsigned long long chunk_size);
 void config_delete(Config* config);
 bool config_send(int file_descriptor, const Config* config);
 Config* config_receive(int file_descriptor);

src/shared/delta.c

@@ -1,5 +1,6 @@
 #include "delta.h"
 #include "log.h"
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
@@ -7,6 +8,10 @@
 #define XXH_IMPLEMENTATION
 #include <xxhash.h>
 
+/* Maximum number of blocks/instructions allowed from the wire to prevent OOM */
+#define MAX_DELTA_BLOCKS       (1024U * 1024U)   /* 1M signature blocks */
+#define MAX_DELTA_INSTRUCTIONS (1024U * 1024U)   /* 1M delta instructions */
+
 uint32_t delta_adler32(const void* data, uint32_t len) {
   const uint8_t* p = (const uint8_t*)data;
   uint32_t s1 = 1;
@@ -101,6 +106,14 @@ DeltaSignature* delta_signature_deserialize(const Data* data) {
   memcpy(&sig->block_count, buf + pos, sizeof(uint32_t));
   pos += sizeof(uint32_t);
 
+  // Reject unreasonably large block counts to prevent OOM
+  if (sig->block_count > MAX_DELTA_BLOCKS) {
+    log_message(LOG_LEVEL_ERROR, "Delta signature block count %u exceeds maximum %u",
+                sig->block_count, MAX_DELTA_BLOCKS);
+    free(sig);
+    return NULL;
+  }
+
   uint64_t expected = sizeof(uint64_t) + sizeof(uint32_t) + sizeof(uint32_t) +
                       (uint64_t)sig->block_count * (sizeof(uint32_t) + sizeof(uint32_t));
   if (data->size < expected) {
@@ -340,6 +353,14 @@ Delta* delta_deserialize(const Data* data) {
   memcpy(&delta->instruction_count, buf + pos, sizeof(uint32_t));
   pos += sizeof(uint32_t);
 
+  // Reject unreasonably large instruction counts to prevent OOM
+  if (delta->instruction_count > MAX_DELTA_INSTRUCTIONS) {
+    log_message(LOG_LEVEL_ERROR, "Delta instruction count %u exceeds maximum %u",
+                delta->instruction_count, MAX_DELTA_INSTRUCTIONS);
+    free(delta);
+    return NULL;
+  }
+
   delta->instructions = malloc(delta->instruction_count * sizeof(DeltaInstruction));
   if (!delta->instructions) {
     free(delta);

src/shared/file.c

@@ -134,9 +134,64 @@ bool file_save_to_disk(const char* root_directory, File* file, const Config* con
     log_message(LOG_LEVEL_ERROR, "Path traversal detected in file path: %s", file->path);
     return false;
   }
-  char* disk_path = path_cat((char*)root_directory, file->path);
+
-  if (disk_path == NULL)
+  // Resolve the destination root to its real path, preventing symlink-based escapes.
+  // If the root does not yet exist, try to create it so realpath can succeed.
+  char* resolved_root = realpath(root_directory, NULL);
+  if (resolved_root == NULL) {
+    if (mkdir_r(root_directory)) {
+      resolved_root = realpath(root_directory, NULL);
+    }
+  }
+  if (resolved_root == NULL) {
+    log_message(LOG_LEVEL_ERROR, "Failed to resolve destination root: %s", root_directory);
     return false;
+  }
+
+  char* disk_path = path_cat(resolved_root, file->path);
+  if (disk_path == NULL) {
+    free(resolved_root);
+    return false;
+  }
+
+  // Ensure the target directory exists so the parent can be resolved for path safety.
+  char* dir_dup = str_dup(disk_path);
+  if (!dir_dup) {
+    free(resolved_root);
+    free(disk_path);
+    return false;
+  }
+  char* dir_str = dirname(dir_dup);
+  // Create the directory if needed (no-op if it already exists) so realpath can resolve it.
+  if (!mkdir_r(dir_str)) {
+    free(dir_dup);
+    free(resolved_root);
+    free(disk_path);
+    return false;
+  }
+  char* resolved_dir = realpath(dir_str, NULL);
+  free(dir_dup);
+  if (resolved_dir == NULL) {
+    log_message(LOG_LEVEL_ERROR, "Failed to resolve directory for: %s", disk_path);
+    free(resolved_root);
+    free(disk_path);
+    return false;
+  }
+
+  // Verify that the resolved directory is inside the resolved root.
+  // Both are canonical absolute paths — this prevents symlink-based escapes.
+  size_t root_len = strlen(resolved_root);
+  if (strncmp(resolved_dir, resolved_root, root_len) != 0 ||
+      (resolved_dir[root_len] != '\0' && resolved_dir[root_len] != '/')) {
+    log_message(LOG_LEVEL_ERROR, "Path escape detected: %s is outside %s", disk_path, root_directory);
+    free(resolved_dir);
+    free(resolved_root);
+    free(disk_path);
+    return false;
+  }
+  free(resolved_dir);
+  free(resolved_root);
+
   bool ok = to_disk(disk_path, file->data->data, file->data->size);
   if (ok)
     file_restore_metadata(disk_path, file->metadata);
@@ -341,7 +396,7 @@ File* receive_incremental_check(int fd, const Config* config, bool* skipped) {
 
   char* full_path = path_cat(config->receive_root_directory, check_path);
   struct stat st;
-  bool has_old_file = (full_path && stat(full_path, &st) == 0);
+  bool has_old_file = (full_path && lstat(full_path, &st) == 0);
   unsigned long long old_size = has_old_file ? (unsigned long long)st.st_size : 0;
 
   bool match = has_old_file && (unsigned long long)st.st_size == check_size &&

src/shared/protocol.c

@@ -9,7 +9,7 @@
 #include <time.h>
 #include <unistd.h>
 
-#define MAX_DATA_SIZE (256ULL * 1024 * 1024)          /* 256 MB max per message */
+#define MAX_DATA_SIZE (100ULL * 1024 * 1024)          /* 100 MB max per data message */
 #define RECEIVE_TIMEOUT_SEC 60                        /* 60 second per-message timeout */
 #define MAX_CONNECTION_MEMORY (1024ULL * 1024 * 1024) /* 1 GB total per connection */
 
@@ -186,9 +186,9 @@ char* receive_str(int file_descriptor) {
   size_t size;
   if (!receive_n_data(file_descriptor, &size, sizeof(size_t)))
     return NULL;
-  if (size > MAX_DATA_SIZE) {
+  if (size > MAX_STRING_SIZE) {
     log_message(LOG_LEVEL_ERROR, "String size %zu exceeds maximum %llu", size,
-                (unsigned long long)MAX_DATA_SIZE);
+                (unsigned long long)MAX_STRING_SIZE);
     return NULL;
   }
   char* data = (char*)malloc(size + 1);

src/shared/protocol.h

@@ -5,8 +5,11 @@
 #include <stdbool.h>
 #include <stddef.h>
 
-/* Maximum allowed string size for receive_str (10 MB) */
+/* Maximum allowed string size for receive_str (64 KB) */
-#define MAX_STRING_SIZE (10 * 1024 * 1024)
+#define MAX_STRING_SIZE (64 * 1024)
+
+/* Maximum allowed data payload size for receive_data (100 MB) */
+#define MAX_DATA_PAYLOAD_SIZE (100ULL * 1024 * 1024)
 
 typedef struct ssl_st SSL;
 

src/shared/transport_tls.c

@@ -79,25 +79,38 @@ static SSL_CTX* create_ssl_ctx(bool is_server, const char* cert, const char* key
   return ctx;
 }
 
-static SSL* wrap_fd_with_ssl(int fd, SSL_CTX* ctx, bool is_server) {
+static SSL* wrap_fd_with_ssl(int fd, SSL_CTX* ctx, bool is_server, const char* hostname) {
   SSL* ssl = SSL_new(ctx);
   if (!ssl) {
     log_message(LOG_LEVEL_ERROR, "Failed to create SSL object");
     return NULL;
   }
   SSL_set_fd(ssl, fd);
+
+  // Enable hostname verification for client connections when a hostname is provided.
+  // Must be done before SSL_connect to take effect during the handshake.
+  if (!is_server && hostname) {
+    SSL_set1_host(ssl, hostname);
+  }
+
+  // Retry SSL_accept/SSL_connect on WANT_READ/WANT_WRITE (non-blocking handshake)
   int ret;
+  do {
     if (is_server)
       ret = SSL_accept(ssl);
     else
       ret = SSL_connect(ssl);
 
     if (ret <= 0) {
+      int ssl_err = SSL_get_error(ssl, ret);
+      if (ssl_err == SSL_ERROR_WANT_READ || ssl_err == SSL_ERROR_WANT_WRITE)
+        continue;
       log_message(LOG_LEVEL_ERROR, "SSL %s failed", is_server ? "accept" : "connect");
       log_ssl_errors();
       SSL_free(ssl);
       return NULL;
     }
+  } while (ret <= 0);
   return ssl;
 }
 
@@ -117,7 +130,7 @@ struct tls_child_ctx {
 
 static void tls_child_fn(int fd, void* arg) {
   struct tls_child_ctx* ctx = (struct tls_child_ctx*)arg;
-  SSL* ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true);
+  SSL* ssl = wrap_fd_with_ssl(fd, ctx->ssl_ctx, true, NULL);
   if (!ssl)
     return;
   io_set_ssl(ssl);
@@ -151,12 +164,16 @@ bool client_connect_tls(Client* client, char* host, int port, const char* cert_p
     return false;
   client->ssl_ctx = ctx;
 
-  SSL* ssl = wrap_fd_with_ssl(client->file_descriptor, ctx, false);
+  // Pass the server hostname for TLS hostname verification (SSL_set1_host
+  // is called inside wrap_fd_with_ssl before the handshake when ca_path is set).
+  const char* verify_host = ca_path ? host : NULL;
+  SSL* ssl = wrap_fd_with_ssl(client->file_descriptor, ctx, false, verify_host);
   if (!ssl) {
     SSL_CTX_free(ctx);
     client->ssl_ctx = NULL;
     return false;
   }
+
   client->ssl = ssl;
   io_set_ssl(ssl);
   return true;

src/shared/utils.c

@@ -126,7 +126,13 @@ static void delete_extras_walk(const char* abs_path, const char* rel_path, Array
     char* child_abs = path_cat((char*)abs_path, entry->d_name);
     char* child_rel = path_cat((char*)rel_path, entry->d_name);
     struct stat st;
-    if (stat(child_abs, &st) != 0) {
+    if (lstat(child_abs, &st) != 0) {
+      free(child_abs);
+      free(child_rel);
+      continue;
+    }
+    // Skip symlinks to prevent following them outside the destination tree
+    if (S_ISLNK(st.st_mode)) {
       free(child_abs);
       free(child_rel);
       continue;

tests/integration/test_tls.py

@@ -37,15 +37,23 @@ def _generate_certs(cert_dir):
     ], check=True, capture_output=True)
 
     # Server key + CSR + cert (signed by CA)
+    # Use a config file to include IP SAN 127.0.0.1 so hostname verification passes
+    san_config = os.path.join(cert_dir, "server_san.conf")
+    with open(san_config, "w") as f:
+        f.write("[req]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n\n")
+        f.write("[req_distinguished_name]\nCN = localhost\n\n")
+        f.write("[v3_req]\nsubjectAltName = @alt_names\n\n")
+        f.write("[alt_names]\nDNS.1 = localhost\nIP.1 = 127.0.0.1\n")
     subprocess.run([
         "openssl", "req", "-newkey", "rsa:2048", "-nodes",
         "-keyout", server_key, "-out", os.path.join(cert_dir, "server.csr"),
-        "-subj", "/CN=localhost",
+        "-subj", "/CN=localhost", "-config", san_config,
     ], check=True, capture_output=True)
     subprocess.run([
         "openssl", "x509", "-req", "-in", os.path.join(cert_dir, "server.csr"),
         "-CA", ca_cert, "-CAkey", ca_key, "-CAcreateserial",
         "-out", server_cert, "-days", "1",
+        "-extfile", san_config, "-extensions", "v3_req",
     ], check=True, capture_output=True)
 
     # Client key + CSR + cert (signed by CA)

tests/test_config.c

@@ -7,17 +7,9 @@
 #include <stdlib.h>
 
 static void test_config_lifecycle() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/dst"), true, true, false,
+                              false, false, 1, false, 0);
   EXPECT_NOT_NULL(cfg);
-  free(cfg->version);
-  cfg->version = str_dup("1.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/dst");
-  cfg->save_to_disk = true;
-  cfg->use_multithreading = true;
-  cfg->use_chunk_serialization = false;
-  cfg->use_compression = false;
-  cfg->compression_level = 1;
   EXPECT_EQ_STR(cfg->version, "1.0");
   EXPECT_EQ_STR(cfg->send_directory, "/src");
   EXPECT_EQ_STR(cfg->receive_root_directory, "/dst");
@@ -31,14 +23,9 @@ static void test_config_lifecycle() {
 }
 
 static void test_config_ssh_dest() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("user@host:/dst"), true,
+                              false, false, false, false, 1, false, 0);
   EXPECT_NOT_NULL(cfg);
-  free(cfg->version);
-  cfg->version = str_dup("1.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("user@host:/dst");
-  cfg->save_to_disk = true;
-  cfg->compression_level = 1;
   EXPECT_EQ_INT(cfg->transport, TRANSPORT_TCP);
   EXPECT_NULL(cfg->ssh_destination);
   EXPECT_EQ_STR(cfg->receive_root_directory, "user@host:/dst");
@@ -51,14 +38,8 @@ static void test_config_ssh_dest() {
 }
 
 static void test_config_ssh_dest_local_path() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/local/path"), true, false,
-  EXPECT_NOT_NULL(cfg);
+                              false, false, false, 1, false, 0);
-  free(cfg->version);
-  cfg->version = str_dup("1.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/local/path");
-  cfg->save_to_disk = true;
-  cfg->compression_level = 1;
   config_parse_ssh_dest(cfg);
   EXPECT_EQ_INT(cfg->transport, TRANSPORT_TCP);
   EXPECT_NULL(cfg->ssh_destination);
@@ -67,14 +48,8 @@ static void test_config_ssh_dest_local_path() {
 }
 
 static void test_config_ssh_dest_no_user() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("host:/remote"), true, false,
-  EXPECT_NOT_NULL(cfg);
+                              false, false, false, 1, false, 0);
-  free(cfg->version);
-  cfg->version = str_dup("1.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("host:/remote");
-  cfg->save_to_disk = true;
-  cfg->compression_level = 1;
   config_parse_ssh_dest(cfg);
   EXPECT_EQ_INT(cfg->transport, TRANSPORT_SSH);
   EXPECT_EQ_STR(cfg->ssh_destination, "host:/remote");
@@ -83,14 +58,8 @@ static void test_config_ssh_dest_no_user() {
 }
 
 static void test_pipeline_sender_lifecycle() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("2.0"), str_dup("/src2"), str_dup("/dst2"), false, false,
-  free(cfg->version);
+                              true, true, false, 1, false, 0);
-  cfg->version = str_dup("2.0");
-  cfg->send_directory = str_dup("/src2");
-  cfg->receive_root_directory = str_dup("/dst2");
-  cfg->use_chunk_serialization = true;
-  cfg->use_compression = true;
-  cfg->compression_level = 1;
   Queue* q1 = queue_create(5, NULL);
   Queue* q2 = queue_create(15, NULL);
 
@@ -106,16 +75,8 @@ static void test_pipeline_sender_lifecycle() {
 }
 
 static void test_pipeline_receiver_lifecycle() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("3.0"), str_dup("/src3"), str_dup("/dst3"), true, true, true,
-  free(cfg->version);
+                              true, false, 1, false, 0);
-  cfg->version = str_dup("3.0");
-  cfg->send_directory = str_dup("/src3");
-  cfg->receive_root_directory = str_dup("/dst3");
-  cfg->save_to_disk = true;
-  cfg->use_multithreading = true;
-  cfg->use_chunk_serialization = true;
-  cfg->use_compression = true;
-  cfg->compression_level = 1;
   Queue* q = queue_create(20, NULL);
 
   PipelineContextReceiver* pcr = pipeline_context_receiver_create(cfg, q, 42);

tests/test_file.c

@@ -154,9 +154,8 @@ static void test_file_send_receive() {
   memcpy(file->data->data, content, len);
   file->data->size = len;
 
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup(PROTOCOL_VERSION), str_dup("/tmp"), str_dup("/tmp"), false,
-  cfg->send_directory = str_dup("/tmp");
+                              false, false, false, false, 0, false, 0);
-  cfg->receive_root_directory = str_dup("/tmp");
 
   int p[2];
   EXPECT_EQ_INT(pipe(p), 0);

tests/test_file_sendfile.c

@@ -22,10 +22,9 @@ static void test_sendfile_basic() {
   /* Set the size so file_send_sendfile can report it */
   file->data->size = len;
 
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup(PROTOCOL_VERSION), str_dup("/tmp"), str_dup("/tmp"), false,
+                              false, false, false, false, 0, false, 0);
   EXPECT_NOT_NULL(cfg);
-  cfg->send_directory = str_dup("/tmp");
-  cfg->receive_root_directory = str_dup("/tmp");
 
   int p[2];
   EXPECT_EQ_INT(pipe(p), 0);
@@ -81,10 +80,9 @@ static void test_sendfile_empty_file() {
   EXPECT_NOT_NULL(file);
   file->data->size = 0;
 
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup(PROTOCOL_VERSION), str_dup("/tmp"), str_dup("/tmp"), false,
+                              false, false, false, false, 0, false, 0);
   EXPECT_NOT_NULL(cfg);
-  cfg->send_directory = str_dup("/tmp");
-  cfg->receive_root_directory = str_dup("/tmp");
 
   int p[2];
   EXPECT_EQ_INT(pipe(p), 0);
@@ -93,7 +91,6 @@ static void test_sendfile_empty_file() {
 
   pid_t pid = fork();
   if (pid == 0) {
-    /* Child: receive */
     close(p[1]);
     File* received = file_receive(cfg, p[0]);
     close(p[0]);
@@ -164,12 +161,9 @@ static void test_sendfile_compression_fallback() {
   file->data->size = (size_t)st.st_size;
   EXPECT_TRUE(file_load_data(file));
 
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup(PROTOCOL_VERSION), str_dup("/tmp"), str_dup("/tmp"), false,
+                              false, false, true, false, 3, false, 0);
   EXPECT_NOT_NULL(cfg);
-  cfg->send_directory = str_dup("/tmp");
-  cfg->receive_root_directory = str_dup("/tmp");
-  cfg->use_compression = true;
-  cfg->compression_level = 3;
 
   int p[2];
   EXPECT_EQ_INT(pipe(p), 0);
@@ -178,7 +172,6 @@ static void test_sendfile_compression_fallback() {
 
   pid_t pid = fork();
   if (pid == 0) {
-    /* Child: receive */
     close(p[1]);
     File* received = file_receive(cfg, p[0]);
     close(p[0]);

tests/test_multiprocessing.c

@@ -8,12 +8,9 @@
 
 /* Test pipeline_context_sender_create/destroy with valid arguments */
 static void test_sender_create_destroy() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("1.0"), str_dup("/src"), str_dup("/dst"), false, false, false,
+                              false, false, 0, false, 0);
   EXPECT_NOT_NULL(cfg);
-  free(cfg->version);
-  cfg->version = str_dup("1.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/dst");
 
   Queue* q_scanner = queue_create(5, NULL);
   EXPECT_NOT_NULL(q_scanner);
@@ -35,14 +32,9 @@ static void test_sender_create_destroy() {
 
 /* Test pipeline_context_receiver_create/destroy with valid arguments */
 static void test_receiver_create_destroy() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("2.0"), str_dup("/src"), str_dup("/dst"), true, true, false,
+                              false, false, 0, false, 0);
   EXPECT_NOT_NULL(cfg);
-  free(cfg->version);
-  cfg->version = str_dup("2.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/dst");
-  cfg->save_to_disk = true;
-  cfg->use_multithreading = true;
 
   Queue* q = queue_create(20, NULL);
   EXPECT_NOT_NULL(q);
@@ -59,12 +51,9 @@ static void test_receiver_create_destroy() {
 
 /* Test that create handles various queue capacities */
 static void test_sender_queue_capacities() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("3.0"), str_dup("/src"), str_dup("/dst"), false, false, false,
+                              false, false, 0, false, 0);
   EXPECT_NOT_NULL(cfg);
-  free(cfg->version);
-  cfg->version = str_dup("3.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/dst");
 
   /* Single-element queues */
   Queue* q1 = queue_create(1, NULL);
@@ -78,12 +67,9 @@ static void test_sender_queue_capacities() {
 
 /* Test that create handles zero-capacity queues */
 static void test_sender_zero_capacity() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("4.0"), str_dup("/src"), str_dup("/dst"), false, false, false,
+                              false, false, 0, false, 0);
   EXPECT_NOT_NULL(cfg);
-  free(cfg->version);
-  cfg->version = str_dup("4.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/dst");
 
   Queue* q1 = queue_create(0, NULL);
   Queue* q2 = queue_create(0, NULL);
@@ -96,11 +82,8 @@ static void test_sender_zero_capacity() {
 
 /* Test receiver with zero file_descriptor */
 static void test_receiver_fd_zero() {
-  Config* cfg = config_create();
+  Config* cfg = config_create(str_dup("5.0"), str_dup("/src"), str_dup("/dst"), false, false, false,
-  free(cfg->version);
+                              false, false, 0, false, 0);
-  cfg->version = str_dup("5.0");
-  cfg->send_directory = str_dup("/src");
-  cfg->receive_root_directory = str_dup("/dst");
   Queue* q = queue_create(5, NULL);
   PipelineContextReceiver* ctx = pipeline_context_receiver_create(cfg, q, 0);
   EXPECT_NOT_NULL(ctx);