A native AFP server — afpd

1Protocol surface

Transport: DSI over TCP 548. A fixed 16-byte DSI header frames every message; small command set, all MVP: OpenSession/CloseSession, Command (carries AFP requests), Write, GetStatus (pre-login server info), Tickle (keepalive), Attention (server→client). Skip AppleTalk entirely — DSI-over-TCP covers AFP 2.2 onward.

Versions: target AFP 3.x primary (advertise AFP3.1–AFP3.4) — TCP-only, UTF-8 filenames, POSIX permissions, 64-bit forks; AFP 3.4 is a minor error-code tweak. Add AFP 2.2 (AFPX03) secondary for System 7 → OS 9 (31-byte Mac-Roman names). [U] the earliest classic Mac OS that speaks AFP-over-TCP vs AppleTalk-only — very early System 7 may be AppleTalk-only, which this server won't serve.

Minimal viable AFP command set

2Authentication (UAMs) — arm's-length via PAM

AFP auth is a pluggable UAM challenge/response in FPLogin+FPLoginCont. Implementation order:

1. DHX2 ("DHX2") — the modern default: 1024-bit Diffie-Hellman, session key MD5(K), CAST5-CBC, fixed IVs, a 16-byte nonce exchange for mutual auth. Crypto via LibreSSL/OpenSSL BN+EVP (BSD-friendly), not libgcrypt (LGPL — netatalk's choice; pick differently to stay clean-room).
2. Cleartext ("Cleartxt Passwrd") — 8-char, for System 7 → OS 9 that can't do DHX2. Gate behind opt-in.
3. DHX ("DHCAST128") — bridges OS 9 / early OS X. Optional if DHX2+cleartext cover the matrix.
4. Kerberos v5 / GSSAPI — v0.2, needs a KDC.

3Fork storage — the crux (UFS-EA · AppleDouble · HFS+-native)

Every AFP object has a data fork, a resource fork, and Finder info (+ a stable CNID) that the server must serve regardless of backing FS. One interface, swappable backends — this is the whole point: the DSI/AFP engine never knows which is underneath.

struct fork_backend {
    ssize_t (*rsrc_read/write)(vol, path, off, buf, len);
    int     (*finderinfo_get/set)(vol, path, uint8_t fi[32]);
    int     (*meta_get/set)(vol, path, struct afp_meta*);   /* AFP flags, comment, CNID */
};

CNID (Catalog Node ID) — AFP needs a stable 32-bit file ID surviving renames/moves. UFS inodes are stable but 64-bit + reused, so a persistent map is required: SQLite (public domain) per-volume .cnid.db. A real subsystem (allocation, rename tracking, orphan reaping), not a stub. ACLs — AFP's NFSv4-style ACEs map almost directly to FreeBSD NFSv4 ACLs on UFS2 (acl_*_file, ACL_TYPE_NFS4). Case — the server is case-policy-neutral; it advertises case-insensitivity in FPGetVolParms only when the backing mount (the UFS casefold patch or HFS+) actually provides it.

4Architecture & placement

launchd (socket-activated, TCP 548)  ─┐   Bonjour: _afpovertcp._tcp via mDNSResponder
                                      ▼
  afpd parent ── accept() ── fork() per connection ── child drops priv to authed user
        │
        ├─ ① DSI transport      (framing, tickle, request/reply demux)          write-new
        ├─ ② AFP command dispatch (FPxxx jump table, per-session state)          write-new
        ├─ ③ UAM engine         (cleartext / DHX2 / DHX) ── PAM ── directoryservicesd
        ├─ ④ VFS / volume layer (path resolve, FPEnumerate, perms)               write-new
        ├─ ⑤ fork_backend vtable (EA · AppleDouble · HFS+-native)                write-new
        └─ ⑥ CNID store         (SQLite per volume)                             reuse+glue

• Location: nextbsd-userland/src/afp/, C, bsd.prog.mk, PROG=afpd, BINDIR=/usr/sbin; man pages as NextBSD-originals. Link mirrors wland + -lpam, the crypto lib, SQLite.
• Session model: per-connection forked child that drops privilege to the authenticated user — per-client memory isolation, OS-enforced permissions as the real user, no shared DHX2 crypto state. More robust than a thread pool. (The directory plan's Mach/dispatch caveats don't bite here — the AFP data path is TCP + kqueue, not Mach.)
• launchd org.nextbsd.afpd with socket activation (Sockets dict, port 548) — not a Mach service. An optional MachServices org.nextbsd.afp can back an afpctl admin CLI (list/kick sessions) the way wlan↔wland talk — but that's management, not the data path.
• Labeling: org.nextbsd.* — Apple's AFP server is closed and net-new here; both ends authored in-tree, so no com.apple.* "fake Apple label."

Reuse vs write-new: reuse — mDNSResponder, OpenPAM + pam_directoryservices + NSS, launchd, LibreSSL (DHX2), SQLite (CNID), FreeBSD extattr/acl/sendfile/flock. Write-new (clean-room, netatalk as design reference only — zero GPL code): the DSI+AFP engine, UAM handshakes, fork abstraction, CNID allocator, config parser.

5Effort & risks