[arch-mirrors] Investigating questionable rsync behavior
Hi everyone, I noticed something strange going on with rsyncd on my mirror but I am not sure if it is an actual issue on my end. Someone able to give advice? The rsyncd reports the following behavior quite often: Apr 10 09:19:40 srv2340 rsyncd[31797]: connect from Y.tld (X.X.X.X) Apr 10 09:19:40 srv2340 rsyncd[31797]: rsync on archlinux/community/os/x86_64/community.db from Y.tld (X.X.X.X) Apr 10 09:19:41 srv2340 rsyncd[31797]: building file list Apr 10 09:19:44 srv2340 rsyncd[31797]: rsync: connection unexpectedly closed (43 bytes received so far) [sender] Apr 10 09:19:44 srv2340 rsyncd[31797]: rsync error: error in rsync protocol data stream (code 12) at io.c(235) [sender=3.1.3] My rsync config: pid file = /run/rsyncd.pid uid = nobody gid = nogroup max connections = 50 socket options = SO_KEEPALIVE [archlinux] path = /path/to/archlinux/ comment = Arch Repository read only = true Is this something I should fix or is it caused by an issue on the users end? Cheers
If you send your host/rsync URI, I can do a test pull from my end. At first glance, it looks like either a client or networking issue. On Sat, Apr 10, 2021, 3:28 AM Easy Lee via arch-mirrors < arch-mirrors@lists.archlinux.org> wrote:
Hi everyone,
I noticed something strange going on with rsyncd on my mirror but I am not sure if it is an actual issue on my end. Someone able to give advice?
The rsyncd reports the following behavior quite often:
Apr 10 09:19:40 srv2340 rsyncd[31797]: connect from Y.tld (X.X.X.X) Apr 10 09:19:40 srv2340 rsyncd[31797]: rsync on archlinux/community/os/x86_64/community.db from Y.tld (X.X.X.X) Apr 10 09:19:41 srv2340 rsyncd[31797]: building file list Apr 10 09:19:44 srv2340 rsyncd[31797]: rsync: connection unexpectedly closed (43 bytes received so far) [sender] Apr 10 09:19:44 srv2340 rsyncd[31797]: rsync error: error in rsync protocol data stream (code 12) at io.c(235) [sender=3.1.3]
My rsync config:
pid file = /run/rsyncd.pid uid = nobody gid = nogroup max connections = 50 socket options = SO_KEEPALIVE
[archlinux] path = /path/to/archlinux/ comment = Arch Repository read only = true
Is this something I should fix or is it caused by an issue on the users end?
Cheers
Hi, Appreciate it. rsync://mirror.easylee.nl On Sun, Apr 11, 2021, at 7:10 AM, Tyler Dence wrote:
If you send your host/rsync URI, I can do a test pull from my end. At first glance, it looks like either a client or networking issue.
On Sat, Apr 10, 2021, 3:28 AM Easy Lee via arch-mirrors <arch-mirrors@lists.archlinux.org> wrote:
Hi everyone,
I noticed something strange going on with rsyncd on my mirror but I am not sure if it is an actual issue on my end. Someone able to give advice?
The rsyncd reports the following behavior quite often:
Apr 10 09:19:40 srv2340 rsyncd[31797]: connect from Y.tld (X.X.X.X) Apr 10 09:19:40 srv2340 rsyncd[31797]: rsync on archlinux/community/os/x86_64/community.db from Y.tld (X.X.X.X) Apr 10 09:19:41 srv2340 rsyncd[31797]: building file list Apr 10 09:19:44 srv2340 rsyncd[31797]: rsync: connection unexpectedly closed (43 bytes received so far) [sender] Apr 10 09:19:44 srv2340 rsyncd[31797]: rsync error: error in rsync protocol data stream (code 12) at io.c(235) [sender=3.1.3]
My rsync config:
pid file = /run/rsyncd.pid uid = nobody gid = nogroup max connections = 50 socket options = SO_KEEPALIVE
[archlinux] path = /path/to/archlinux/ comment = Arch Repository read only = true
Is this something I should fix or is it caused by an issue on the users end?
Cheers
On 4/10/21 3:27 AM, Easy Lee via arch-mirrors wrote:
Hi everyone,
I noticed something strange going on with rsyncd on my mirror but I am not sure if it is an actual issue on my end. Someone able to give advice?
(SNIP) Does this always occur with the same client IP? If so, it sounds like an issue with that client's networking. Namely either a faulty line or, more likely a forged RST. The latter occurs in a good amount of corporate firewalls, particularly to manage bandwidth quota-ing (and happens to be the preferred method the "Great Firewall of China", a.k.a. the firewall component of China's Golden Shield Project, uses to sever connections). That'd be my guess, though, and first step - determine if it's always the same client address or ASN registration. -- brent saner https://square-r00t.net/ GPG info: https://square-r00t.net/gpg-info
Hi, It does seem to happen to the same client IPs. Thank you for pointing me into that direction! I can't reproduce it either from my local machines. On Sun, Apr 11, 2021, at 7:56 AM, brent s. via arch-mirrors wrote:
On 4/10/21 3:27 AM, Easy Lee via arch-mirrors wrote:
Hi everyone,
I noticed something strange going on with rsyncd on my mirror but I am not sure if it is an actual issue on my end. Someone able to give advice?
(SNIP)
Does this always occur with the same client IP? If so, it sounds like an issue with that client's networking. Namely either a faulty line or, more likely a forged RST. The latter occurs in a good amount of corporate firewalls, particularly to manage bandwidth quota-ing (and happens to be the preferred method the "Great Firewall of China", a.k.a. the firewall component of China's Golden Shield Project, uses to sever connections).
That'd be my guess, though, and first step - determine if it's always the same client address or ASN registration.
-- brent saner https://square-r00t.net/ GPG info: https://square-r00t.net/gpg-info
participants (3)
-
brent s.
-
Easy Lee
-
Tyler Dence