`rsync-ssl` breaking with openssl 3.6.2

[christian-heusel]

Hello everyone, thanks for maintaining rsync 👋🏻 🥳

We're using rsync-ssl in Arch Linux for mirror synchronization and when upgrading our server fleet we noticed that all synchronizations failed with the following error when upgrading openssl to 3.6.2:

Apr 11 13:09:07 mirror.pkgbuild.com systemd[1]: Starting Synchronize repo mirror...
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7055]: verify depth is 4
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7055]: Connecting to 2a01:4f8:251:598::
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7054]: receiving file list ... done
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7057]: rsync: connection unexpectedly closed (4154299 bytes received so far) [receiver]
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7057]: rsync error: error in rsync protocol data stream (code 12) at io.c(232) [receiver=3.4.1]
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7054]: rsync: [generator] write error: Broken pipe (32)
Apr 11 13:09:08 mirror.pkgbuild.com syncrepo[7054]: rsync error: error in socket IO (code 10) at io.c(849) [generator=3.4.1]
Apr 11 13:09:08 mirror.pkgbuild.com systemd[1]: syncrepo.service: Main process exited, code=exited, status=10/n/a
Apr 11 13:09:08 mirror.pkgbuild.com systemd[1]: syncrepo.service: Failed with result 'exit-code'.
Apr 11 13:09:08 mirror.pkgbuild.com systemd[1]: Failed to start Synchronize repo mirror.

When downgrading back to 3.6.1 everything worked again. Any idea how we could start to debug this in more detail? Adding any verbosity flags didn't show more useful information. 🤔

The script that we're using rsync with is the following:

#!/bin/bash

target="/srv/ftp"
lock="/run/lock/syncrepo.lck"
source_url='rsync://rsync.archlinux.org/ftp_tier1'
lastupdate_url='https://rsync.archlinux.org/lastupdate'

[ ! -d "${target}" ] && mkdir -p "${target}"

exec 9>"${lock}"
flock -n 9 || exit

rsync_cmd() {
        local -a cmd=(rsync-ssl --type=openssl --verbose -rlptH --safe-links --delete-delay --delay-updates
                "--timeout=600" --no-motd)

        if stty &>/dev/null; then
                cmd+=(-h -v --progress)
        else
                cmd+=("--info=name1")
        fi

        "${cmd[@]}" "$@"
}

# if we are called without a tty (cronjob) only run when there are changes
if ! tty -s && [[ -f "$target/lastupdate" ]] && diff -b <(curl -Ls "$lastupdate_url") "$target/lastupdate" >/dev/null; then
        # keep lastsync file in sync for statistics generated by the Arch Linux website
        rsync_cmd "$source_url/lastsync" "$target/lastsync"
        exit 0
fi

rsync_cmd \
        --exclude="/other" \
        --exclude="/sources" \
        --exclude="*-debug/" \
        "${source_url}" "${target}"

If you're interested, here is the incident in detail: https://gitlab.archlinux.org/archlinux/infrastructure/-/issues/818

cc @klausenbusk @Eworm @jelle