RSYNC
RSYNC has been the de-facto protocol for the distribution of RPKI objects since the beginning. It allows Relying Party software to connect to RPKI repositories to synchronize a local copy by downloading the certificates, RPKI-signed objects (ROAs), manifest and CRLs files. While RSYNC has served its initial purpose of providing synchronization in the early stages of RPKI deployment, it has proved to be operationally unfit for a number of reasons (as per RFC 8182):
- RSYNC is designed to limit the amount of data that needs to be transferred between client and server. However, the server needs to spend significant resources in terms of CPU and memory for every connection. This is a problem in an envisioned RPKI deployment where thousands of Relying Parties query a small number of central repositories, and it makes these repositories weak to denial-of-service attacks.
- A secondary concern is the lack of supported rsync server and client libraries. In practice, all implementations have to make system calls to an rsync binary. This is inefficient; it introduces fragility with regards to updates of this binary, makes it difficult to catch and report problems to operators, and complicates software development and testing.
Read more: RPKI Delta Protocol (RRDP) as a future replacement of rsync in RPKI
