Learn Rsync - Rsync 3.4.x & Latest Features

#Introduction

Throughout this series you've been asked to use rsync ≥3.4.4. Episode 17 answers the unfinished question: what actually changed in 3.4.x? It's not just "more secure" — there are internal design decisions that affect how rsync processes arguments and symlinks. Understanding this matters so you aren't surprised by behavior changes when upgrading.

The three pillars of 3.4.x: security hardening, the --safe-links fix, and the argument parser overhaul. Let's dissect each one.

#The 3.4.x Journey

The big picture: since 3.4.0, the rsync project shifted modes — from "adding features" to "fixing the foundation". Every subsequent release closes newly found holes discovered after the big security release.

#Security Hardening

The hardening in 3.4.x touches layers you rarely see:

• Buffer handling — every point processing network data was re-audited; the CVE-2024-12084 heap overflow is an example of what was looked for and fixed.
• Info leaks — the paths leaking stack/memory data (CVE-2024-12085, CVE-2026-29518) were closed.
• Stricter configuration — defaults and daemon input validation were improved.
• Comprehensive audit — many small changes that don't show up in the changelog, but reduce the attack surface.

The biggest lesson: nearly 30-year-old transfer code requires continuous security maintenance — and that's what makes the latest patch version mandatory, not optional.

#The --safe-links Fix

--safe-links is the option that ignores symlinks pointing outside the transfer directory (e.g. /etc/passwd or ../../server-root). Its purpose is to stop backups from pulling files outside the source tree.

In 3.4.x, the --safe-links implementation was overhauled because the old version could be bypassed. The new behavior is stricter at detecting absolute symlinks and symlinks with .. traversal. Impact for you: if you use --safe-links, some symlinks that previously "passed" may now be ignored — check the backup output after upgrading and make sure legitimate symlinks (those pointing inside the tree) are still synced.

#The Internal Argument Parser Overhaul

Behind the scenes, 3.4.x rewrote rsync's internal argument parser. This isn't just cosmetic: the old parser had inconsistent behavior and security gaps in how it handled options. The rewrite makes parsing stricter, errors clearer, and behavior more predictable.

Impacts you might feel:

• More explicit usage errors when an option is wrong.
• Options that were previously "accepted but ignored" are now rejected.
• Ambiguous option combinations are handled more firmly.

If an old rsync script suddenly shows errors after upgrading, this is likely the cause — the parser now rejects what it previously tolerated. Read the error message, fix the options, and update the script.

#Other Features and Fixes

Besides the three pillars above, 3.4.x brings general quality improvements:

• Better accuracy and clarity of error messages.
• Fixes in daemon mode and configuration handling.
• Checksum and protocol interop fixes across versions.
• Performance fixes in several paths (including use of modern xxHash).

There are no major new features — and that's actually good news. Rsync in 3.4.x is the most mature, most secure, and most stable version in its history.

#Verifying Your Version

How to check the version you're using:

rsync --version | head -3

rsync  version 3.4.4  protocol version 31
Copyright (C) 1996-2026 by Andrew Tridgell, Wayne Davison, and others.
Web site: https://rsync.samba.org/

The first line contains the version and protocol version. Audit habit: collect the version from all servers, compare with the latest release at download.samba.org/pub/rsync/NEWS.

#Ensuring Your Distro Backports Fixes

The classic problem: LTS distros pin an old rsync version and apply fixes silently (backporting). As a result, rsync --version still prints 3.2.7, even though security-wise it's equivalent to 3.4.x.

How to check whether your distro backports:

apt changelog rsync            # Debian/Ubuntu
dnf updateinfo list rsync      # RHEL/Fedora

If the changelog contains CVE entries (CVE-2024-12084, etc.) at the same version, the distro backports — safe. If not, and the version is still old, don't assume it's safe: build a static rsync ≥3.4.4 (from source) or install the package from a newer repo.

#Closing

In this episode you've understood what's actually inside rsync 3.4.x.

Key takeaways:

• 3.4.x = major security hardening: buffer handling, info leaks, input validation.
• --safe-links was overhauled — stricter behavior; check backups after upgrading.
• The argument parser was rewritten — stricter errors; old scripts may need adjusting.
• No major features — a focus on stability and security.
• Verify with rsync --version; make sure your distro really backports fixes.

In episode 18 we level up: performance tuning for large datasets — --whole-file for fast networks vs delta for slow ones, parallelism with multiple rsyncs per shard, NIC/disk benchmarks, plus case studies of MongoDB/Postgres data dirs, media libraries, and TB-level datasets. See you in episode 18!