Download raw body.
[UPDATE] net/sslh 1.22c -> 2.31.1
On 2026-07-21 13:47, Stuart Henderson wrote:
> On 2026/07/20 15:26, Atanas Vladimirov wrote:
>> +CONFIGURE_STYLE = gnu
>> +
>> +MAKE_ENV += CPPFLAGS="-I${LOCALBASE}/include" \
>> + LDFLAGS="-L${LOCALBASE}/lib"
>
> normally you want these set in CONFIGURE_ENV, but the autoconf foo
> upstream doesn't work properly, so I'll add a comment.
>
>> +MAKE_FLAGS = MAN=sslh.8
>
> since you already patch Makefile.in for a closely related change,
> it would make sense to add that to the patch.
>
>> +sslh accepts HTTPS, SSH, OpenVPN, WireGuard, tinc, XMPP and other
>> +protocols on the same port, demultiplexing them based on probes of
>> +the first packet. This makes it possible to connect to any of these
>> +servers on port 443 (e.g. from inside a corporate firewall, which
>> +almost never blocks port 443) while still serving HTTPS on that
>> +port. TCP and UDP are supported. TLS probing can use SNI and ALPN.
>> +
>> +Three binaries are provided: sslh-fork, sslh-select and sslh-ev
>> +(libev-based, for larger numbers of connections).
>
> I think it's better to provide a bit more information about how one
> would choose between the three options - how about this for now?
>
Thanks, Stuart!
I like your version more than mine :)
Best wishes,
Atanas
>
> Index: pkg/DESCR
> ===================================================================
> RCS file: /cvs/ports/net/sslh/pkg/DESCR,v
> diff -u -p -r1.1.1.1 DESCR
> --- pkg/DESCR 13 Apr 2012 14:14:21 -0000 1.1.1.1
> +++ pkg/DESCR 21 Jul 2026 10:45:33 -0000
> @@ -1,4 +1,12 @@
> -sslh accepts HTTPS, SSH, OpenVPN, tinc and XMPP connections on the
> -same port. This makes it possible to connect to any of these servers
> -on port 443 (e.g. from inside a corporate firewall, which almost
> -never block port 443) while still serving HTTPS on that port.
> +sslh accepts HTTPS, SSH, OpenVPN, WireGuard, tinc, XMPP and other
> +protocols on the same port, demultiplexing them based on probes of
> +the first packet. This makes it possible to connect to any of these
> +servers on port 443 (e.g. from inside a corporate firewall, which
> +almost never blocks port 443) while still serving HTTPS on that
> +port. TCP and UDP are supported. TLS probing can use SNI and ALPN.
> +
> +Three binaries are provided: sslh-fork, sslh-select and sslh-ev.
> +-fork has higher overhead, but processes are isolated and restarts
> +don't disrupt active connections. -select and -ev avoid multiple
> +processes: of the two, -ev should handle load better but is newer;
> +-select is more well-tested.
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/net/sslh/Makefile,v
> diff -u -p -r1.33 Makefile
> --- Makefile 17 Oct 2024 10:50:03 -0000 1.33
> +++ Makefile 21 Jul 2026 10:45:33 -0000
> @@ -1,7 +1,6 @@
> COMMENT = SSL/SSH multiplexer
>
> -DISTNAME = sslh-v1.22c
> -REVISION = 2
> +DISTNAME = sslh-v2.3.1
> PKGNAME = ${DISTNAME:S/-v/-/}
>
> CATEGORIES = security net
> @@ -11,21 +10,23 @@ HOMEPAGE = https://www.rutschle.net/tech
> # GPLv2+
> PERMIT_PACKAGE = Yes
>
> -WANTLIB = c config m pcre2-8
> +WANTLIB = c config ev m pcre2-8
>
> SITES = https://www.rutschle.net/tech/sslh/
>
> LIB_DEPENDS = devel/libconfig \
> + devel/libev \
> devel/pcre2
> TEST_DEPENDS = devel/p5-Conf-Libconfig \
> net/p5-IO-Socket-INET6
>
> -MAKE_FLAGS = CFLAGS="${CFLAGS} -I${LOCALBASE}/include -DLIBPCRE" \
> - LIBS="-L${LOCALBASE}/lib -lconfig -lm -lpcre2-8" \
> - MAN=sslh.8
> -
> +CONFIGURE_STYLE = gnu
> USE_GMAKE = Yes
>
> +# XXX not passed through properly from autoconf
> +MAKE_ENV = CPPFLAGS="-I${LOCALBASE}/include" \
> + LDFLAGS="-L${LOCALBASE}/lib"
> +
> PORTHOME = ${WRKDIST}
>
> do-install:
> @@ -36,8 +37,11 @@ do-install:
> .for p in basic.cfg example.cfg udp.cfg
> ${INSTALL_DATA} ${WRKSRC}/$p ${PREFIX}/share/examples/sslh
> .endfor
> -.for p in sslh-fork sslh-select
> +.for p in sslh-fork sslh-select sslh-ev
> ${INSTALL_PROGRAM} ${WRKSRC}/$p ${PREFIX}/sbin
> .endfor
> +
> +do-test:
> + cd ${WRKSRC}/t && ./run
>
> .include <bsd.port.mk>
> Index: distinfo
> ===================================================================
> RCS file: /cvs/ports/net/sslh/distinfo,v
> diff -u -p -r1.15 distinfo
> --- distinfo 30 Oct 2021 14:51:25 -0000 1.15
> +++ distinfo 21 Jul 2026 10:45:33 -0000
> @@ -1,2 +1,2 @@
> -SHA256 (sslh-v1.22c.tar.gz) =
> jjdC0U7fQRk1DP3Hu5a4kTTZIY620qbh9wiRyhimSbE=
> -SIZE (sslh-v1.22c.tar.gz) = 146950
> +SHA256 (sslh-v2.3.1.tar.gz) =
> UaVRbsXLAYI2M7TYys3u5O+gxW72INHJltT1LKUaYBs=
> +SIZE (sslh-v2.3.1.tar.gz) = 535800
> Index: patches/patch-Makefile
> ===================================================================
> RCS file: patches/patch-Makefile
> diff -N patches/patch-Makefile
> --- patches/patch-Makefile 8 Mar 2022 08:53:51 -0000 1.11
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,12 +0,0 @@
> -Index: Makefile
> ---- Makefile.orig
> -+++ Makefile
> -@@ -95,7 +95,7 @@ echosrv: version.h echosrv-conf.c echosrv.o
> echosrv-co
> - $(CC) $(CFLAGS) $(LDFLAGS) -o echosrv echosrv.o echosrv-conf.o
> argtable3.o $(LIBS)
> -
> - $(MAN): sslh.pod Makefile
> -- pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod |
> gzip -9 - > $(MAN)
> -+ pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod >
> $(MAN)
> -
> - # Create release: export clean tree and tag current
> - # configuration
> Index: patches/patch-Makefile_in
> ===================================================================
> RCS file: patches/patch-Makefile_in
> diff -N patches/patch-Makefile_in
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-Makefile_in 21 Jul 2026 10:45:33 -0000
> @@ -0,0 +1,21 @@
> +Index: Makefile.in
> +--- Makefile.in.orig
> ++++ Makefile.in
> +@@ -16,7 +16,7 @@ PREFIX?=/usr
> + BINDIR?=$(PREFIX)/sbin
> + MANDIR?=$(PREFIX)/share/man/man8
> +
> +-MAN=sslh.8.gz # man page name
> ++MAN=sslh.8 # man page name
> +
> + # End of configuration -- the rest should take care of
> + # itself
> +@@ -105,7 +105,7 @@ echosrv: version.h echosrv-conf.c echosrv.o
> echosrv-co
> + landlock.o: config.h
> +
> + $(MAN): sslh.pod Makefile
> +- pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod |
> gzip -9 - > $(MAN)
> ++ pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod >
> $(MAN)
> +
> + # Create release: export clean tree and tag current
> + # configuration
> Index: patches/patch-basic_cfg
> ===================================================================
> RCS file: /cvs/ports/net/sslh/patches/patch-basic_cfg,v
> diff -u -p -r1.6 patch-basic_cfg
> --- patches/patch-basic_cfg 8 Mar 2022 08:53:51 -0000 1.6
> +++ patches/patch-basic_cfg 21 Jul 2026 10:45:33 -0000
> @@ -1,12 +1,12 @@
> Index: basic.cfg
> --- basic.cfg.orig
> +++ basic.cfg
> -@@ -7,7 +7,7 @@ inetd: false;
> - numeric: false;
> - transparent: false;
> +@@ -5,7 +5,7 @@
> + # example.cfg
> +
> timeout: 2;
> -user: "nobody";
> +user: "_sslh";
> pidfile: "/var/run/sslh.pid";
> - chroot: "/var/empty";
> +
>
> Index: patches/patch-example_cfg
> ===================================================================
> RCS file: /cvs/ports/net/sslh/patches/patch-example_cfg,v
> diff -u -p -r1.6 patch-example_cfg
> --- patches/patch-example_cfg 8 Mar 2022 08:53:51 -0000 1.6
> +++ patches/patch-example_cfg 21 Jul 2026 10:45:33 -0000
> @@ -1,7 +1,7 @@
> Index: example.cfg
> --- example.cfg.orig
> +++ example.cfg
> -@@ -9,7 +9,7 @@ inetd: false;
> +@@ -8,7 +8,7 @@ inetd: false;
> numeric: false;
> transparent: false;
> timeout: 2;
> Index: patches/patch-sslh_pod
> ===================================================================
> RCS file: /cvs/ports/net/sslh/patches/patch-sslh_pod,v
> diff -u -p -r1.11 patch-sslh_pod
> --- patches/patch-sslh_pod 8 Mar 2022 08:53:51 -0000 1.11
> +++ patches/patch-sslh_pod 21 Jul 2026 10:45:33 -0000
> @@ -1,18 +1,21 @@
> Index: sslh.pod
> --- sslh.pod.orig
> +++ sslh.pod
> -@@ -26,17 +26,14 @@ Hence B<sslh> acts as a protocol demultiplexer, or
> a
> +@@ -26,17 +26,17 @@ Hence B<sslh> acts as a protocol demultiplexer, or
> a
> switchboard. Its name comes from its original function to
> serve SSH and HTTPS on the same port.
>
> -=head2 Libwrap support
> -+B<sslh> comes in two versions: B<sslh-fork> forks a new process
> -+for each incoming connection. It is well-tested and very
> -+reliable, but incurs the overhead of many processes. B<sslh-select>
> -+uses only one thread, which monitors all connections at once.
> -+It is more recent and less tested, but only incurs a 16 byte
> -+overhead per connection. Also, if it stops, you'll lose all
> -+connections, which means you can't upgrade it remotely.
> ++B<sslh> comes in three versions: B<sslh-fork> forks a new
> ++process for each incoming connection. It is well-tested and
> ++very reliable, but incurs the overhead of many processes.
> ++B<sslh-select> uses only one thread, which monitors all
> ++connections at once; it only incurs a 16 byte overhead per
> ++connection. B<sslh-ev> is similar to B<sslh-select>, but uses
> ++B<libev> as a backend, which allows managing larger numbers
> ++of connections. If B<sslh-select> or B<sslh-ev> stops, you
> ++will lose all connections, which means you cannot upgrade it
> ++remotely.
>
> -One drawback of B<sslh> is that the servers do not see the
> -original IP address of the client anymore, as the connection
> @@ -26,7 +29,7 @@ Index: sslh.pod
> =head2 Configuration file
>
> A configuration file can be supplied to B<sslh>. Command
> -@@ -209,24 +206,6 @@ Runs in background. This overrides B<foreground>
> if se
> +@@ -213,24 +213,6 @@ Runs in background. This overrides B<foreground>
> if se
> the configuration file (or on the command line, but there is
> no point setting both on the command line unless you have a
> personality disorder).
> Index: patches/patch-t
> ===================================================================
> RCS file: patches/patch-t
> diff -N patches/patch-t
> --- patches/patch-t 8 Mar 2022 08:53:51 -0000 1.5
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,33 +0,0 @@
> -Index: t
> ---- t.orig
> -+++ t
> -@@ -39,8 +39,6 @@ my $RB_OPEN_PID_FILE = 0;
> - my $RB_RESOLVE_ADDRESS = 0;
> - my $RB_CL_PARAMS = 0;
> -
> --`lcov --directory . --zerocounters`;
> --
> - sub verbose_exec
> - {
> - my ($cmd) = @_;
> -@@ -293,7 +291,7 @@ for my $binary (@binaries) {
> - warn "$!\n" unless $cnx_h;
> - if ($cnx_h) {
> - close $cnx_h;
> -- my_is(1, "$binary: Connect and write nothing");
> -+ my_is(1, 1, "$binary: Connect and write nothing");
> - # The goal of the test is to check sslh doesn't
> - # crash
> - }
> -@@ -454,10 +452,7 @@ if ($RB_CL_PARAMS) {
> - my_is($code, 6, "Bad command line parameters");
> - }
> -
> --`lcov --directory . --capture --output-file sslh_cov.info`;
> --`genhtml sslh_cov.info`;
> --
> --`killall echosrv`;
> -+`pkill -q echosrv`;
> -
> -
> - format test_results_top =
> Index: patches/patch-t_run
> ===================================================================
> RCS file: patches/patch-t_run
> diff -N patches/patch-t_run
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ patches/patch-t_run 21 Jul 2026 10:45:33 -0000
> @@ -0,0 +1,21 @@
> +Index: t/run
> +--- t/run.orig
> ++++ t/run
> +@@ -124,7 +124,7 @@ sub start_echosrv
> +
> + sub stop_echosrv
> + {
> +- `killall echosrv` if $started_echosrvs;
> ++ `pkill -q echosrv` if $started_echosrvs;
> + undef $started_echosrvs;
> + }
> +
> +@@ -157,7 +157,7 @@ sub stop_sslh
> + {
> + if (defined $sslh_pid) {
> + kill TERM => $sslh_pid or warn "kill process: $!\n";
> +- `killall sslh-ev sslh-select sslh-fork`;
> ++ `pkill -q sslh-ev sslh-select sslh-fork`;
> + undef $sslh_pid;
> + }
> + }
> Index: patches/patch-test_cfg
> ===================================================================
> RCS file: patches/patch-test_cfg
> diff -N patches/patch-test_cfg
> --- patches/patch-test_cfg 8 Mar 2022 08:53:51 -0000 1.2
> +++ /dev/null 1 Jan 1970 00:00:00 -0000
> @@ -1,23 +0,0 @@
> -Taken from https://github.com/yrutschle/sslh/pull/310.
> -
> -Index: test.cfg
> ---- test.cfg.orig
> -+++ test.cfg
> -@@ -18,7 +18,7 @@ listen:
> - (
> - { host: "localhost"; port: "8080"; keepalive: true; },
> - { host: "localhost"; port: "8081"; keepalive: true; },
> -- { host: "ip4-localhost"; is_udp: true; port: "8086"; }
> -+ { host: "127.0.0.1"; is_udp: true; port: "8086"; }
> - );
> -
> -
> -@@ -32,7 +32,7 @@ protocols:
> - { name: "xmpp"; host: "localhost"; port: "9009"; },
> - { name: "adb"; host: "localhost"; port: "9010"; },
> - { name: "syslog"; host: "localhost"; port: "9013"; },
> -- { name: "regex"; host: "ip4-localhost"; is_udp: true; port:
> "9020";
> -+ { name: "ssh"; host: "127.0.0.1"; is_udp: true; port: "9020";
> - udp_timeout: 30;
> - regex_patterns: [ "^foo" ];
> - },
> Index: pkg/PLIST
> ===================================================================
> RCS file: /cvs/ports/net/sslh/pkg/PLIST,v
> diff -u -p -r1.7 PLIST
> --- pkg/PLIST 23 Apr 2022 11:52:33 -0000 1.7
> +++ pkg/PLIST 21 Jul 2026 10:45:33 -0000
> @@ -1,10 +1,12 @@
> -@newgroup _sslh:696
> -@newuser _sslh:696:696::sslh:/nonexistent:/sbin/nologin
> +@newgroup _sslh:*
> +@newuser _sslh:*:::sslh:/nonexistent:/sbin/nologin
> @rcscript ${RCDIR}/sslh_fork
> @rcscript ${RCDIR}/sslh_select
> +@rcscript ${RCDIR}/sslh_ev
> @man man/man8/sslh.8
> @bin sbin/sslh-fork
> @bin sbin/sslh-select
> +@bin sbin/sslh-ev
> share/doc/sslh/
> share/doc/sslh/README.md
> share/examples/sslh/
> Index: pkg/sslh_ev.rc
> ===================================================================
> RCS file: pkg/sslh_ev.rc
> diff -N pkg/sslh_ev.rc
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ pkg/sslh_ev.rc 21 Jul 2026 10:45:33 -0000
> @@ -0,0 +1,11 @@
> +#!/bin/ksh
> +
> +daemon="${TRUEPREFIX}/sbin/sslh-ev"
> +daemon_flags="--user=_sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22
> --tls 127.0.0.1:443"
> +
> +. /etc/rc.d/rc.subr
> +
> +pexp="${daemon} .*"
> +rc_reload=NO
> +
> +rc_cmd $1
[UPDATE] net/sslh 1.22c -> 2.31.1