From: Atanas Vladimirov Subject: Re: [UPDATE] net/sslh 1.22c -> 2.31.1 To: Ports Date: Tue, 21 Jul 2026 15:18:34 +0300 On 2026-07-21 13:47, Stuart Henderson wrote: > On 2026/07/20 15:26, Atanas Vladimirov wrote: >> +CONFIGURE_STYLE = gnu >> + >> +MAKE_ENV += CPPFLAGS="-I${LOCALBASE}/include" \ >> + LDFLAGS="-L${LOCALBASE}/lib" > > normally you want these set in CONFIGURE_ENV, but the autoconf foo > upstream doesn't work properly, so I'll add a comment. > >> +MAKE_FLAGS = MAN=sslh.8 > > since you already patch Makefile.in for a closely related change, > it would make sense to add that to the patch. > >> +sslh accepts HTTPS, SSH, OpenVPN, WireGuard, tinc, XMPP and other >> +protocols on the same port, demultiplexing them based on probes of >> +the first packet. This makes it possible to connect to any of these >> +servers on port 443 (e.g. from inside a corporate firewall, which >> +almost never blocks port 443) while still serving HTTPS on that >> +port. TCP and UDP are supported. TLS probing can use SNI and ALPN. >> + >> +Three binaries are provided: sslh-fork, sslh-select and sslh-ev >> +(libev-based, for larger numbers of connections). > > I think it's better to provide a bit more information about how one > would choose between the three options - how about this for now? > Thanks, Stuart! I like your version more than mine :) Best wishes, Atanas > > Index: pkg/DESCR > =================================================================== > RCS file: /cvs/ports/net/sslh/pkg/DESCR,v > diff -u -p -r1.1.1.1 DESCR > --- pkg/DESCR 13 Apr 2012 14:14:21 -0000 1.1.1.1 > +++ pkg/DESCR 21 Jul 2026 10:45:33 -0000 > @@ -1,4 +1,12 @@ > -sslh accepts HTTPS, SSH, OpenVPN, tinc and XMPP connections on the > -same port. This makes it possible to connect to any of these servers > -on port 443 (e.g. from inside a corporate firewall, which almost > -never block port 443) while still serving HTTPS on that port. > +sslh accepts HTTPS, SSH, OpenVPN, WireGuard, tinc, XMPP and other > +protocols on the same port, demultiplexing them based on probes of > +the first packet. This makes it possible to connect to any of these > +servers on port 443 (e.g. from inside a corporate firewall, which > +almost never blocks port 443) while still serving HTTPS on that > +port. TCP and UDP are supported. TLS probing can use SNI and ALPN. > + > +Three binaries are provided: sslh-fork, sslh-select and sslh-ev. > +-fork has higher overhead, but processes are isolated and restarts > +don't disrupt active connections. -select and -ev avoid multiple > +processes: of the two, -ev should handle load better but is newer; > +-select is more well-tested. > Index: Makefile > =================================================================== > RCS file: /cvs/ports/net/sslh/Makefile,v > diff -u -p -r1.33 Makefile > --- Makefile 17 Oct 2024 10:50:03 -0000 1.33 > +++ Makefile 21 Jul 2026 10:45:33 -0000 > @@ -1,7 +1,6 @@ > COMMENT = SSL/SSH multiplexer > > -DISTNAME = sslh-v1.22c > -REVISION = 2 > +DISTNAME = sslh-v2.3.1 > PKGNAME = ${DISTNAME:S/-v/-/} > > CATEGORIES = security net > @@ -11,21 +10,23 @@ HOMEPAGE = https://www.rutschle.net/tech > # GPLv2+ > PERMIT_PACKAGE = Yes > > -WANTLIB = c config m pcre2-8 > +WANTLIB = c config ev m pcre2-8 > > SITES = https://www.rutschle.net/tech/sslh/ > > LIB_DEPENDS = devel/libconfig \ > + devel/libev \ > devel/pcre2 > TEST_DEPENDS = devel/p5-Conf-Libconfig \ > net/p5-IO-Socket-INET6 > > -MAKE_FLAGS = CFLAGS="${CFLAGS} -I${LOCALBASE}/include -DLIBPCRE" \ > - LIBS="-L${LOCALBASE}/lib -lconfig -lm -lpcre2-8" \ > - MAN=sslh.8 > - > +CONFIGURE_STYLE = gnu > USE_GMAKE = Yes > > +# XXX not passed through properly from autoconf > +MAKE_ENV = CPPFLAGS="-I${LOCALBASE}/include" \ > + LDFLAGS="-L${LOCALBASE}/lib" > + > PORTHOME = ${WRKDIST} > > do-install: > @@ -36,8 +37,11 @@ do-install: > .for p in basic.cfg example.cfg udp.cfg > ${INSTALL_DATA} ${WRKSRC}/$p ${PREFIX}/share/examples/sslh > .endfor > -.for p in sslh-fork sslh-select > +.for p in sslh-fork sslh-select sslh-ev > ${INSTALL_PROGRAM} ${WRKSRC}/$p ${PREFIX}/sbin > .endfor > + > +do-test: > + cd ${WRKSRC}/t && ./run > > .include > Index: distinfo > =================================================================== > RCS file: /cvs/ports/net/sslh/distinfo,v > diff -u -p -r1.15 distinfo > --- distinfo 30 Oct 2021 14:51:25 -0000 1.15 > +++ distinfo 21 Jul 2026 10:45:33 -0000 > @@ -1,2 +1,2 @@ > -SHA256 (sslh-v1.22c.tar.gz) = > jjdC0U7fQRk1DP3Hu5a4kTTZIY620qbh9wiRyhimSbE= > -SIZE (sslh-v1.22c.tar.gz) = 146950 > +SHA256 (sslh-v2.3.1.tar.gz) = > UaVRbsXLAYI2M7TYys3u5O+gxW72INHJltT1LKUaYBs= > +SIZE (sslh-v2.3.1.tar.gz) = 535800 > Index: patches/patch-Makefile > =================================================================== > RCS file: patches/patch-Makefile > diff -N patches/patch-Makefile > --- patches/patch-Makefile 8 Mar 2022 08:53:51 -0000 1.11 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,12 +0,0 @@ > -Index: Makefile > ---- Makefile.orig > -+++ Makefile > -@@ -95,7 +95,7 @@ echosrv: version.h echosrv-conf.c echosrv.o > echosrv-co > - $(CC) $(CFLAGS) $(LDFLAGS) -o echosrv echosrv.o echosrv-conf.o > argtable3.o $(LIBS) > - > - $(MAN): sslh.pod Makefile > -- pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | > gzip -9 - > $(MAN) > -+ pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod > > $(MAN) > - > - # Create release: export clean tree and tag current > - # configuration > Index: patches/patch-Makefile_in > =================================================================== > RCS file: patches/patch-Makefile_in > diff -N patches/patch-Makefile_in > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-Makefile_in 21 Jul 2026 10:45:33 -0000 > @@ -0,0 +1,21 @@ > +Index: Makefile.in > +--- Makefile.in.orig > ++++ Makefile.in > +@@ -16,7 +16,7 @@ PREFIX?=/usr > + BINDIR?=$(PREFIX)/sbin > + MANDIR?=$(PREFIX)/share/man/man8 > + > +-MAN=sslh.8.gz # man page name > ++MAN=sslh.8 # man page name > + > + # End of configuration -- the rest should take care of > + # itself > +@@ -105,7 +105,7 @@ echosrv: version.h echosrv-conf.c echosrv.o > echosrv-co > + landlock.o: config.h > + > + $(MAN): sslh.pod Makefile > +- pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | > gzip -9 - > $(MAN) > ++ pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod > > $(MAN) > + > + # Create release: export clean tree and tag current > + # configuration > Index: patches/patch-basic_cfg > =================================================================== > RCS file: /cvs/ports/net/sslh/patches/patch-basic_cfg,v > diff -u -p -r1.6 patch-basic_cfg > --- patches/patch-basic_cfg 8 Mar 2022 08:53:51 -0000 1.6 > +++ patches/patch-basic_cfg 21 Jul 2026 10:45:33 -0000 > @@ -1,12 +1,12 @@ > Index: basic.cfg > --- basic.cfg.orig > +++ basic.cfg > -@@ -7,7 +7,7 @@ inetd: false; > - numeric: false; > - transparent: false; > +@@ -5,7 +5,7 @@ > + # example.cfg > + > timeout: 2; > -user: "nobody"; > +user: "_sslh"; > pidfile: "/var/run/sslh.pid"; > - chroot: "/var/empty"; > + > > Index: patches/patch-example_cfg > =================================================================== > RCS file: /cvs/ports/net/sslh/patches/patch-example_cfg,v > diff -u -p -r1.6 patch-example_cfg > --- patches/patch-example_cfg 8 Mar 2022 08:53:51 -0000 1.6 > +++ patches/patch-example_cfg 21 Jul 2026 10:45:33 -0000 > @@ -1,7 +1,7 @@ > Index: example.cfg > --- example.cfg.orig > +++ example.cfg > -@@ -9,7 +9,7 @@ inetd: false; > +@@ -8,7 +8,7 @@ inetd: false; > numeric: false; > transparent: false; > timeout: 2; > Index: patches/patch-sslh_pod > =================================================================== > RCS file: /cvs/ports/net/sslh/patches/patch-sslh_pod,v > diff -u -p -r1.11 patch-sslh_pod > --- patches/patch-sslh_pod 8 Mar 2022 08:53:51 -0000 1.11 > +++ patches/patch-sslh_pod 21 Jul 2026 10:45:33 -0000 > @@ -1,18 +1,21 @@ > Index: sslh.pod > --- sslh.pod.orig > +++ sslh.pod > -@@ -26,17 +26,14 @@ Hence B acts as a protocol demultiplexer, or > a > +@@ -26,17 +26,17 @@ Hence B acts as a protocol demultiplexer, or > a > switchboard. Its name comes from its original function to > serve SSH and HTTPS on the same port. > > -=head2 Libwrap support > -+B comes in two versions: B forks a new process > -+for each incoming connection. It is well-tested and very > -+reliable, but incurs the overhead of many processes. B > -+uses only one thread, which monitors all connections at once. > -+It is more recent and less tested, but only incurs a 16 byte > -+overhead per connection. Also, if it stops, you'll lose all > -+connections, which means you can't upgrade it remotely. > ++B comes in three versions: B forks a new > ++process for each incoming connection. It is well-tested and > ++very reliable, but incurs the overhead of many processes. > ++B uses only one thread, which monitors all > ++connections at once; it only incurs a 16 byte overhead per > ++connection. B is similar to B, but uses > ++B as a backend, which allows managing larger numbers > ++of connections. If B or B stops, you > ++will lose all connections, which means you cannot upgrade it > ++remotely. > > -One drawback of B is that the servers do not see the > -original IP address of the client anymore, as the connection > @@ -26,7 +29,7 @@ Index: sslh.pod > =head2 Configuration file > > A configuration file can be supplied to B. Command > -@@ -209,24 +206,6 @@ Runs in background. This overrides B > if se > +@@ -213,24 +213,6 @@ Runs in background. This overrides B > if se > the configuration file (or on the command line, but there is > no point setting both on the command line unless you have a > personality disorder). > Index: patches/patch-t > =================================================================== > RCS file: patches/patch-t > diff -N patches/patch-t > --- patches/patch-t 8 Mar 2022 08:53:51 -0000 1.5 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,33 +0,0 @@ > -Index: t > ---- t.orig > -+++ t > -@@ -39,8 +39,6 @@ my $RB_OPEN_PID_FILE = 0; > - my $RB_RESOLVE_ADDRESS = 0; > - my $RB_CL_PARAMS = 0; > - > --`lcov --directory . --zerocounters`; > -- > - sub verbose_exec > - { > - my ($cmd) = @_; > -@@ -293,7 +291,7 @@ for my $binary (@binaries) { > - warn "$!\n" unless $cnx_h; > - if ($cnx_h) { > - close $cnx_h; > -- my_is(1, "$binary: Connect and write nothing"); > -+ my_is(1, 1, "$binary: Connect and write nothing"); > - # The goal of the test is to check sslh doesn't > - # crash > - } > -@@ -454,10 +452,7 @@ if ($RB_CL_PARAMS) { > - my_is($code, 6, "Bad command line parameters"); > - } > - > --`lcov --directory . --capture --output-file sslh_cov.info`; > --`genhtml sslh_cov.info`; > -- > --`killall echosrv`; > -+`pkill -q echosrv`; > - > - > - format test_results_top = > Index: patches/patch-t_run > =================================================================== > RCS file: patches/patch-t_run > diff -N patches/patch-t_run > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ patches/patch-t_run 21 Jul 2026 10:45:33 -0000 > @@ -0,0 +1,21 @@ > +Index: t/run > +--- t/run.orig > ++++ t/run > +@@ -124,7 +124,7 @@ sub start_echosrv > + > + sub stop_echosrv > + { > +- `killall echosrv` if $started_echosrvs; > ++ `pkill -q echosrv` if $started_echosrvs; > + undef $started_echosrvs; > + } > + > +@@ -157,7 +157,7 @@ sub stop_sslh > + { > + if (defined $sslh_pid) { > + kill TERM => $sslh_pid or warn "kill process: $!\n"; > +- `killall sslh-ev sslh-select sslh-fork`; > ++ `pkill -q sslh-ev sslh-select sslh-fork`; > + undef $sslh_pid; > + } > + } > Index: patches/patch-test_cfg > =================================================================== > RCS file: patches/patch-test_cfg > diff -N patches/patch-test_cfg > --- patches/patch-test_cfg 8 Mar 2022 08:53:51 -0000 1.2 > +++ /dev/null 1 Jan 1970 00:00:00 -0000 > @@ -1,23 +0,0 @@ > -Taken from https://github.com/yrutschle/sslh/pull/310. > - > -Index: test.cfg > ---- test.cfg.orig > -+++ test.cfg > -@@ -18,7 +18,7 @@ listen: > - ( > - { host: "localhost"; port: "8080"; keepalive: true; }, > - { host: "localhost"; port: "8081"; keepalive: true; }, > -- { host: "ip4-localhost"; is_udp: true; port: "8086"; } > -+ { host: "127.0.0.1"; is_udp: true; port: "8086"; } > - ); > - > - > -@@ -32,7 +32,7 @@ protocols: > - { name: "xmpp"; host: "localhost"; port: "9009"; }, > - { name: "adb"; host: "localhost"; port: "9010"; }, > - { name: "syslog"; host: "localhost"; port: "9013"; }, > -- { name: "regex"; host: "ip4-localhost"; is_udp: true; port: > "9020"; > -+ { name: "ssh"; host: "127.0.0.1"; is_udp: true; port: "9020"; > - udp_timeout: 30; > - regex_patterns: [ "^foo" ]; > - }, > Index: pkg/PLIST > =================================================================== > RCS file: /cvs/ports/net/sslh/pkg/PLIST,v > diff -u -p -r1.7 PLIST > --- pkg/PLIST 23 Apr 2022 11:52:33 -0000 1.7 > +++ pkg/PLIST 21 Jul 2026 10:45:33 -0000 > @@ -1,10 +1,12 @@ > -@newgroup _sslh:696 > -@newuser _sslh:696:696::sslh:/nonexistent:/sbin/nologin > +@newgroup _sslh:* > +@newuser _sslh:*:::sslh:/nonexistent:/sbin/nologin > @rcscript ${RCDIR}/sslh_fork > @rcscript ${RCDIR}/sslh_select > +@rcscript ${RCDIR}/sslh_ev > @man man/man8/sslh.8 > @bin sbin/sslh-fork > @bin sbin/sslh-select > +@bin sbin/sslh-ev > share/doc/sslh/ > share/doc/sslh/README.md > share/examples/sslh/ > Index: pkg/sslh_ev.rc > =================================================================== > RCS file: pkg/sslh_ev.rc > diff -N pkg/sslh_ev.rc > --- /dev/null 1 Jan 1970 00:00:00 -0000 > +++ pkg/sslh_ev.rc 21 Jul 2026 10:45:33 -0000 > @@ -0,0 +1,11 @@ > +#!/bin/ksh > + > +daemon="${TRUEPREFIX}/sbin/sslh-ev" > +daemon_flags="--user=_sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22 > --tls 127.0.0.1:443" > + > +. /etc/rc.d/rc.subr > + > +pexp="${daemon} .*" > +rc_reload=NO > + > +rc_cmd $1