Hello,
Here is a patch that updates net/sslh 1.22c -> 2.31.1
Tested on -current
```
OpenBSD 8.0-beta (GENERIC.MP) #45: Sat Jul 18 11:29:43 MDT 2026
```
Any thoughts are welcome.
P.S.: Please add me on CC because I'm not subscribed to the list.
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/sslh/Makefile,v
diff -u -p -r1.33 Makefile
--- Makefile 17 Oct 2024 10:50:03 -0000 1.33
+++ Makefile 20 Jul 2026 11:37:41 -0000
@@ -1,7 +1,6 @@
COMMENT = SSL/SSH multiplexer
-DISTNAME = sslh-v1.22c
-REVISION = 2
+DISTNAME = sslh-v2.3.1
PKGNAME = ${DISTNAME:S/-v/-/}
CATEGORIES = security net
@@ -11,20 +10,23 @@ HOMEPAGE = https://www.rutschle.net/tech
# GPLv2+
PERMIT_PACKAGE = Yes
-WANTLIB = c config m pcre2-8
+WANTLIB = c config ev m pcre2-8
SITES = https://www.rutschle.net/tech/sslh/
LIB_DEPENDS = devel/libconfig \
+ devel/libev \
devel/pcre2
TEST_DEPENDS = devel/p5-Conf-Libconfig \
net/p5-IO-Socket-INET6
-MAKE_FLAGS = CFLAGS="${CFLAGS} -I${LOCALBASE}/include -DLIBPCRE" \
- LIBS="-L${LOCALBASE}/lib -lconfig -lm -lpcre2-8" \
- MAN=sslh.8
+CONFIGURE_STYLE = gnu
+
+MAKE_ENV += CPPFLAGS="-I${LOCALBASE}/include" \
+ LDFLAGS="-L${LOCALBASE}/lib"
USE_GMAKE = Yes
+MAKE_FLAGS = MAN=sslh.8
PORTHOME = ${WRKDIST}
@@ -36,8 +38,11 @@ do-install:
.for p in basic.cfg example.cfg udp.cfg
${INSTALL_DATA} ${WRKSRC}/$p ${PREFIX}/share/examples/sslh
.endfor
-.for p in sslh-fork sslh-select
+.for p in sslh-fork sslh-select sslh-ev
${INSTALL_PROGRAM} ${WRKSRC}/$p ${PREFIX}/sbin
.endfor
+
+do-test:
+ cd ${WRKSRC}/t && ./run
.include <bsd.port.mk>
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/sslh/distinfo,v
diff -u -p -r1.15 distinfo
--- distinfo 30 Oct 2021 14:51:25 -0000 1.15
+++ distinfo 20 Jul 2026 11:37:41 -0000
@@ -1,2 +1,2 @@
-SHA256 (sslh-v1.22c.tar.gz) = jjdC0U7fQRk1DP3Hu5a4kTTZIY620qbh9wiRyhimSbE=
-SIZE (sslh-v1.22c.tar.gz) = 146950
+SHA256 (sslh-v2.3.1.tar.gz) = UaVRbsXLAYI2M7TYys3u5O+gxW72INHJltT1LKUaYBs=
+SIZE (sslh-v2.3.1.tar.gz) = 535800
Index: patches/patch-Makefile
===================================================================
RCS file: patches/patch-Makefile
diff -N patches/patch-Makefile
--- patches/patch-Makefile 8 Mar 2022 08:53:51 -0000 1.11
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,12 +0,0 @@
-Index: Makefile
---- Makefile.orig
-+++ Makefile
-@@ -95,7 +95,7 @@ echosrv: version.h echosrv-conf.c echosrv.o echosrv-co
- $(CC) $(CFLAGS) $(LDFLAGS) -o echosrv echosrv.o echosrv-conf.o
argtable3.o $(LIBS)
-
- $(MAN): sslh.pod Makefile
-- pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | gzip
-9 - > $(MAN)
-+ pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod > $(MAN)
-
- # Create release: export clean tree and tag current
- # configuration
Index: patches/patch-Makefile_in
===================================================================
RCS file: patches/patch-Makefile_in
diff -N patches/patch-Makefile_in
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-Makefile_in 20 Jul 2026 11:37:41 -0000
@@ -0,0 +1,12 @@
+Index: Makefile.in
+--- Makefile.in.orig
++++ Makefile.in
+@@ -105,7 +105,7 @@ echosrv: version.h echosrv-conf.c echosrv.o echosrv-co
+ landlock.o: config.h
+
+ $(MAN): sslh.pod Makefile
+- pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod | gzip
-9 - > $(MAN)
++ pod2man --section=8 --release=$(VERSION) --center=" " sslh.pod > $(MAN)
+
+ # Create release: export clean tree and tag current
+ # configuration
Index: patches/patch-basic_cfg
===================================================================
RCS file: /cvs/ports/net/sslh/patches/patch-basic_cfg,v
diff -u -p -r1.6 patch-basic_cfg
--- patches/patch-basic_cfg 8 Mar 2022 08:53:51 -0000 1.6
+++ patches/patch-basic_cfg 20 Jul 2026 11:37:41 -0000
@@ -1,12 +1,12 @@
Index: basic.cfg
--- basic.cfg.orig
+++ basic.cfg
-@@ -7,7 +7,7 @@ inetd: false;
- numeric: false;
- transparent: false;
+@@ -5,7 +5,7 @@
+ # example.cfg
+
timeout: 2;
-user: "nobody";
+user: "_sslh";
pidfile: "/var/run/sslh.pid";
- chroot: "/var/empty";
+
Index: patches/patch-example_cfg
===================================================================
RCS file: /cvs/ports/net/sslh/patches/patch-example_cfg,v
diff -u -p -r1.6 patch-example_cfg
--- patches/patch-example_cfg 8 Mar 2022 08:53:51 -0000 1.6
+++ patches/patch-example_cfg 20 Jul 2026 11:37:41 -0000
@@ -1,7 +1,7 @@
Index: example.cfg
--- example.cfg.orig
+++ example.cfg
-@@ -9,7 +9,7 @@ inetd: false;
+@@ -8,7 +8,7 @@ inetd: false;
numeric: false;
transparent: false;
timeout: 2;
Index: patches/patch-sslh_pod
===================================================================
RCS file: /cvs/ports/net/sslh/patches/patch-sslh_pod,v
diff -u -p -r1.11 patch-sslh_pod
--- patches/patch-sslh_pod 8 Mar 2022 08:53:51 -0000 1.11
+++ patches/patch-sslh_pod 20 Jul 2026 11:37:41 -0000
@@ -1,18 +1,21 @@
Index: sslh.pod
--- sslh.pod.orig
+++ sslh.pod
-@@ -26,17 +26,14 @@ Hence B<sslh> acts as a protocol demultiplexer, or a
+@@ -26,17 +26,17 @@ Hence B<sslh> acts as a protocol demultiplexer, or a
switchboard. Its name comes from its original function to
serve SSH and HTTPS on the same port.
-=head2 Libwrap support
-+B<sslh> comes in two versions: B<sslh-fork> forks a new process
-+for each incoming connection. It is well-tested and very
-+reliable, but incurs the overhead of many processes. B<sslh-select>
-+uses only one thread, which monitors all connections at once.
-+It is more recent and less tested, but only incurs a 16 byte
-+overhead per connection. Also, if it stops, you'll lose all
-+connections, which means you can't upgrade it remotely.
++B<sslh> comes in three versions: B<sslh-fork> forks a new
++process for each incoming connection. It is well-tested and
++very reliable, but incurs the overhead of many processes.
++B<sslh-select> uses only one thread, which monitors all
++connections at once; it only incurs a 16 byte overhead per
++connection. B<sslh-ev> is similar to B<sslh-select>, but uses
++B<libev> as a backend, which allows managing larger numbers
++of connections. If B<sslh-select> or B<sslh-ev> stops, you
++will lose all connections, which means you cannot upgrade it
++remotely.
-One drawback of B<sslh> is that the servers do not see the
-original IP address of the client anymore, as the connection
@@ -26,7 +29,7 @@ Index: sslh.pod
=head2 Configuration file
A configuration file can be supplied to B<sslh>. Command
-@@ -209,24 +206,6 @@ Runs in background. This overrides B<foreground> if se
+@@ -213,24 +213,6 @@ Runs in background. This overrides B<foreground> if se
the configuration file (or on the command line, but there is
no point setting both on the command line unless you have a
personality disorder).
Index: patches/patch-t
===================================================================
RCS file: patches/patch-t
diff -N patches/patch-t
--- patches/patch-t 8 Mar 2022 08:53:51 -0000 1.5
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,33 +0,0 @@
-Index: t
---- t.orig
-+++ t
-@@ -39,8 +39,6 @@ my $RB_OPEN_PID_FILE = 0;
- my $RB_RESOLVE_ADDRESS = 0;
- my $RB_CL_PARAMS = 0;
-
--`lcov --directory . --zerocounters`;
--
- sub verbose_exec
- {
- my ($cmd) = @_;
-@@ -293,7 +291,7 @@ for my $binary (@binaries) {
- warn "$!\n" unless $cnx_h;
- if ($cnx_h) {
- close $cnx_h;
-- my_is(1, "$binary: Connect and write nothing");
-+ my_is(1, 1, "$binary: Connect and write nothing");
- # The goal of the test is to check sslh doesn't
- # crash
- }
-@@ -454,10 +452,7 @@ if ($RB_CL_PARAMS) {
- my_is($code, 6, "Bad command line parameters");
- }
-
--`lcov --directory . --capture --output-file sslh_cov.info`;
--`genhtml sslh_cov.info`;
--
--`killall echosrv`;
-+`pkill -q echosrv`;
-
-
- format test_results_top =
Index: patches/patch-t_run
===================================================================
RCS file: patches/patch-t_run
diff -N patches/patch-t_run
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ patches/patch-t_run 20 Jul 2026 11:37:41 -0000
@@ -0,0 +1,21 @@
+Index: t/run
+--- t/run.orig
++++ t/run
+@@ -124,7 +124,7 @@ sub start_echosrv
+
+ sub stop_echosrv
+ {
+- `killall echosrv` if $started_echosrvs;
++ `pkill -q echosrv` if $started_echosrvs;
+ undef $started_echosrvs;
+ }
+
+@@ -157,7 +157,7 @@ sub stop_sslh
+ {
+ if (defined $sslh_pid) {
+ kill TERM => $sslh_pid or warn "kill process: $!\n";
+- `killall sslh-ev sslh-select sslh-fork`;
++ `pkill -q sslh-ev sslh-select sslh-fork`;
+ undef $sslh_pid;
+ }
+ }
Index: patches/patch-test_cfg
===================================================================
RCS file: patches/patch-test_cfg
diff -N patches/patch-test_cfg
--- patches/patch-test_cfg 8 Mar 2022 08:53:51 -0000 1.2
+++ /dev/null 1 Jan 1970 00:00:00 -0000
@@ -1,23 +0,0 @@
-Taken from https://github.com/yrutschle/sslh/pull/310.
-
-Index: test.cfg
---- test.cfg.orig
-+++ test.cfg
-@@ -18,7 +18,7 @@ listen:
- (
- { host: "localhost"; port: "8080"; keepalive: true; },
- { host: "localhost"; port: "8081"; keepalive: true; },
-- { host: "ip4-localhost"; is_udp: true; port: "8086"; }
-+ { host: "127.0.0.1"; is_udp: true; port: "8086"; }
- );
-
-
-@@ -32,7 +32,7 @@ protocols:
- { name: "xmpp"; host: "localhost"; port: "9009"; },
- { name: "adb"; host: "localhost"; port: "9010"; },
- { name: "syslog"; host: "localhost"; port: "9013"; },
-- { name: "regex"; host: "ip4-localhost"; is_udp: true; port: "9020";
-+ { name: "ssh"; host: "127.0.0.1"; is_udp: true; port: "9020";
- udp_timeout: 30;
- regex_patterns: [ "^foo" ];
- },
Index: pkg/DESCR
===================================================================
RCS file: /cvs/ports/net/sslh/pkg/DESCR,v
diff -u -p -r1.1.1.1 DESCR
--- pkg/DESCR 13 Apr 2012 14:14:21 -0000 1.1.1.1
+++ pkg/DESCR 20 Jul 2026 11:37:41 -0000
@@ -1,4 +1,9 @@
-sslh accepts HTTPS, SSH, OpenVPN, tinc and XMPP connections on the
-same port. This makes it possible to connect to any of these servers
-on port 443 (e.g. from inside a corporate firewall, which almost
-never block port 443) while still serving HTTPS on that port.
+sslh accepts HTTPS, SSH, OpenVPN, WireGuard, tinc, XMPP and other
+protocols on the same port, demultiplexing them based on probes of
+the first packet. This makes it possible to connect to any of these
+servers on port 443 (e.g. from inside a corporate firewall, which
+almost never blocks port 443) while still serving HTTPS on that
+port. TCP and UDP are supported. TLS probing can use SNI and ALPN.
+
+Three binaries are provided: sslh-fork, sslh-select and sslh-ev
+(libev-based, for larger numbers of connections).
Index: pkg/PLIST
===================================================================
RCS file: /cvs/ports/net/sslh/pkg/PLIST,v
diff -u -p -r1.7 PLIST
--- pkg/PLIST 23 Apr 2022 11:52:33 -0000 1.7
+++ pkg/PLIST 20 Jul 2026 11:37:41 -0000
@@ -2,9 +2,11 @@
@newuser _sslh:696:696::sslh:/nonexistent:/sbin/nologin
@rcscript ${RCDIR}/sslh_fork
@rcscript ${RCDIR}/sslh_select
+@rcscript ${RCDIR}/sslh_ev
@man man/man8/sslh.8
@bin sbin/sslh-fork
@bin sbin/sslh-select
+@bin sbin/sslh-ev
share/doc/sslh/
share/doc/sslh/README.md
share/examples/sslh/
Index: pkg/sslh_ev.rc
===================================================================
RCS file: pkg/sslh_ev.rc
diff -N pkg/sslh_ev.rc
--- /dev/null 1 Jan 1970 00:00:00 -0000
+++ pkg/sslh_ev.rc 20 Jul 2026 11:37:41 -0000
@@ -0,0 +1,11 @@
+#!/bin/ksh
+
+daemon="${TRUEPREFIX}/sbin/sslh-ev"
+daemon_flags="--user=_sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22 --tls
127.0.0.1:443"
+
+. /etc/rc.d/rc.subr
+
+pexp="${daemon} .*"
+rc_reload=NO
+
+rc_cmd $1
