sslh accepts connections on specified ports, and forwards them further based
on tests performed on the first data packet sent by the remote client.
Probes for HTTP, TLS/SSL (including SNI and ALPN), SSH, OpenVPN, tinc, XMPP,
SOCKS5, are implemented, and any other protocol that can be tested using a
regular expression, can be recognised. A typical use case is to allow serving
several services on port 443 (e.g. to connect to SSH from inside a corporate
firewall, which almost never block port 443) while still serving HTTPS on
that port.
Hence sslh acts as a protocol demultiplexer, or a switchboard. With the SNI
and ALPN probe, it makes a good front-end to a virtual host farm hosted
behind a single IP address.
sslh has the bells and whistles expected from a mature daemon: privilege and
capabilities dropping, inetd support, systemd support, transparent proxying,
chroot, logging, IPv4 and IPv6, TCP and UDP, a fork-based and a select-based
model, and more.
===> The following configuration options are available for sslh-2.3.1:
EXAMPLES=on: Build and/or install examples
LIBWRAP=on: TCP wrapper support
===> Use 'make config' to modify these settings
net/sslh: Update to 2.2.4
Changelog:
- Fix CVE-2025-46806 for "Misaligned Memory Accesses in `is_openvpn_protocol()`"
- Fix CVE-2025-46807 for "File Descriptor Exhaustion in sslh-select and sslh-ev"
- Fix potential parsing of undefined data in syslog probe (no CVE assigned)
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
net: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Aaron Straup Cope <ascope@cpan.org>
* Aaron Zauner <az_mail@gmx.at>
* Adam Jette <jettea46@yahoo.com>
* Adam Weinberger <adamw@FreeBSD.org>
* Alan Eldridge <alane@geeksrus.net>
* Alex Bakhtin <Alex.Bakhtin@gmail.com>
* Alex Deiter <Alex.Deiter@Gmail.COM>
* Alex Dupre <ale@FreeBSD.org>
* Alex Dupre <sysadmin@alexdupre.com>
(Only the first 15 lines of the commit message are shown above )
net/sslh: update to 1.22c
Most notably, sslh now supports UDP and, thus, QUIC and Teamspeak.
For the release announcement see:
https://lists.rutschle.net/mailman/archives/sslh/2021-August/000744.html
While at it:
- Give the sample configuration file @sample treatment.
- Install all remaining example configuration files as EXAMPLES.
- Make the EXAMPLES knob actually work as intended by not installing
corresponding files when it's off.
- Refresh pkg-descr.
PR: 261067
Approved by: maintainer timeout
net/sslh is not jobs safe
This port has failed on me twice so far. The problem is that version.h
is generated, but common.c doesn't want for that to finish, and it
includes the header incomplete.
Fixing 'fetch' and unbreak.
Note: the author confirm that the recent changes to the source archive
was just adding a COPYING file
<http://rutschle.net/pipermail/sslh/2014-October/000550.html>.
PR: ports/194134
Submitted by: maintainer
- Update to 1.16. For changes since 1.15 see:
http://rutschle.net/pipermail/sslh/2014-February/000489.html
- Respect {C,LD}FLAGS.
- Add an option for TCP wrapper support, enabled by default.
- Correct path name of configuration file and startup script in man page.
- Sanitize the startup script; mainly add ldconfig to REQUIRE to ensure that
libconfig is found when starting sslh.
Approved by: maintainer
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
Remove painful examples of foo="", with particular prejudice against
constructions that parse out to [ -z "$foo" ] && foo=""
These are bad examples that get copied and pasted into new code, so the
hope is that with less bad examples there will be less need for me to
bring this up in review.
In a few of these files all that were changed were comments so that next
time I search for these patterns I won't trip on the file for no reason.
In a few places, add $FreeBSD$
No functional changes, so no PORTREVISION bumps
- Fix PLIST when NO_INSTALL_MANPAGES is set
- Remove obsolete MD5 sum while I'm here
PR: ports/152260
Submitted by: sunpoet (myself)
Approved by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw> (maintainer)
sslh lets one accept both HTTPS and SSH connections on the same port. It makes
it possible to connect to an SSH server on port 443 (e.g. from inside a
corporate firewall) while still serving HTTPS on that port.
WWW: http://www.rutschle.net/tech/sslh.shtml
PR: ports/145113
Submitted by: Jui-Nan Lin <jnlin@csie.nctu.edu.tw>
