Re: UPDATE net/sslh

On Sun 21/01/2018 19:10, Klemens Nanni wrote:
> On Sun, Jan 21, 2018 at 05:59:26PM +0100, Björn Ketelaars wrote:
> > Enclosed a diff for bringing net/sslh to the latest version. From the release
> > announcement:
> >
> > - Added 'syslog_facility' configuration option to specify where to log
> > - TLS now supports SNI and ALPN, including support for Let's Encrypt
> > challenges
> > - ADB probe
> > - Added per-protocol 'fork' option
> > - Added chroot option
> > - A truckload of bug fixes and documentation improvements
> >
> > I'm running this version, in an existing sslh setup, without any issues.
> >
> > Comments?
> Haven't run tested this properly yet but here are some portwise
> improvements to consider:
>
> The dance around VERSION with and without "v" prefix can be reduced to
> simply patching genver.sh. This completely avoids the ugly do-configure
> and version string passing.
>
> Instead of removing all the conditionals from the Makefile and passing
> default values through make's `-D', USE_GMAKE is all you need.
>
> Combined this reduces a lot of noise; and if we can live with "v1.19"
> instead of "1.19" in sslh's output and manpage, even the now introduced
> genver.sh patch can be dropped.

I prefer your diff, including the genver.sh patch. The overall result is
better for the eyes.

While here I would like to propose to add "--chroot=/var/empty" to the
rc.d-scripts. As long as nothing is placed in this directory there should be
no security implication, even if this chroot is shared with for example
OpenVPN (or any of the other ports that chroot to /var/empty).

Diff below is based on your work, and contains the chroot bit in the rc.d
scripts.


diff --git net/sslh/Makefile net/sslh/Makefile
index 5196ad1f3f6..ed1dec969c6 100644
--- net/sslh/Makefile
+++ net/sslh/Makefile
@@ -2,14 +2,11 @@

COMMENT = SSL/SSH multiplexer

-GH_ACCOUNT = yrutschle
-GH_PROJECT = sslh
-V = 1.18
-GH_TAGNAME = v$V
+DISTNAME = sslh-v1.19
+PKGNAME = ${DISTNAME:S/-v/-/}
CATEGORIES = security net
-REVISION = 0

-HOMEPAGE = http://www.rutschle.net/tech/sslh.shtml
+HOMEPAGE = https://www.rutschle.net/tech/sslh.shtml

MAINTAINER = Bjorn Ketelaars <bjorn.ketelaars@hydroxide.nl>

@@ -17,16 +14,18 @@ MAINTAINER = Bjorn Ketelaars <bjorn.ketelaars@hydroxide.nl>
PERMIT_PACKAGE_CDROM = Yes

WANTLIB = c config pcre
+
+MASTER_SITES = https://www.rutschle.net/tech/sslh/
+
LIB_DEPENDS = devel/libconfig \
devel/pcre

-MAKE_FLAGS = CFLAGS="${CFLAGS} -I${LOCALBASE}/include \
- -DENABLE_REGEX -DLIBCONFIG -DLIBPCRE" \
- LIBS="-L${LOCALBASE}/lib -lconfig -lpcre" VERSION=$V
+MAKE_FLAGS = CFLAGS="${CFLAGS} -I${LOCALBASE}/include" \
+ LIBS="-L${LOCALBASE}/lib -lconfig -lpcre" \
+ MAN=sslh.8
NO_TEST = Yes

-do-configure:
- printf '#ifndef _VERSION_H_\n#define _VERSION_H_\n#define VERSION "$V"\n