#1125372 sslh: logcheck pattern needs update

Package:
sslh
Source:
sslh
Description:
Applicative protocol multiplexer
Submitter:
Gabor Kiss
Date:
2026-01-16 02:01:01 UTC
Severity:
normal
Tags:
#1125372#5
Date:
2026-01-13 05:51:52 UTC
From:
To:
Dear Maintainer,

After Debian 12 -> 13 upgrade logcheck started to report log lines like
this:

2026-01-13T00:36:58.261944+01:00 myhost sslh[83128]: tls:connection from some.host.example.com:60940 to public-address:443 forwarded from some.host.example.com:60940 to localhost:443

I suggest modification of /etc/logcheck/ignore.d.server/sslh. Patch is
attached.

BR
Gabor Kiss
#1125372#8
Date:
2026-01-16 01:49:02 UTC
From:
To:
On Tue, 13 Jan 2026, Gabor Kiss wrote:n

Thanks for the report and patch.

There are some extraneous changes here, but I'll switch to the regex
recommended by upstream:

   sed --in-place --regexp-extended \
    's,^\^((\\w|\[\[:alpha:\]\])\{3\} \[ :(0-9|\[:digit:\])\]\{11\}),^(\1|[0-9T:.+-]{32}),'

and then cleanup the protocol matching section to match more of the
modern protocols which are accepted (and simplify the regex).

I'm currently blocking on getting the new upstream version of sslh
released.