New port: security/hitch:

hitch is a network proxy that terminates TLS/SSL connections and forwards
the unencrypted traffic to some backend. It's designed to handle 10s of
thousands of connections efficiently on multicore machines.

WWW: https://github.com/varnish/hitch/

security/Makefile

@@ -173,6 +173,7 @@
     SUBDIR += hackbot
     SUBDIR += hamachi
     SUBDIR += heimdal
+    SUBDIR += hitch
     SUBDIR += hlfl
     SUBDIR += hmap
     SUBDIR += honggfuzz

security/hitch/Makefile

@@ -0,0 +1,36 @@
+# Created by: Ryan Steinmetz <zi@FreeBSD.org>
+# $FreeBSD$
+
+PORTNAME=		hitch
+DISTVERSIONPREFIX=	${PORTNAME}-
+DISTVERSION=		1.0.0-beta1
+CATEGORIES=		security
+
+MAINTAINER=		zi@FreeBSD.org
+COMMENT=		TLS proxy to forward connections to an unencrypted backend
+
+LICENSE=		BSD2CLAUSE
+
+LIB_DEPENDS=		libev.so:${PORTSDIR}/devel/libev
+
+USERS=			nobody
+GROUPS=			nobody
+
+USES=			autoreconf
+GNU_CONFIGURE=		yes
+CONFIGURE_ARGS=		--localstatedir=/var/run
+USE_OPENSSL=		yes
+USE_RC_SUBR=		${PORTNAME}
+CPPFLAGS+=		-I${LOCALBASE}/include
+LDFLAGS+=		-L${LOCALBASE}/lib
+USE_GITHUB=		yes
+GH_ACCOUNT=		varnish
+
+post-patch:
+	${REINPLACE_CMD} 's|stud|${PORTNAME}|g' ${WRKSRC}/*.* ${WRKSRC}/src/*
+
+post-install:
+	${MKDIR} ${STAGEDIR}${PREFIX}/etc
+	${INSTALL_DATA} ${FILESDIR}/${PORTNAME}.conf.sample ${STAGEDIR}${PREFIX}/etc/
+
+.include <bsd.port.mk>

security/hitch/distinfo

@@ -0,0 +1,2 @@
+SHA256 (varnish-hitch-hitch-1.0.0-beta1_GH0.tar.gz) = 9214f748a28a2ac726197ad74720889dcba345fecf0369259df7769e3a734d3d
+SIZE (varnish-hitch-hitch-1.0.0-beta1_GH0.tar.gz) = 48476

security/hitch/files/hitch.conf.sample

@@ -0,0 +1,130 @@
+#
+# stud(8), The Scalable TLS Unwrapping Daemon's configuration
+#
+
+# NOTE: all config file parameters can be overriden
+#       from command line!
+
+# Listening address. REQUIRED.
+#
+# type: string
+# syntax: [HOST]:PORT
+frontend = "[*]:8443"
+
+# Upstream server address. REQUIRED.
+#
+# type: string
+# syntax: [HOST]:PORT.
+backend = "[127.0.0.1]:8000"
+
+# SSL x509 certificate file. REQUIRED.
+# List multiple certs to use SNI. Certs are used in the order they
+# are listed; the last cert listed will be used if none of the others match
+#
+# type: string
+pem-file = ""
+
+# SSL protocol.
+#
+# tls = on
+# ssl = off
+
+# List of allowed SSL ciphers.
+#
+# Run openssl ciphers for list of available ciphers.
+# type: string
+ciphers = ""
+
+# Enforce server cipher list order
+#
+# type: boolean
+prefer-server-ciphers = off
+
+# Use specified SSL engine
+#
+# type: string
+ssl-engine = ""
+
+# Number of worker processes
+#
+# type: integer
+workers = 1
+
+# Listen backlog size
+#
+# type: integer
+backlog = 100
+
+# TCP socket keepalive interval in seconds
+#
+# type: integer
+keepalive = 3600
+
+# Chroot directory
+#
+# type: string
+chroot = ""
+
+# Set uid after binding a socket
+#
+# type: string
+user = "nobody"
+
+# Set gid after binding a socket
+#
+# type: string
+group = "nobody"
+
+# Quiet execution, report only error messages
+#
+# type: boolean
+quiet = off
+
+# Use syslog for logging
+#
+# type: boolean
+syslog = on
+
+# Syslog facility to use
+#
+# type: string
+syslog-facility = "daemon"
+
+# Run as daemon
+#
+# type: boolean
+daemon = on
+
+# Report client address by writing IP before sending data
+#
+# NOTE: This option is mutually exclusive with option write-proxy-v2, write-proxy and proxy-proxy.
+#
+# type: boolean
+write-ip = off
+
+# Report client address using SENDPROXY protocol, see
+# http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
+# for details.
+#
+# NOTE: This option is mutually exclusive with option write-proxy-v2, write-ip and proxy-proxy.
+#
+# type: boolean
+write-proxy = off
+
+# Report client address using SENDPROXY v2 binary protocol, see
+# http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
+# for details.
+#
+# NOTE: This option is mutually exclusive with option write-ip, write-proxy and proxy-proxy.
+#
+# type: boolean
+write-proxy-v2 = off
+
+# Proxy an existing SENDPROXY protocol header through this request.
+#
+# NOTE: This option is mutually exclusive with option write-proxy-v2, write-ip and write-proxy.
+#
+# type: boolean
+proxy-proxy = off
+
+# EOF

security/hitch/files/hitch.in

@@ -0,0 +1,38 @@
+#!/bin/sh
+#
+# $FreeBSD$
+#
+
+# PROVIDE: hitch
+# REQUIRE: NETWORKING SERVERS
+# BEFORE: DAEMON
+# KEYWORD: shutdown
+
+#
+# Add some of the following variables to /etc/rc.conf to configure hitch:
+# hitch_enable (bool):	Set to "NO" by default.
+#				Set it to "YES" to enable hitch.
+# hitch_config (str):		Default "%%PREFIX%%/etc/hitch.conf"
+#				Set it to the full path to the config file
+#				that hitch will use during the automated
+#				start-up.
+# hitch_pidfile (str):	Default "%%PREFIX%%/var/hitch/hitch.pid"
+#				Set it to the value of 'pid' in
+#				the hitch.conf file.
+#
+
+. /etc/rc.subr
+
+name="hitch"
+rcvar=hitch_enable
+
+load_rc_config $name
+
+: ${hitch_enable="NO"}
+: ${hitch_config="%%PREFIX%%/etc/hitch.conf"}
+
+command="%%PREFIX%%/sbin/hitch-openssl"
+command_args="--daemon -u nobody -g nobody -s --config=${hitch_config}"
+
+required_files=${hitch_config}
+run_rc_command "$1"

security/hitch/pkg-descr

@@ -0,0 +1,5 @@
+hitch is a network proxy that terminates TLS/SSL connections and forwards
+the unencrypted traffic to some backend. It's designed to handle 10s of
+thousands of connections efficiently on multicore machines.
+
+WWW: https://github.com/varnish/hitch/

security/hitch/pkg-message

@@ -0,0 +1,2 @@
+Don't forget to append DH params to your pem file using:
+openssl dhparam -rand - 1024 >> /path/to/cert.pem

security/hitch/pkg-plist

@@ -0,0 +1,3 @@
+man/man8/hitch.8.gz
+sbin/hitch-openssl
+@sample etc/hitch.conf.sample