From 91736dbd177364a0291b4ba4e8a39cdf31246add Mon Sep 17 00:00:00 2001
From: Stefan Meinecke <meinecke@greensec.de>
Date: Sun, 18 Oct 2026 02:14:06 +0200
Subject: [PATCH] sslh-fork: apply the active listener's configuration, not
 listener 0's

tcp_listener() accepts on endpoint[active_endpoint] but then used
endpoint-> - the base of the array, i.e. endpoint[0] - for the
connection counter, the max_connections limit, SIGCHLD accounting and
start_shoveler(). With several listen addresses, every listener
process therefore:

- enforces listener 0's max_connections (verified: a listener with
  limit 100 drops its second connection when listener 0 has limit 1),
- and passes listener 0's endpoint_cfg to children, so e.g. the
  proxyprotocol flag of listener 0 decides whether a PROXY header is
  expected on sockets accepted by other listeners.

Use a pointer to the active endpoint throughout the loop.
---
 sslh-fork.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/sslh-fork.c b/sslh-fork.c
index eec6009..d25760b 100644
--- a/sslh-fork.c
+++ b/sslh-fork.c
@@ -224,9 +224,10 @@ static void process_signals(struct listen_endpoint* endpoint)
 void tcp_listener(struct listen_endpoint* endpoint, int num_endpoints, int active_endpoint)
 {
     int i, in_socket;
+    struct listen_endpoint* self = &endpoint[active_endpoint];
 
     while (1) {
-        in_socket = accept(endpoint[active_endpoint].socketfd, 0, 0);
+        in_socket = accept(self->socketfd, 0, 0);
         if (in_socket == -1) {
             print_message(msg_system_error, "%s:%d:%s:%d:%s\n",
                           __FILE__, __LINE__, "accept", errno, strerror(errno));
@@ -243,20 +244,20 @@ void tcp_listener(struct listen_endpoint* endpoint, int num_endpoints, int activ
                 continue;
 
             case EINTR:
-                process_signals(endpoint);
+                process_signals(self);
                 continue;
 
             default:  /* Otherwise, it's something wrong in our parameters, we fail */
                 return;
             }
         }
-        endpoint->num_connections++;
-        print_message(msg_fd, "accepted fd %d (%d concurrent connections)\n", in_socket, endpoint->num_connections);
-        if ((endpoint->endpoint_cfg->max_connections_is_present) 
-            && (endpoint->num_connections > endpoint->endpoint_cfg->max_connections)) 
+        self->num_connections++;
+        print_message(msg_fd, "accepted fd %d (%d concurrent connections)\n", in_socket, self->num_connections);
+        if ((self->endpoint_cfg->max_connections_is_present)
+            && (self->num_connections > self->endpoint_cfg->max_connections))
         {
             print_message(msg_fd, "too many connection, reclosing fd %d\n", in_socket);
-            endpoint->num_connections--;
+            self->num_connections--;
             close(in_socket);
             continue;
         }
@@ -269,7 +270,7 @@ void tcp_listener(struct listen_endpoint* endpoint, int num_endpoints, int activ
                  /* Shoveler processes don't need to hog file descriptors */
                  for (i = 0; i < num_endpoints; i++)
                      close(endpoint[i].socketfd);
-                 start_shoveler(in_socket, endpoint);
+                 start_shoveler(in_socket, self);
                  exit(0);
 
         default: /* In parent process */