Page MenuHomeFreeBSD
Files F146638342

D55624.id173039.largetrue.diff
No OneTemporary
Actions

D55624.id173039.largetrue.diff
View Options

This file is larger than 256 KB, so syntax highlighting was skipped.
diff --git a/MOVED b/MOVED
--- a/MOVED
+++ b/MOVED
@@ -5159,3 +5159,9 @@
security/owasp-dependency-check||2026-02-28|Has expired: This port is 9 major versions and almost 8 years behind on upstream. No maintainer. No users in the ports tree. Does not compile with jdk11+
lang/go-devel|lang/go|2026-03-01|Has expired: Old version of Go. Use the go package (lang/go) instead
devel/tbb|devel/onetbb|2026-03-01|Has expired: Project moved to devel/onetbb
+ports-mgmt/portsnap||2026-04-30|Has expired: portsnap infrastructure will be removed after the EOL of 13.x
+security/ktls_isa-l_crypto-kmod||2026-04-30|Has expired: is only supported on FreeBSD 13
+security/openssl111||2026-04-30|End-of-life since 2023-09-11, see https://www.openssl.org/blog/blog/2023/09/11/eol-111/, port will be removed when FreeBSD 13 is EoL
+graphics/drm-510-kmod||2026-04-30|only for 13
+graphics/nvidia-drm-510-kmod||2026-04-30|only for 13
+graphics/nvidia-drm-510-kmod-devel||2026-04-30|only for 13
diff --git a/Mk/Features/ssp.mk b/Mk/Features/ssp.mk
--- a/Mk/Features/ssp.mk
+++ b/Mk/Features/ssp.mk
@@ -12,8 +12,7 @@
_SSP_MK_INCLUDED= yes
SSP_Include_MAINTAINER= portmgr@FreeBSD.org
-. if !defined(SSP_UNSAFE) && \
- (! ${ARCH:Mmips*})
+. if !defined(SSP_UNSAFE)
# Overridable as a user may want to use -fstack-protector-all
SSP_CFLAGS?= -fstack-protector-strong
CFLAGS+= ${SSP_CFLAGS}
diff --git a/Mk/Uses/qt-dist.mk b/Mk/Uses/qt-dist.mk
--- a/Mk/Uses/qt-dist.mk
+++ b/Mk/Uses/qt-dist.mk
@@ -265,7 +265,7 @@
${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_features_qt__module.prf \
${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_common_bsd_bsd.conf \
${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_freebsd-clang_qmake.conf
-. if ${ARCH:Mmips*} || (${ARCH:Mpowerpc*} && !exists(/usr/bin/clang))
+. if (${ARCH:Mpowerpc*} && !exists(/usr/bin/clang))
_EXTRA_PATCHES_QT5+= ${PORTSDIR}/devel/${_QT_RELNAME}/files/extra-patch-mkspecs_common_g++-base.conf \
${PORTSDIR}/devel/${_QT_RELNAME}/files/extra-patch-mkspecs_common_gcc-base.conf \
${PORTSDIR}/devel/${_QT_RELNAME}/files/extrapatch-mkspecs_freebsd-g++_qmake.conf
diff --git a/Mk/bsd.port.mk b/Mk/bsd.port.mk
--- a/Mk/bsd.port.mk
+++ b/Mk/bsd.port.mk
@@ -163,12 +163,12 @@
# IGNORE_${ARCH} - Port should be ignored on ${ARCH}.
# IGNORE_${OPSYS} - Port should be ignored on ${OPSYS}.
# IGNORE_${OPSYS}_${OSREL:R} - Port should be ignored on a single
-# release of ${OPSYS}, e.g IGNORE_FreeBSD_13
-# would affect all point releases of FreeBSD 13.
+# release of ${OPSYS}, e.g IGNORE_FreeBSD_14
+# would affect all point releases of FreeBSD 14.
# IGNORE_${OPSYS}_${OSREL:R}_${ARCH} - Port should be ignored on a
# single release of ${OPSYS} and specific architecture,
-# e.g IGNORE_FreeBSD_13_i386 would affect all point
-# releases of FreeBSD 13 in i386.
+# e.g IGNORE_FreeBSD_14_i386 would affect all point
+# releases of FreeBSD 14 in i386.
# BROKEN - Port is believed to be broken. Package builds can
# still be attempted using TRYBROKEN to test this
# assumption.
@@ -179,13 +179,13 @@
# can still be attempted using TRYBROKEN to
# test this assumption.
# BROKEN_${OPSYS}_${OSREL:R} - Port is believed to be broken on a single
-# release of ${OPSYS}, e.g BROKEN_FreeBSD_13
-# would affect all point releases of FreeBSD 13
+# release of ${OPSYS}, e.g BROKEN_FreeBSD_14
+# would affect all point releases of FreeBSD 14
# unless TRYBROKEN is also set.
# BROKEN_${OPSYS}_${OSREL:R}_${ARCH} - Port is believed to be broken on a
# single release of ${OPSYS} and specific architecture,
-# e.g BROKEN_FreeBSD_13 would affect all point
-# releases of FreeBSD 13 in i386
+# e.g BROKEN_FreeBSD_14 would affect all point
+# releases of FreeBSD 14 in i386
# unless TRYBROKEN is also set.
# DEPRECATED - Port is deprecated to install. Advisory only.
# EXPIRATION_DATE
@@ -1165,7 +1165,7 @@
. endif
_EXPORTED_VARS+= OSVERSION
-. if ${OPSYS} == FreeBSD && (${OSVERSION} < 1305000 || (${OSVERSION} >= 1400000 && ${OSVERSION} < 1403000))
+. if ${OPSYS} == FreeBSD && ${OSVERSION} < 1403000
_UNSUPPORTED_SYSTEM_MESSAGE= Ports Collection support for your ${OPSYS} version has ended, and no ports\
are guaranteed to build on this system. Please upgrade to a supported release.
. if defined(ALLOW_UNSUPPORTED_SYSTEM)
@@ -2213,11 +2213,7 @@
. if defined(PKG_NOCOMPRESS)
PKG_COMPRESSION_FORMAT?= tar
. else
-. if ${OSVERSION} > 1400000
PKG_COMPRESSION_FORMAT?= tzst
-. else
-PKG_COMPRESSION_FORMAT?= txz
-. endif
. endif
# where pkg(8) stores its data
diff --git a/Tools/scripts/tindex b/Tools/scripts/tindex
--- a/Tools/scripts/tindex
+++ b/Tools/scripts/tindex
@@ -27,8 +27,6 @@
# Location of ports tree and source trees
export BASEDIR=/a/tindex
export PORTSDIR=${BASEDIR}/ports
-export SRCDIR12=${BASEDIR}/src.12
-export SRCDIR13=${BASEDIR}/src.13
export SRCDIR14=${BASEDIR}/src.14
export OUTDIR=${BASEDIR}/out
@@ -113,17 +111,12 @@
export INDEX_QUIET=1
# First update the source trees to get current OSVERSION
-${SVN} -q up ${SRCDIR12}/sys/sys
-OSVERSION12=$(awk '/^#define[[:blank:]]__FreeBSD_version/ {print $3}' < ${SRCDIR12}/sys/sys/param.h)
-
-${GIT} -C ${SRCDIR13} pull --rebase -q
-OSVERSION13=$(awk '/^#define[[:blank:]]__FreeBSD_version/ {print $3}' < ${SRCDIR13}/sys/sys/param.h)
${GIT} -C ${SRCDIR14} pull --rebase -q
OSVERSION14=$(awk '/^#define[[:blank:]]__FreeBSD_version/ {print $3}' < ${SRCDIR14}/sys/sys/param.h)
cd ${PORTSDIR}
-for ver in 12 13 14; do
+for ver in 14; do
rm -f INDEX-${ver} INDEX-${ver}.bz2 INDEX-${ver}.xz INDEX-${ver}.zst
done
diff --git a/accessibility/hyprsunset/Makefile b/accessibility/hyprsunset/Makefile
--- a/accessibility/hyprsunset/Makefile
+++ b/accessibility/hyprsunset/Makefile
@@ -11,8 +11,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= fails to build: /usr/local/include/date/date.h:6636:15: error: no member named 'read' in namespace 'date::detail'; did you mean '::read'?
-
BUILD_DEPENDS= hyprwayland-scanner>=0.4.0:devel/hyprwayland-scanner \
hyprland-protocols>=0.4.0:graphics/hyprland-protocols \
wayland-protocols>0:graphics/wayland-protocols
diff --git a/archivers/lxqt-archiver/Makefile b/archivers/lxqt-archiver/Makefile
--- a/archivers/lxqt-archiver/Makefile
+++ b/archivers/lxqt-archiver/Makefile
@@ -24,10 +24,4 @@
USE_LXQT= buildtools2 libfmqt6 lxqt
USE_XORG= xcb
-.include <bsd.port.pre.mk>
-
-.if ${OSVERSION} < 1400504
-RUN_DEPENDS+= unzip:archivers/unzip
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/archivers/py-borgbackup/Makefile b/archivers/py-borgbackup/Makefile
--- a/archivers/py-borgbackup/Makefile
+++ b/archivers/py-borgbackup/Makefile
@@ -38,20 +38,6 @@
FUSE_DESC= Support to mount locally borg backup files
FUSE_RUN_DEPENDS= ${PYTHON_PKGNAMEPREFIX}llfuse>0:filesystems/py-llfuse@${PY_FLAVOR}
-.include <bsd.port.pre.mk>
-
-.if (${OPSYS} == FreeBSD) && ${OSVERSION} < 1400033 # why 1400033?
-# 1. check for the OLDEST (last in list) history entry on the file, when it was added:
-# git -C /usr/src hist lib/libc/posix1e/acl_extended_file_np.c
-# 2. check for the version you have obtained what __FreeBSD_version was
-# and increment by one. This is inaccurate for the interim between file addition
-# and __FreeBSD_version bump back then, but those versions were no releases and
-# should no longer be in the field.
-EXTRA_PATCHES += ${FILESDIR}/extrapatch-setup.py
-post-patch:
- ${CP} ${FILESDIR}/acl_extended_file_np.c ${WRKSRC}/src/borg/platform/
-.endif
-
_BORGHOME=${WRKDIR}/testhome
_BORGENV=-i BORG_PASSPHRASE=secret123 PYTHONPATH=${STAGEDIR}${PYTHON_SITELIBDIR} HOME=${_BORGHOME}
post-install:
@@ -87,4 +73,4 @@
# the PATH dance works around a strange "pkg-config" file not found error.
cd ${WRKSRC} && ${SETENV} ${_BORGENV} PATH=${PATH}:${LOCALBASE}/bin tox-${PYTHON_VER} -e ${PY_FLAVOR} -vv
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/archivers/py-borgbackup/files/acl_extended_file_np.c b/archivers/py-borgbackup/files/acl_extended_file_np.c
deleted file mode 100644
--- a/archivers/py-borgbackup/files/acl_extended_file_np.c
+++ /dev/null
@@ -1,83 +0,0 @@
-/*-
- * SPDX-License-Identifier: BSD-2-Clause
- *
- * Copyright (c) 2021 Gleb Popov
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/* taken from FreeBSD src branch as of 559a218c9b25 Wed Nov 1 16:43:37 2023 -0600 */
-/*
- * acl_extended_file_np: Check if the file has extended ACLs set.
- */
-
-#include <sys/param.h>
-#include <sys/errno.h>
-#include <sys/acl.h>
-
-#include <unistd.h>
-
-typedef acl_t (*acl_get_func)(const char *, acl_type_t);
-typedef long (*pathconf_func)(const char *, int);
-
-static int
-_acl_extended_file(acl_get_func f, pathconf_func pathconf_f, const char* path_p);
-
-int
-acl_extended_file_np(const char *path_p)
-{
- return (_acl_extended_file(acl_get_file, pathconf, path_p));
-}
-
-int
-acl_extended_file_nofollow_np(const char *path_p)
-{
- return (_acl_extended_file(acl_get_link_np, lpathconf, path_p));
-}
-
-int
-acl_extended_link_np(const char *path_p)
-{
- return (_acl_extended_file(acl_get_link_np, lpathconf, path_p));
-}
-
-int
-_acl_extended_file(acl_get_func acl_get, pathconf_func pathconf_f, const char* path_p)
-{
- acl_t acl;
- int retval, istrivial, acltype = ACL_TYPE_ACCESS;
-
- retval = pathconf_f(path_p, _PC_ACL_NFS4);
- if (retval > 0)
- acltype = ACL_TYPE_NFS4;
-
- acl = acl_get(path_p, acltype);
- if (acl == NULL)
- return (-1);
-
- retval = acl_is_trivial_np(acl, &istrivial);
- acl_free(acl);
- if (retval == -1)
- return (-1);
-
- return (!istrivial);
-}
diff --git a/archivers/py-borgbackup/files/extrapatch-setup.py b/archivers/py-borgbackup/files/extrapatch-setup.py
deleted file mode 100644
--- a/archivers/py-borgbackup/files/extrapatch-setup.py
+++ /dev/null
@@ -1,11 +0,0 @@
---- setup.py.orig 2024-07-02 22:06:38 UTC
-+++ setup.py
-@@ -181,7 +181,7 @@ if not on_rtd:
- syncfilerange_ext = Extension(
- "borg.platform.syncfilerange", [platform_syncfilerange_source], extra_compile_args=cflags
- )
-- freebsd_ext = Extension("borg.platform.freebsd", [platform_freebsd_source], extra_compile_args=cflags)
-+ freebsd_ext = Extension("borg.platform.freebsd", [platform_freebsd_source, 'src/borg/platform/acl_extended_file_np.c'], extra_compile_args=cflags)
- darwin_ext = Extension("borg.platform.darwin", [platform_darwin_source], extra_compile_args=cflags)
- windows_ext = Extension("borg.platform.windows", [platform_windows_source], extra_compile_args=cflags)
-
diff --git a/astro/openuniverse/Makefile b/astro/openuniverse/Makefile
--- a/astro/openuniverse/Makefile
+++ b/astro/openuniverse/Makefile
@@ -17,13 +17,6 @@
USE_XORG= ice sm x11 xext xi xmu xorgproto
GNU_CONFIGURE= yes
-
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
-LIBS+= -lcompat
-.else
LIBS+= -lutil
-.endif
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/audio/ardour/Makefile b/audio/ardour/Makefile
--- a/audio/ardour/Makefile
+++ b/audio/ardour/Makefile
@@ -113,14 +113,4 @@
post-install-VST3-on:
@${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/${ARDOUR_MAJOR}/ardour-vst3-scanner
-.include <bsd.port.pre.mk>
-
-# Some peripheral libraries are only built with libusb-1.0 >= 1.0.16
-.if ${OPSYS} == FreeBSD && \
- (1500000 <= ${OSVERSION} && ${OSVERSION} <= 1500019)
-PLIST_SUB+= LIBUSB="@comment "
-.else
-PLIST_SUB+= LIBUSB=""
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/audio/ardour/pkg-plist b/audio/ardour/pkg-plist
--- a/audio/ardour/pkg-plist
+++ b/audio/ardour/pkg-plist
@@ -92,7 +92,7 @@
lib/%%ARDOUR_MAJOR%%/sanityCheck
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_cc121.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_console1.so
-%%LIBUSB%%lib/%%ARDOUR_MAJOR%%/surfaces/libardour_contourdesign.so
+lib/%%ARDOUR_MAJOR%%/surfaces/libardour_contourdesign.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_faderport.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_faderport16.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_faderport2.so
@@ -105,7 +105,7 @@
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_launchpad_x.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_mcp.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_osc.so
-%%LIBUSB%%lib/%%ARDOUR_MAJOR%%/surfaces/libardour_push2.so
+lib/%%ARDOUR_MAJOR%%/surfaces/libardour_push2.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_ssl_uf8.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_us2400.so
lib/%%ARDOUR_MAJOR%%/surfaces/libardour_websockets.so
diff --git a/audio/denemo/Makefile b/audio/denemo/Makefile
--- a/audio/denemo/Makefile
+++ b/audio/denemo/Makefile
@@ -10,8 +10,6 @@
LICENSE= GPLv3+
-BROKEN_mips= fails to package: tar: Pathname cannot be converted from UTF-8 to current locale
-
LIB_DEPENDS= libaubio.so:audio/aubio \
libfluidsynth.so:audio/fluidsynth \
libjack.so:audio/jack \
diff --git a/audio/id3lib/Makefile b/audio/id3lib/Makefile
--- a/audio/id3lib/Makefile
+++ b/audio/id3lib/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv2+
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= fails to link: '_ZTSN12_GLOBAL__N_117ConstIteratorImplE' referenced in section '.data.rel.ro' of tag.lo: defined in discarded section
-BROKEN_mips64= fails to link: '_ZTSN12_GLOBAL__N_117ConstIteratorImplE' referenced in section '.data.rel.ro' of tag.lo: defined in discarded section
-
USES= cmake compiler:c11 cpe iconv pkgconfig
CMAKE_OFF= WITH_DOCS WITH_TESTS
diff --git a/audio/ncmpcpp/Makefile b/audio/ncmpcpp/Makefile
--- a/audio/ncmpcpp/Makefile
+++ b/audio/ncmpcpp/Makefile
@@ -52,10 +52,6 @@
.include <bsd.port.options.mk>
-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
-CONFIGURE_ENV= ncursesw_CFLAGS="-L${NCURSESLIB}" ncursesw_LIBS="-lncursesw"
-.endif
-
post-install:
${INSTALL_PROGRAM} ${WRKSRC}/src/ncmpcpp ${STAGEDIR}${PREFIX}/bin/
diff --git a/audio/siren/Makefile b/audio/siren/Makefile
--- a/audio/siren/Makefile
+++ b/audio/siren/Makefile
@@ -11,9 +11,6 @@
LICENSE= ISCL
LICENSE_FILE= ${WRKSRC}/LICENCE
-BROKEN_mips= fails to configure: cannot find program /nxb-bin/usr/bin/cc
-BROKEN_mips64= fails to configure: cannot find program /nxb-bin/usr/bin/cc
-
USES= localbase:ldflags ncurses pkgconfig
HAS_CONFIGURE= yes
USE_CSTD= c99
diff --git a/audio/xmcd/Makefile b/audio/xmcd/Makefile
--- a/audio/xmcd/Makefile
+++ b/audio/xmcd/Makefile
@@ -8,8 +8,6 @@
COMMENT= Motif CD player
WWW= https://www.ibiblio.org/tkan/xmcd/
-BROKEN_mips64= Fails to compile: many undefined symbols in xorg.cf
-
LIB_DEPENDS+= libvorbis.so:audio/libvorbis \
libFLAC.so:audio/flac
RUN_DEPENDS+= lame:audio/lame
diff --git a/benchmarks/libmicro/Makefile b/benchmarks/libmicro/Makefile
--- a/benchmarks/libmicro/Makefile
+++ b/benchmarks/libmicro/Makefile
@@ -8,9 +8,6 @@
LICENSE= CDDL
-BROKEN_mips64= Fails to build: bin-mips64: no such file or directory
-BROKEN_riscv64= Fails to build: bin-riscv64: no such file or directory
-
USES= gmake
WRKSRC= ${WRKDIR}/libMicro-${PORTVERSION}
STRIP= # Do not strip binaries
diff --git a/biology/avida/Makefile b/biology/avida/Makefile
--- a/biology/avida/Makefile
+++ b/biology/avida/Makefile
@@ -13,8 +13,6 @@
BROKEN_aarch64= invokes x86 assembler
BROKEN_armv6= invokes x86 assembler
BROKEN_armv7= invokes x86 assembler
-BROKEN_mips= invokes x86 assembler
-BROKEN_mips64= invokes x86 assembler
BROKEN_riscv64= invokes x86 assembler
USES= compiler:c11 cmake ncurses
diff --git a/biology/btllib/Makefile b/biology/btllib/Makefile
--- a/biology/btllib/Makefile
+++ b/biology/btllib/Makefile
@@ -11,7 +11,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # temporary until https://github.com/bcgsc/btllib/issues/117 is fixed
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # temporary until https://github.com/bcgsc/btllib/issues/117 is fixed
BUILD_DEPENDS= bash:shells/bash \
samtools:biology/samtools \
diff --git a/biology/bwa/Makefile b/biology/bwa/Makefile
--- a/biology/bwa/Makefile
+++ b/biology/bwa/Makefile
@@ -12,10 +12,6 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/COPYING
-# Recheck these after 0.7.18 update
-BROKEN_mips= fails to compile: cc1: unrecognized command line option "-msse2"
-BROKEN_mips64= fails to compile: cc1: unrecognized command line option "-msse2"
-
BUILD_DEPENDS= simde>0:devel/simde
USES= gmake localbase perl5 shebangfix
diff --git a/biology/canu/Makefile b/biology/canu/Makefile
--- a/biology/canu/Makefile
+++ b/biology/canu/Makefile
@@ -12,7 +12,7 @@
LICENSE= GPLv2
LICENSE_FILE= ${WRKDIR}/${PORTNAME}-${PORTVERSION}/README.license.GPL
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= Requires 64-bit processor
LIB_DEPENDS= libboost_regex.so:devel/boost-libs
diff --git a/biology/hhsuite/Makefile b/biology/hhsuite/Makefile
--- a/biology/hhsuite/Makefile
+++ b/biology/hhsuite/Makefile
@@ -11,7 +11,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe # not for 32-bit architectures, see https://github.com/soedinglab/hh-suite/issues/322#issuecomment-1264416293
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe # not for 32-bit architectures, see https://github.com/soedinglab/hh-suite/issues/322#issuecomment-1264416293
LIB_DEPENDS= libmpi.so:net/openmpi
diff --git a/biology/metaeuk/Makefile b/biology/metaeuk/Makefile
--- a/biology/metaeuk/Makefile
+++ b/biology/metaeuk/Makefile
@@ -10,7 +10,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENCE.md
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # 32-bit platforms produce wrong results based on https://github.com/soedinglab/metaeuk/issues/85#issuecomment-1888379107
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # 32-bit platforms produce wrong results based on https://github.com/soedinglab/metaeuk/issues/85#issuecomment-1888379107
NOT_FOR_ARCHS+= powerpc64 # many modules produce wrong results on big-endian architectures
BUILD_DEPENDS= xxd:editors/vim
diff --git a/biology/migrate/Makefile b/biology/migrate/Makefile
--- a/biology/migrate/Makefile
+++ b/biology/migrate/Makefile
@@ -15,7 +15,6 @@
# Waiting on build reports, 2024-03-27
#BROKEN_armv6= fails to build: make[2]: cannot open makefile
#BROKEN_armv7= fails to build: make[2]: cannot open makefile
-#BROKEN_mips= fails to build: make[2]: cannot open makefile
#BROKEN_riscv64= fails to build: make[2]: cannot open makefile
GNU_CONFIGURE= yes
diff --git a/biology/minimap2/Makefile b/biology/minimap2/Makefile
--- a/biology/minimap2/Makefile
+++ b/biology/minimap2/Makefile
@@ -10,7 +10,7 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LICENSE.txt
-NOT_FOR_ARCHS= i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= Requires 64-bit processor, except ARM NEON
BUILD_DEPENDS= simde>0:devel/simde
diff --git a/biology/mmseqs2/Makefile b/biology/mmseqs2/Makefile
--- a/biology/mmseqs2/Makefile
+++ b/biology/mmseqs2/Makefile
@@ -9,7 +9,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENSE.md
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
BUILD_DEPENDS= zstd>0:archivers/zstd
diff --git a/biology/plink/Makefile b/biology/plink/Makefile
--- a/biology/plink/Makefile
+++ b/biology/plink/Makefile
@@ -11,7 +11,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= aarch64 mips64 powerpc64
+NOT_FOR_ARCHS= aarch64 powerpc64
NOT_FOR_ARCHS_REASON= 64bit code requires SSE2 instructions
USES= gmake fortran
diff --git a/biology/preseq/Makefile b/biology/preseq/Makefile
--- a/biology/preseq/Makefile
+++ b/biology/preseq/Makefile
@@ -11,7 +11,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= 32-bit platforms are not useful for bioinformatics
LIB_DEPENDS= libhts.so:biology/htslib
diff --git a/biology/salmon/Makefile b/biology/salmon/Makefile
--- a/biology/salmon/Makefile
+++ b/biology/salmon/Makefile
@@ -11,7 +11,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= Requires 64-bit processor
# libtool and auto* are run manually in submodules, so don't put them in USES
diff --git a/biology/star/Makefile b/biology/star/Makefile
--- a/biology/star/Makefile
+++ b/biology/star/Makefile
@@ -11,7 +11,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKDIR}/STAR-${DISTVERSION}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= Requires 64-bit processor
.if !exists(/usr/include/omp.h)
BROKEN= requires OpenMP support that is missing on this architecture
diff --git a/cad/astk-serveur/Makefile b/cad/astk-serveur/Makefile
--- a/cad/astk-serveur/Makefile
+++ b/cad/astk-serveur/Makefile
@@ -14,7 +14,7 @@
LICENSE= GPLv2
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= ARG_MAX is too small for Code_Aster on 32 bits systems
#-----------------------------------------------------------------------
diff --git a/cad/fritzing/Makefile b/cad/fritzing/Makefile
--- a/cad/fritzing/Makefile
+++ b/cad/fritzing/Makefile
@@ -50,10 +50,4 @@
-f ${STAGEDIR}${DATADIR} \
-platform offscreen
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000 && ${SSL_DEFAULT} == "base"
-IGNORE= Requires OpenSSL >= 3
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/cad/gnucap/Makefile b/cad/gnucap/Makefile
--- a/cad/gnucap/Makefile
+++ b/cad/gnucap/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= defined in discarded section
-BROKEN_mips64= defined in discarded section
-
USES= gmake
USE_LDCONFIG= yes
diff --git a/cad/opencascade/Makefile b/cad/opencascade/Makefile
--- a/cad/opencascade/Makefile
+++ b/cad/opencascade/Makefile
@@ -144,7 +144,7 @@
.include <bsd.port.options.mk>
-.if ${ARCH} == armv6 || ${ARCH} == armv7 || ${ARCH} == mips || ${ARCH} == powerpc || ${ARCH} == powerpcspe || ${ARCH} == "i386"
+.if ${ARCH} == armv6 || ${ARCH} == armv7 || ${ARCH} == powerpc || ${ARCH} == powerpcspe || ${ARCH} == "i386"
BITS= 32
.else
BITS= 64
diff --git a/comms/librs232/Makefile b/comms/librs232/Makefile
--- a/comms/librs232/Makefile
+++ b/comms/librs232/Makefile
@@ -22,7 +22,7 @@
.include <bsd.port.options.mk>
-.if defined(NO_PROFILE) || ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
+.if defined(NO_PROFILE) || ${OPSYS} == FreeBSD
PLIST_SUB+= PROFILE="@comment "
.else
PLIST_SUB+= PROFILE=""
diff --git a/comms/mgetty+sendfax/Makefile b/comms/mgetty+sendfax/Makefile
--- a/comms/mgetty+sendfax/Makefile
+++ b/comms/mgetty+sendfax/Makefile
@@ -12,7 +12,6 @@
LICENSE= GPLv2
BROKEN_aarch64= fails to compile: error: initializer element is not a compile-time constant
-BROKEN_mips64= fails to compile: error: initializer element is not a compile-time constant
BROKEN_riscv64= fails to compile: error: initializer element is not a compile-time constant
USES= cpe makeinfo perl5 shebangfix
diff --git a/comms/uhd/Makefile b/comms/uhd/Makefile
--- a/comms/uhd/Makefile
+++ b/comms/uhd/Makefile
@@ -33,10 +33,6 @@
USE_GITHUB= yes
GH_ACCOUNT= EttusResearch
-BROKEN_FreeBSD_13_aarch64= fails to configure: Could not find standard set_new_handler function
-BROKEN_FreeBSD_13_armv6= fails to configure: Could not find standard set_new_handler function
-BROKEN_FreeBSD_13_armv7= fails to configure: Could not find standard set_new_handler function
-
CMAKE_SOURCE_PATH= ${WRKSRC}/host
#CXXFLAGS_amd64= -msse2 -std=c++11
CXXFLAGS_i386= -msse2
diff --git a/converters/iconv/Makefile b/converters/iconv/Makefile
--- a/converters/iconv/Makefile
+++ b/converters/iconv/Makefile
@@ -27,7 +27,7 @@
.include <bsd.port.pre.mk>
-.if defined(NO_PROFILE) || ${OSVERSION} > 1400001
+.if defined(NO_PROFILE) || ${OPSYS} == FreeBSD
PLIST_SUB+= PROFILE="@comment "
.else
PLIST_SUB+= PROFILE=""
diff --git a/databases/db18/Makefile b/databases/db18/Makefile
--- a/databases/db18/Makefile
+++ b/databases/db18/Makefile
@@ -20,8 +20,6 @@
LICENSE_FILE= ${WRKSRC}/../LICENSE
LICENSE_PERMS_UPL10= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
-BROKEN_mips64= no usable MUTEX implementation, assy works only for MIPS32, POSIX mutexes are unshared
-
USES= gmake libtool ssl
USE_LDCONFIG= yes
diff --git a/databases/kyotocabinet/Makefile b/databases/kyotocabinet/Makefile
--- a/databases/kyotocabinet/Makefile
+++ b/databases/kyotocabinet/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv3
-BROKEN_mips= fails to link: hidden symbol '__sync_lock_test_and_set_8' in /usr/lib/libgcc.a(stdatomic.o) is referenced by DSO
-BROKEN_mips64= fails to link: hidden symbol '__sync_lock_test_and_set_8' in /usr/lib/libgcc.a(stdatomic.o) is referenced by DSO
-
USES= compiler:c++11-lang gmake
CPPFLAGS+= -fPIC
diff --git a/databases/ldb25/Makefile b/databases/ldb25/Makefile
--- a/databases/ldb25/Makefile
+++ b/databases/ldb25/Makefile
@@ -69,7 +69,7 @@
lib/shared-modules/ldb/ldb.so lib/shared-modules/ldb/ldap.so \
lib/shared-modules/ldb/asq.so lib/shared-modules/ldb/tdb.so
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && \
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && \
${ARCH} != powerpc && ${ARCH} != powerpcspe
LDB_LIBS+= lib/ldb/libldb-mdb-int.so lib/shared-modules/ldb/mdb.so
.endif
diff --git a/databases/ldb28/Makefile b/databases/ldb28/Makefile
--- a/databases/ldb28/Makefile
+++ b/databases/ldb28/Makefile
@@ -104,7 +104,7 @@
.endif
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && \
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && \
${ARCH} != powerpc && ${ARCH} != powerpcspe
_LDB_LIBS_64= lib/ldb/libldb-mdb-int.so lib/shared-modules/ldb/mdb.so
.endif
diff --git a/databases/ldb29/Makefile b/databases/ldb29/Makefile
--- a/databases/ldb29/Makefile
+++ b/databases/ldb29/Makefile
@@ -104,7 +104,7 @@
.endif
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && \
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && \
${ARCH} != powerpc && ${ARCH} != powerpcspe
_LDB_LIBS_64= lib/ldb/libldb-mdb-int.so lib/shared-modules/ldb/mdb.so
.endif
diff --git a/databases/libcouchbase/Makefile b/databases/libcouchbase/Makefile
--- a/databases/libcouchbase/Makefile
+++ b/databases/libcouchbase/Makefile
@@ -10,8 +10,6 @@
LICENSE= APACHE20
-BROKEN_mips64= fails to link: ld: failed to merge target specific data
-
LIB_DEPENDS= libev.so:devel/libev \
libevent.so:devel/libevent \
libuv.so:devel/libuv
diff --git a/databases/postgresql-plv8js/Makefile b/databases/postgresql-plv8js/Makefile
--- a/databases/postgresql-plv8js/Makefile
+++ b/databases/postgresql-plv8js/Makefile
@@ -22,7 +22,7 @@
CXXFLAGS+= -std=c++17 -fno-rtti
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
CXXFLAGS+= -DV8_COMPRESS_POINTERS=1 -DV8_31BIT_SMIS_ON_64BIT_ARCH=1
.endif
MAKE_ARGS= CUSTOM_CC=${CXX} CCFLAGS="${CXXFLAGS}"
diff --git a/databases/soci/Makefile b/databases/soci/Makefile
--- a/databases/soci/Makefile
+++ b/databases/soci/Makefile
@@ -29,8 +29,6 @@
OPTIONS_EXCLUDE_aarch64= FIREBIRD
OPTIONS_EXCLUDE_armv6= FIREBIRD
OPTIONS_EXCLUDE_armv7= FIREBIRD
-OPTIONS_EXCLUDE_mips= FIREBIRD
-OPTIONS_EXCLUDE_mips64= FIREBIRD
OPTIONS_EXCLUDE_powerpc= FIREBIRD
OPTIONS_EXCLUDE_powerpc64= FIREBIRD
OPTIONS_EXCLUDE_powerpc64le= FIREBIRD
diff --git a/devel/aarch64-none-elf-gcc/Makefile b/devel/aarch64-none-elf-gcc/Makefile
--- a/devel/aarch64-none-elf-gcc/Makefile
+++ b/devel/aarch64-none-elf-gcc/Makefile
@@ -12,9 +12,6 @@
LICENSE= GPLv3 GPLv3RLE
LICENSE_COMB= multi
-BROKEN_mips= configure: error: cannot compute suffix of object files: cannot compile
-BROKEN_mips64= configure: error: cannot compute suffix of object files: cannot compile
-
LIB_DEPENDS= libgmp.so:math/gmp \
libmpfr.so:math/mpfr \
libmpc.so:math/mpc
diff --git a/devel/avr-gcc/Makefile b/devel/avr-gcc/Makefile
--- a/devel/avr-gcc/Makefile
+++ b/devel/avr-gcc/Makefile
@@ -11,8 +11,6 @@
LICENSE= GPLv3 GPLv3RLE
LICENSE_COMB= multi
-BROKEN_mips64= Fails to configure: cannot compute suffix of object files
-
BUILD_DEPENDS= avr-as:devel/binutils@avr \
avr-ld:devel/binutils@avr \
objdump:devel/binutils
diff --git a/devel/bcc/Makefile b/devel/bcc/Makefile
--- a/devel/bcc/Makefile
+++ b/devel/bcc/Makefile
@@ -11,8 +11,6 @@
LICENSE= GPLv2
BROKEN_aarch64= fails to link: error adding symbols: File in wrong format
-BROKEN_mips= fails to compile: unrecognized command line option "-m32"
-BROKEN_mips64= fails to compile: unrecognized command line option "-m32"
USES= uidfix
diff --git a/devel/binutils/Makefile b/devel/binutils/Makefile
--- a/devel/binutils/Makefile
+++ b/devel/binutils/Makefile
@@ -21,7 +21,7 @@
LIB_DEPENDS= libzstd.so:archivers/zstd
FLAVORS= native aarch64 aarch64_none_elf amd64 arm_gnueabi arm_none_eabi \
- avr i386 mingw32 mips mips64 powerpc powerpc64 powerpc64le riscv64 \
+ avr i386 mingw32 powerpc powerpc64 powerpc64le riscv64 \
riscv64_none_elf s390x riscv32_unknown_elf
FLAVOR?= native
@@ -80,10 +80,7 @@
PLIST_SUB= BUTARGET=${BUTARGET}
INFO_PATH= ${PKGNAMEPREFIX:S/-$//}/share/info
-.if ${FLAVOR} == aarch64
-BROKEN_mips= fails to configure: error: C compiler cannot create executables
-BROKEN_mips64= fails to configure: error: C compiler cannot create executables
-.elif ${FLAVOR} == aarch64_none_elf || ${FLAVOR} == arm_none_eabi || ${FLAVOR} == riscv64_none_elf || ${FLAVOR} == mingw32 || ${FLAVOR} == avr || ${FLAVOR} == riscv32_unknown_elf
+.if ${FLAVOR} == aarch64_none_elf || ${FLAVOR} == arm_none_eabi || ${FLAVOR} == riscv64_none_elf || ${FLAVOR} == mingw32 || ${FLAVOR} == avr || ${FLAVOR} == riscv32_unknown_elf
BUTARGET= ${FLAVOR:C/_/-/g}
.elif ${FLAVOR} == amd64
BUTARGET= x86_64-unknown-${OPSYS:tl}${OSREL}
@@ -133,7 +130,7 @@
.include <bsd.port.pre.mk>
# Actual earliest version may differ slightly
-.if (${ARCH} != mips && ${ARCH} != mips64 && ${ARCH} != powerpcspe && ${ARCH} != powerpc && ${ARCH} != powerpc64 && ${ARCH} != riscv64 && !defined(PKGNAMEPREFIX)) || ((${ARCH} == powerpc || ${ARCH} == powerpc64) && ${CHOSEN_COMPILER_TYPE} != gcc && !defined(PKGNAMEPREFIX))
+.if (${ARCH} != powerpcspe && ${ARCH} != powerpc && ${ARCH} != powerpc64 && ${ARCH} != riscv64 && !defined(PKGNAMEPREFIX)) || ((${ARCH} == powerpc || ${ARCH} == powerpc64) && ${CHOSEN_COMPILER_TYPE} != gcc && !defined(PKGNAMEPREFIX))
CONFIGURE_ARGS+= --enable-gold --enable-plugins
CXXFLAGS+= -Wno-c++11-narrowing
PLIST_SUB+= GOLD=""
diff --git a/devel/boost-all/compiled.mk b/devel/boost-all/compiled.mk
--- a/devel/boost-all/compiled.mk
+++ b/devel/boost-all/compiled.mk
@@ -46,8 +46,7 @@
.include <bsd.port.options.mk>
.if ${OPSYS} == FreeBSD && \
- ((${OSVERSION} >= 1500000 && ${OSVERSION} < 1500017) || \
- ${PORT_OPTIONS:MLLVM_FROM_PORTS})
+ ${PORT_OPTIONS:MLLVM_FROM_PORTS}
USES+= llvm:build
USES:= ${USES:Ncompiler\:*} # XXX avoid warnings
CHOSEN_COMPILER_TYPE= clang
diff --git a/devel/boost-libs/Makefile b/devel/boost-libs/Makefile
--- a/devel/boost-libs/Makefile
+++ b/devel/boost-libs/Makefile
@@ -15,8 +15,6 @@
# Build of this port fails with assertion failure of compiler due to
# bug of LLVM/Clang in base system. The failure happens when all of
# following conditions are satisfied.
-# * OSVERSION is included in either of following ranges.
-# 1. 1500000 <= OSVERSION < 1500017
# * Base system is built with WITH_LLVM_ASSERTIONS variable set.
# So if your base system fulfills them you need to use LLVM ports to
# build this port.
diff --git a/devel/cjose/Makefile b/devel/cjose/Makefile
--- a/devel/cjose/Makefile
+++ b/devel/cjose/Makefile
@@ -28,7 +28,7 @@
CFLAGS+= -Wno-error=strict-prototypes
.endif
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
CFLAGS+= -Wno-error=deprecated-declarations
.endif
diff --git a/devel/cpu_features/Makefile b/devel/cpu_features/Makefile
--- a/devel/cpu_features/Makefile
+++ b/devel/cpu_features/Makefile
@@ -10,8 +10,8 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= mips mips64 riscv64
-NOT_FOR_ARCHS_REASON= assumes android if on MIPS; not ported to riscv64
+NOT_FOR_ARCHS= riscv64
+NOT_FOR_ARCHS_REASON= not ported to riscv64
USES= cmake:testing
USE_GITHUB= yes
diff --git a/devel/critcl/Makefile b/devel/critcl/Makefile
--- a/devel/critcl/Makefile
+++ b/devel/critcl/Makefile
@@ -20,7 +20,7 @@
TEST_TARGET= test
PLIST_SUB= VER=${PORTVERSION} \
- ARCH=${ARCH:C/arm.*/arm/:S/i386/ix86/:S/aarch64/arm/:S/mips64/mips/:C/powerpc64.*/powerpc/}
+ ARCH=${ARCH:C/arm.*/arm/:S/i386/ix86/:S/aarch64/arm/:C/powerpc64.*/powerpc/}
PORTDOCS= *
diff --git a/devel/cssc/Makefile b/devel/cssc/Makefile
--- a/devel/cssc/Makefile
+++ b/devel/cssc/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv3
-BROKEN_mips= fails to compile: ../gl/lib/unistd.h:135:3: "Please include config.h first."
-BROKEN_mips64= fails to compile: ../gl/lib/unistd.h:135:3: "Please include config.h first."
-
USES= compiler:c11
GNU_CONFIGURE= yes
diff --git a/devel/cxxtools/Makefile b/devel/cxxtools/Makefile
--- a/devel/cxxtools/Makefile
+++ b/devel/cxxtools/Makefile
@@ -12,8 +12,6 @@
LICENSE_FILE= ${WRKSRC}/COPYING
BROKEN_aarch64= does not configure: error: check for atomictype failed
-BROKEN_mips= does not configure: in section .data.rel.ro of csvdeserializer-test.o: defined in discarded section
-BROKEN_mips64= does not configure: in section .data.rel.ro of csvdeserializer-test.o: defined in discarded section
BROKEN_riscv64= does not configure: error: check for atomictype failed
USES= cpe iconv libtool localbase pathfix
@@ -51,12 +49,6 @@
PLIST_SUB+= ARM_ONLY="@comment "
.endif
-.if ${ARCH:Mmips*}
-PLIST_SUB+= MIPS_ONLY=""
-.else
-PLIST_SUB+= MIPS_ONLY="@comment "
-.endif
-
.if ${ARCH:Mpowerpc*}
PLIST_SUB+= PPC_ONLY=""
.else
diff --git a/devel/cxxtools/pkg-plist b/devel/cxxtools/pkg-plist
--- a/devel/cxxtools/pkg-plist
+++ b/devel/cxxtools/pkg-plist
@@ -32,7 +32,6 @@
%%X86_64_ONLY%%include/cxxtools/atomicity.gcc.x86_64.h
%%I386_ONLY%%include/cxxtools/atomicity.gcc.x86.h
%%ARM_ONLY%%include/cxxtools/atomicity.gcc.arm.h
-%%MIPS_ONLY%%include/cxxtools/atomicity.gcc.mips.h
%%PPC_ONLY%%include/cxxtools/atomicity.gcc.ppc.h
include/cxxtools/atomicity.h
include/cxxtools/base64codec.h
@@ -126,7 +125,6 @@
include/cxxtools/membar.gcc.nosmp.h
%%X86_ONLY%%include/cxxtools/membar.gcc.x86.h
%%ARM_ONLY%%include/cxxtools/membar.gcc.arm.h
-%%MIPS_ONLY%%include/cxxtools/membar.gcc.mips.h
%%PPC_ONLY%%include/cxxtools/membar.gcc.ppc.h
include/cxxtools/membar.h
include/cxxtools/method.h
diff --git a/devel/dbus/Makefile b/devel/dbus/Makefile
--- a/devel/dbus/Makefile
+++ b/devel/dbus/Makefile
@@ -79,10 +79,4 @@
${MV} ${file} ${file}.sample
.endfor
-.include <bsd.port.pre.mk>
-
-.if ${OSVERSION} < 1400000
-MESON_ARGS+= -Db_lundef=false
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/devel/efivar/Makefile b/devel/efivar/Makefile
--- a/devel/efivar/Makefile
+++ b/devel/efivar/Makefile
@@ -11,7 +11,6 @@
NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= specification only supports little-endian processors
-BROKEN_FreeBSD_13= requires at least FreeBSD 14
BUILD_DEPENDS= gsed:textproc/gsed
LIB_DEPENDS= libpopt.so:devel/popt
diff --git a/devel/folly/Makefile b/devel/folly/Makefile
--- a/devel/folly/Makefile
+++ b/devel/folly/Makefile
@@ -10,7 +10,6 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= compilation fails: use of undeclared identifier 'clearenv'
BROKEN_i386= error: use of undeclared identifier 'DCHECK': https://github.com/facebook/folly/issues/1168
BROKEN_powerpc= compilation fails: Big endian requires a redesigned table (assert in folly/detail/base64_detail/Base64SWAR.cpp:107)
BROKEN_powerpc64= compilation fails: Big endian requires a redesigned table (assert in folly/detail/base64_detail/Base64SWAR.cpp:107)
diff --git a/devel/gcc-arm-embedded/Makefile b/devel/gcc-arm-embedded/Makefile
--- a/devel/gcc-arm-embedded/Makefile
+++ b/devel/gcc-arm-embedded/Makefile
@@ -12,7 +12,7 @@
LICENSE= GPLv2 LGPL20 LGPL21 GPLv3 LGPL3
LICENSE_COMB= multi
-NOT_FOR_ARCHS= arm armv6 armv7 mips mips64 mips64el mipsel mipsn32
+NOT_FOR_ARCHS= arm armv6 armv7
NOT_FOR_ARCHS_REASON= Very slow to build on emulator
BUILD_DEPENDS= bash:shells/bash \
diff --git a/devel/hyprwire/Makefile b/devel/hyprwire/Makefile
--- a/devel/hyprwire/Makefile
+++ b/devel/hyprwire/Makefile
@@ -27,12 +27,6 @@
OPTIONS_DEFINE= DOCS
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-.endif
-
post-install-DOCS-on:
@${MKDIR} ${STAGEDIR}${DOCSDIR}
${INSTALL_MAN} ${PORTDOCS:S|^|${WRKSRC}/|} ${STAGEDIR}${DOCSDIR}
diff --git a/devel/judy/Makefile b/devel/judy/Makefile
--- a/devel/judy/Makefile
+++ b/devel/judy/Makefile
@@ -10,9 +10,6 @@
LICENSE= LGPL21
-BROKEN_mips= fails to compile: unrecognized command line option "-m32"
-BROKEN_mips64= fails to compile: unrecognized command line option "-m64"
-
USES= gmake libtool
GNU_CONFIGURE= yes
GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
diff --git a/devel/kunifiedpush/Makefile b/devel/kunifiedpush/Makefile
--- a/devel/kunifiedpush/Makefile
+++ b/devel/kunifiedpush/Makefile
@@ -11,6 +11,4 @@
ecm:build
USE_QT= base declarative websockets
-IGNORE_FreeBSD_13= does not build with OpenSSL 1.1.1
-
.include <bsd.port.mk>
diff --git a/devel/kyua/Makefile b/devel/kyua/Makefile
--- a/devel/kyua/Makefile
+++ b/devel/kyua/Makefile
@@ -41,7 +41,7 @@
TEST_CONFIGURE_ENABLE= atf
# TODO: Get back to IGNORE after the alignment with the dependent ports
-#.if ${OPSYS} == FreeBSD && ${OSREL:R} >= 14
+#.if ${OPSYS} == FreeBSD
#IGNORE= kyua from base must be used for FreeBSD 14.x and newer
#.endif
diff --git a/devel/libdistance/Makefile b/devel/libdistance/Makefile
--- a/devel/libdistance/Makefile
+++ b/devel/libdistance/Makefile
@@ -23,7 +23,7 @@
.include <bsd.port.options.mk>
-.if defined(NOPROFILE) || defined(NO_PROFILE) || ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
+.if defined(NOPROFILE) || defined(NO_PROFILE) || ${OPSYS} == FreeBSD
PLIST_SUB+= PROFILE="@comment "
.else
PLIST_SUB+= PROFILE=""
diff --git a/devel/libhoard/Makefile b/devel/libhoard/Makefile
--- a/devel/libhoard/Makefile
+++ b/devel/libhoard/Makefile
@@ -12,9 +12,6 @@
LICENSE= GPLv2+
LICENSE_FILE= ${WRKSRC}/../COPYING
-BROKEN_mips= no spin lock implementation is available for this platform
-BROKEN_mips64= no spin lock implementation is available for this platform
-
WRKSRC= ${WRKDIR}/Hoard/src
MAKEFILE= GNUmakefile
USES= gmake compiler:c++14-lang
diff --git a/devel/libmtrie/Makefile b/devel/libmtrie/Makefile
--- a/devel/libmtrie/Makefile
+++ b/devel/libmtrie/Makefile
@@ -14,7 +14,7 @@
.include <bsd.port.pre.mk>
-.if defined(NO_PROFILE) || ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
+.if defined(NO_PROFILE) || ${OPSYS} == FreeBSD
PLIST_SUB+= HURRRR="@comment "
.else
PLIST_SUB+= HURRRR=""
diff --git a/devel/libruin/Makefile b/devel/libruin/Makefile
--- a/devel/libruin/Makefile
+++ b/devel/libruin/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv3+
LICENSE_FILE= ${WRKSRC}/COPYING
-NOT_FOR_ARCHS= mips
-NOT_FOR_ARCHS_REASON= glib needs GCC (not available for mips)
-
BUILD_DEPENDS= guile-lib-${GUILE_FLAVOR}>0:devel/guile-lib@${GUILE_FLAVOR}
RUN_DEPENDS= guile-lib-${GUILE_FLAVOR}>0:devel/guile-lib@${GUILE_FLAVOR}
diff --git a/devel/libvex/Makefile b/devel/libvex/Makefile
--- a/devel/libvex/Makefile
+++ b/devel/libvex/Makefile
@@ -21,7 +21,7 @@
MAKEFILE= Makefile-gcc
-CFLAGS+= -DVGA_${ARCH:S/i386/x86/:S/aarch64/arm/:S/powerpc64le/ppc64le/:S/powerpc64/ppc64/:S/powerpc/ppc32/:S/mips/mips64/}
+CFLAGS+= -DVGA_${ARCH:S/i386/x86/:S/aarch64/arm/:S/powerpc64le/ppc64le/:S/powerpc64/ppc64/:S/powerpc/ppc32/}
MAKE_ARGS= EXTRA_CFLAGS="${CFLAGS}"
diff --git a/devel/lightning/Makefile b/devel/lightning/Makefile
--- a/devel/lightning/Makefile
+++ b/devel/lightning/Makefile
@@ -10,7 +10,7 @@
LICENSE= LGPL3+
LICENSE_FILE= ${WRKSRC}/COPYING.LESSER
-ONLY_FOR_ARCHS= aarch64 amd64 armv6 armv7 i386 mips powerpc powerpc64 powerpc64le powerpcspe riscv64
+ONLY_FOR_ARCHS= aarch64 amd64 armv6 armv7 i386 powerpc powerpc64 powerpc64le powerpcspe riscv64
USES= cpe libtool pathfix
CPE_VENDOR= gnu
diff --git a/devel/llvm-cheri/Makefile b/devel/llvm-cheri/Makefile
--- a/devel/llvm-cheri/Makefile
+++ b/devel/llvm-cheri/Makefile
@@ -10,7 +10,7 @@
.include "${.PARSEDIR}/../llvm-devel/Makefile.LICENSE"
-NOT_FOR_ARCHS= i386 armv6 armv7 powerpc mips
+NOT_FOR_ARCHS= i386 armv6 armv7 powerpc
NOT_FOR_ARCHS_REASON= No one will develop CHERI from 32-bit
LLVM_SUFFIX?= -cheri
diff --git a/devel/llvm-cheriot/Makefile b/devel/llvm-cheriot/Makefile
--- a/devel/llvm-cheriot/Makefile
+++ b/devel/llvm-cheriot/Makefile
@@ -11,7 +11,7 @@
.include "${.PARSEDIR}/../llvm-devel/Makefile.LICENSE"
-NOT_FOR_ARCHS= i386 armv6 armv7 powerpc mips
+NOT_FOR_ARCHS= i386 armv6 armv7 powerpc
NOT_FOR_ARCHS_REASON= No one will develop CHERI from 32-bit
LLVM_SUFFIX= -cheriot
diff --git a/devel/llvm12/Makefile b/devel/llvm12/Makefile
--- a/devel/llvm12/Makefile
+++ b/devel/llvm12/Makefile
@@ -264,7 +264,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -274,8 +274,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -301,7 +299,6 @@
_BE_LIBS_Hexagon= AsmParser Disassembler
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_RISCV= AsmParser Disassembler
_BE_LIBS_Sparc= AsmParser Disassembler
diff --git a/devel/llvm13/Makefile b/devel/llvm13/Makefile
--- a/devel/llvm13/Makefile
+++ b/devel/llvm13/Makefile
@@ -301,7 +301,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -311,8 +311,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -340,8 +338,6 @@
_BE_LIBS_Hexagon= AsmParser Disassembler
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_LIBS_RISCV= AsmParser Disassembler
diff --git a/devel/llvm14/Makefile b/devel/llvm14/Makefile
--- a/devel/llvm14/Makefile
+++ b/devel/llvm14/Makefile
@@ -302,7 +302,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -312,8 +312,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -341,8 +339,6 @@
_BE_LIBS_Hexagon= AsmParser Disassembler
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_INCS_RISCV= riscv_vector.h
diff --git a/devel/llvm15/Makefile b/devel/llvm15/Makefile
--- a/devel/llvm15/Makefile
+++ b/devel/llvm15/Makefile
@@ -324,7 +324,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -334,8 +334,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -363,8 +361,6 @@
_BE_LIBS_Hexagon= AsmParser Disassembler
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_INCS_RISCV= riscv_vector.h
diff --git a/devel/llvm16/Makefile b/devel/llvm16/Makefile
--- a/devel/llvm16/Makefile
+++ b/devel/llvm16/Makefile
@@ -330,7 +330,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -340,8 +340,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -370,8 +368,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_INCS_RISCV= riscv_vector.h
diff --git a/devel/llvm17/Makefile b/devel/llvm17/Makefile
--- a/devel/llvm17/Makefile
+++ b/devel/llvm17/Makefile
@@ -334,7 +334,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -344,8 +344,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -378,8 +376,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_INCS_RISCV= riscv_vector.h
diff --git a/devel/llvm18/Makefile b/devel/llvm18/Makefile
--- a/devel/llvm18/Makefile
+++ b/devel/llvm18/Makefile
@@ -338,7 +338,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -348,8 +348,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -382,8 +380,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_MODS_PowerPC= __ppc_intrinsics.f18.mod __ppc_intrinsics.mod \
diff --git a/devel/llvm19/Makefile b/devel/llvm19/Makefile
--- a/devel/llvm19/Makefile
+++ b/devel/llvm19/Makefile
@@ -355,7 +355,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -365,8 +365,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -399,8 +397,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_MODS_PowerPC= __ppc_intrinsics.mod mma.mod
diff --git a/devel/llvm20/Makefile b/devel/llvm20/Makefile
--- a/devel/llvm20/Makefile
+++ b/devel/llvm20/Makefile
@@ -361,7 +361,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -371,8 +371,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -406,8 +404,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_MODS_PowerPC= __ppc_intrinsics.mod mma.mod
diff --git a/devel/llvm21/Makefile b/devel/llvm21/Makefile
--- a/devel/llvm21/Makefile
+++ b/devel/llvm21/Makefile
@@ -361,7 +361,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -371,8 +371,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -406,8 +404,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_MODS_PowerPC= __ppc_intrinsics.mod mma.mod
diff --git a/devel/llvm22/Makefile b/devel/llvm22/Makefile
--- a/devel/llvm22/Makefile
+++ b/devel/llvm22/Makefile
@@ -361,7 +361,7 @@
.include "${.CURDIR}/Makefile.COMMANDS"
.include "${.CURDIR}/Makefile.MAN1SRCS"
-_FREEBSD_BACKENDS= AArch64 ARM Mips PowerPC RISCV Sparc X86
+_FREEBSD_BACKENDS= AArch64 ARM PowerPC RISCV Sparc X86
FREEBSD_BACKENDS= ${_FREEBSD_BACKENDS}
.if ${ARCH} == amd64
_NATIVE_BACKENDS= X86
@@ -371,8 +371,6 @@
_NATIVE_BACKENDS= ARM
.elif ${ARCH} == i386
_NATIVE_BACKENDS= X86
-.elif ${ARCH:Mmips*}
-_NATIVE_BACKENDS= Mips
.elif ${ARCH:Mpowerpc*}
_NATIVE_BACKENDS= PowerPC
.elif ${ARCH:Mriscv*}
@@ -406,8 +404,6 @@
_BE_LIBS_Lanai= AsmParser Disassembler
_BE_LIBS_LoongArch= AsmParser Disassembler
_BE_LIBS_MSP430= AsmParser Disassembler
-_BE_LIBS_Mips= AsmParser Disassembler
-_BE_LIBS_BACKWARDS_Mips=Exegesis
_BE_LIBS_PowerPC= AsmParser Disassembler
_BE_LIBS_BACKWARDS_PowerPC=Exegesis
_BE_MODS_PowerPC= __ppc_intrinsics.mod mma.mod
diff --git a/devel/love/Makefile b/devel/love/Makefile
--- a/devel/love/Makefile
+++ b/devel/love/Makefile
@@ -12,7 +12,7 @@
LICENSE= ZLIB
LICENSE_FILE= ${WRKSRC}/license.txt
-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= Hashing not yet implemented for big endian
LIB_DEPENDS= libmodplug.so:audio/libmodplug \
diff --git a/devel/mongo-c-driver/Makefile b/devel/mongo-c-driver/Makefile
--- a/devel/mongo-c-driver/Makefile
+++ b/devel/mongo-c-driver/Makefile
@@ -86,7 +86,7 @@
CMAKE_ARGS+= -DENABLE_SSL=LIBRESSL
.endif
CMAKE_ARGS+= -DENABLE_SSL=OPENSSL
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
CFLAGS+= -DOPENSSL_API_COMPAT=0x30000000L
.endif
.endif
diff --git a/devel/notcurses/Makefile b/devel/notcurses/Makefile
--- a/devel/notcurses/Makefile
+++ b/devel/notcurses/Makefile
@@ -18,7 +18,7 @@
libqrcodegen.so:graphics/qr-code-generator \
libunistring.so:devel/libunistring
-USES= cmake:noninja compiler:c++17-lang localbase pkgconfig
+USES= cmake:noninja compiler:c++17-lang localbase ncurses pkgconfig
USE_GITHUB= yes
GH_ACCOUNT= dankamongmen
USE_LDCONFIG= yes
@@ -41,13 +41,6 @@
.include <bsd.port.options.mk>
-# ncursesw and tinfo >= 6.1 seem to be needed (see CMakeLists.txt:l104)
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400035
-USES+=ncurses:port
-.else
-USES+=ncurses
-.endif
-
post-patch-DOCS-off:
@${REINPLACE_CMD} -e 's|install(FILES $${MARKDOWN} DESTINATION $${CMAKE_INSTALL_DOCDIR})|#install(FILES $${MARKDOWN} DESTINATION $${CMAKE_INSTALL_DOCDIR})|' \
${WRKSRC}/CMakeLists.txt
diff --git a/devel/objconv/Makefile b/devel/objconv/Makefile
--- a/devel/objconv/Makefile
+++ b/devel/objconv/Makefile
@@ -10,7 +10,7 @@
LICENSE= GPLv1
-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= source/maindef.h:71:5: This machine has big-endian memory organization. Objconv program will not work
USES= dos2unix zip
diff --git a/devel/ocaml-extlib/Makefile b/devel/ocaml-extlib/Makefile
--- a/devel/ocaml-extlib/Makefile
+++ b/devel/ocaml-extlib/Makefile
@@ -12,8 +12,6 @@
LICENSE= LGPL21
LICENSE_FILE= ${WRKSRC}/../LICENSE
-BROKEN_mips= depends on Ocaml(not available for mips)
-
BUILD_DEPENDS= cppo:devel/ocaml-cppo
USES= gmake ocaml:camlp4,findplist
diff --git a/devel/p5-Data-MessagePack-Stream/Makefile b/devel/p5-Data-MessagePack-Stream/Makefile
--- a/devel/p5-Data-MessagePack-Stream/Makefile
+++ b/devel/p5-Data-MessagePack-Stream/Makefile
@@ -8,9 +8,6 @@
COMMENT= Perl extension for yet another messagepack streaming deserializer
WWW= https://metacpan.org/release/Data-MessagePack-Stream
-BROKEN_mips= fails to build: atomic operations are not found
-BROKEN_mips64= fails to build: atomic operations are not found
-
BUILD_DEPENDS= p5-File-Which>=0:sysutils/p5-File-Which \
p5-Module-Build-XSUtil>=0:devel/p5-Module-Build-XSUtil \
${RUN_DEPENDS}
diff --git a/devel/pcre/Makefile b/devel/pcre/Makefile
--- a/devel/pcre/Makefile
+++ b/devel/pcre/Makefile
@@ -38,7 +38,6 @@
OPTIONS_DEFAULT_aarch64+= JIT
OPTIONS_DEFAULT_amd64+= JIT
OPTIONS_DEFAULT_i386+= JIT
-OPTIONS_DEFAULT_mips+= JIT
OPTIONS_DEFAULT_powerpc=JIT
OPTIONS_DEFAULT_powerpc64= JIT
OPTIONS_DEFAULT_powerpc64le= JIT
diff --git a/devel/pcre2/Makefile b/devel/pcre2/Makefile
--- a/devel/pcre2/Makefile
+++ b/devel/pcre2/Makefile
@@ -48,7 +48,7 @@
.include <bsd.port.options.mk>
-.if ${ARCH:Mmips64*} == "" && ${ARCH:Mriscv64*} == ""
+.if ${ARCH:Mriscv64*} == ""
CMAKE_ON+= PCRE2_SUPPORT_JIT
.else
CMAKE_OFF+= PCRE2_SUPPORT_JIT
diff --git a/devel/pecl-grpc/Makefile b/devel/pecl-grpc/Makefile
--- a/devel/pecl-grpc/Makefile
+++ b/devel/pecl-grpc/Makefile
@@ -9,9 +9,6 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_mips= fails to compile: fatal error: sys/auxv.h file not found
-BROKEN_mips64= fails to compile: fatal error: sys/auxv.h file not found
-
USES= compiler:c++11-lang php:pecl
.include <bsd.port.mk>
diff --git a/devel/pickle/Makefile b/devel/pickle/Makefile
--- a/devel/pickle/Makefile
+++ b/devel/pickle/Makefile
@@ -12,8 +12,6 @@
BROKEN_armv6= invokes x86 assembler
BROKEN_armv7= invokes x86 assembler
-BROKEN_mips= invokes x86 assembler
-BROKEN_mips64= invokes x86 assembler
USES= gmake tar:tgz
diff --git a/devel/py-greenlet/Makefile b/devel/py-greenlet/Makefile
--- a/devel/py-greenlet/Makefile
+++ b/devel/py-greenlet/Makefile
@@ -14,9 +14,6 @@
LICENSE_FILE_MIT= ${WRKSRC}/LICENSE
LICENSE_FILE_PSFL= ${WRKSRC}/LICENSE.PSF
-NOT_FOR_ARCHS= mips mips64
-NOT_FOR_ARCHS_REASON= greenlet needs to be ported to this platform
-
BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}setuptools>=61:devel/py-setuptools@${PY_FLAVOR} \
${PYTHON_PKGNAMEPREFIX}wheel>=0:devel/py-wheel@${PY_FLAVOR}
diff --git a/devel/radare2/Makefile b/devel/radare2/Makefile
--- a/devel/radare2/Makefile
+++ b/devel/radare2/Makefile
@@ -10,7 +10,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/COPYING
-NOT_FOR_ARCHS= armv6 armv7 mips mips64 powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 powerpcspe
NOT_FOR_ARCHS_REASON= does not build: Unsupported BSD architecture
LIB_DEPENDS= libcapstone.so:devel/capstone
diff --git a/devel/skalibs/Makefile b/devel/skalibs/Makefile
--- a/devel/skalibs/Makefile
+++ b/devel/skalibs/Makefile
@@ -10,8 +10,6 @@
LICENSE= ISCL
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips64= fails to build: Checking whether system has auto-close after fd-passing... test crashed, aborting
-
USES= gmake
USE_LDCONFIG= yes
HAS_CONFIGURE= yes
diff --git a/devel/tex-libtexluajit/Makefile b/devel/tex-libtexluajit/Makefile
--- a/devel/tex-libtexluajit/Makefile
+++ b/devel/tex-libtexluajit/Makefile
@@ -12,8 +12,6 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LuaJIT-src/COPYRIGHT
-BROKEN_mips= Does not configure: error: Sorry, cannot preprocess lj_arch.h
-BROKEN_mips64= Does not configure: error: Sorry, cannot preprocess lj_arch.h
BROKEN_powerpc64= Does not build: uninitialized constant Config (NameError)
BROKEN_riscv64= Does not configure: error: Sorry, cannot preprocess lj_arch.h
diff --git a/dns/dnsdist/Makefile b/dns/dnsdist/Makefile
--- a/dns/dnsdist/Makefile
+++ b/dns/dnsdist/Makefile
@@ -99,20 +99,13 @@
OPENSSL_USES= ssl
OPENSSL_MESON_ENABLED= libcrypto tls-libssl
-OPENSSL_MESON_ON= -Dlibcrypto-path=${OPENSSLBASE}
+OPENSSL_MESON_ON= -Dlibcrypto-path=${OPENSSLBASE} -Dtls-libssl-engines=true
SNMP_LIB_DEPENDS= libnetsnmp.so:net-mgmt/net-snmp
SNMP_MESON_ENABLED= snmp
-.include <bsd.port.pre.mk>
-
-.if !(${OSVERSION} < 1400000 && ${SSL_DEFAULT} == "base")
-OPENSSL_MESON_ON+= -Dtls-libssl-providers=true
-.else
-OPENSSL_MESON_ON+= -Dtls-libssl-engines=true
-.endif
post-install:
${MV} ${STAGEDIR}${ETCDIR}/dnsdist.conf-dist ${STAGEDIR}${ETCDIR}/dnsdist.conf.sample
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/dns/dog/Makefile b/dns/dog/Makefile
--- a/dns/dog/Makefile
+++ b/dns/dog/Makefile
@@ -105,7 +105,7 @@
.include <bsd.port.options.mk>
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl} || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl} || ${SSL_DEFAULT:Mopenssl3*}
BROKEN= Fails to detect OpenSSL 3.0.0 and later
.endif
diff --git a/editors/libreoffice/Makefile b/editors/libreoffice/Makefile
--- a/editors/libreoffice/Makefile
+++ b/editors/libreoffice/Makefile
@@ -366,11 +366,6 @@
.include <bsd.port.pre.mk>
-.if ${OPSYS} == FreeBSD && ( \
- (${OSVERSION} >= 1400051 && ${OSVERSION} < 1400057))
-BROKEN= please update FreeBSD base system first to fix an ABI incompatibility
-.endif
-
.if ${ARCH} == powerpc || ${ARCH} == powerpcspe || ${ARCH} == powerpc64
CONFIGURE_ARGS+= --disable-skia
.endif
diff --git a/emulators/mesen/Makefile b/emulators/mesen/Makefile
--- a/emulators/mesen/Makefile
+++ b/emulators/mesen/Makefile
@@ -8,7 +8,7 @@
LICENSE= GPLv3
-# ARM/MIPS are only supported on Android
+# ARM is only supported on Android
ONLY_FOR_ARCHS= amd64 i386
BUILD_DEPENDS= zip:archivers/zip \
diff --git a/emulators/ppsspp/Makefile b/emulators/ppsspp/Makefile
--- a/emulators/ppsspp/Makefile
+++ b/emulators/ppsspp/Makefile
@@ -13,7 +13,7 @@
LICENSE_FILE= ${WRKSRC}/LICENSE.TXT
# Bi-endian architectures default to big for some reason
-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= only little-endian is supported, see \
https://github.com/hrydgard/ppsspp/issues/8823
diff --git a/filesystems/fusefs-libs3/Makefile b/filesystems/fusefs-libs3/Makefile
--- a/filesystems/fusefs-libs3/Makefile
+++ b/filesystems/fusefs-libs3/Makefile
@@ -22,9 +22,6 @@
.include <bsd.port.pre.mk>
-.if ${OPSYS} == "FreeBSD" && ${OSVERSION} < 1400014
-EXTRA_PATCHES= ${FILESDIR}/extra-patch-test_meson.build
-.endif
.if ${OPSYS} == DragonFly
IGNORE= fusefs has not been implemented on DragonFly
.endif
diff --git a/filesystems/py-libzfs/Makefile b/filesystems/py-libzfs/Makefile
--- a/filesystems/py-libzfs/Makefile
+++ b/filesystems/py-libzfs/Makefile
@@ -29,7 +29,7 @@
EXTRA_PATCHES+= ${FILESDIR}/extra-libuutil.patch
.endif
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1401000
+.if ${OPSYS} == FreeBSD
EXTRA_PATCHES+= ${FILESDIR}/extra-zpool-add.patch
.endif
@@ -37,7 +37,7 @@
IGNORE= requires kernel source files in ${SRC_BASE}
.endif
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400000
+.if ${OPSYS} == FreeBSD
PATCH_SITES= https://github.com/${GH_ACCOUNT}/${GH_PROJECT}/commit/
PATCHFILES+= 0b2ab0594997c44e80e3fdfe9d2add106d81149a.diff:-p1 # backport of https://github.com/truenas/py-libzfs/pull/251
.endif
diff --git a/finance/fabric/Makefile b/finance/fabric/Makefile
--- a/finance/fabric/Makefile
+++ b/finance/fabric/Makefile
@@ -12,7 +12,7 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # compilation fails on non-64-bit systems: fabric-amcl/core/FP256BN/FP.go:111:19: cannot convert MConst (constant 30564559323915749 of type Chunk) to type int
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # compilation fails on non-64-bit systems: fabric-amcl/core/FP256BN/FP.go:111:19: cannot convert MConst (constant 30564559323915749 of type Chunk) to type int
USES= go:modules
USE_GITHUB= yes
diff --git a/french/aster/Makefile b/french/aster/Makefile
--- a/french/aster/Makefile
+++ b/french/aster/Makefile
@@ -9,7 +9,7 @@
LICENSE= GPLv2
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
NOT_FOR_ARCHS_REASON= ARG_MAX is too small for Code_Aster on 32 bits systems
BROKEN= fails to build the catalog of elements
diff --git a/ftp/fastdfs/Makefile b/ftp/fastdfs/Makefile
--- a/ftp/fastdfs/Makefile
+++ b/ftp/fastdfs/Makefile
@@ -10,9 +10,6 @@
LICENSE= GPLv3+
LICENSE_FILE= ${WRKSRC}/COPYING-3_0.txt
-BROKEN_mips= fails to link: tracker_service.c:270: undefined reference to '__sync_add_and_fetch_4'
-BROKEN_mips64= fails to link: tracker_service.c:270: undefined reference to '__sync_add_and_fetch_4'
-
LIB_DEPENDS= libfastcommon.so:devel/libfastcommon
USES= perl5
diff --git a/games/anki/Makefile b/games/anki/Makefile
--- a/games/anki/Makefile
+++ b/games/anki/Makefile
@@ -13,7 +13,7 @@
LICENSE= AGPLv3+
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
NOT_FOR_ARCHS_REASON= the provided build system written in Rust (= runner) accepts only 64-bit systems.
BUILD_DEPENDS= protoc:devel/protobuf \
diff --git a/games/crafty/Makefile b/games/crafty/Makefile
--- a/games/crafty/Makefile
+++ b/games/crafty/Makefile
@@ -17,8 +17,6 @@
BROKEN_armv6= fails to compile: invokes amd64 assembler
BROKEN_armv7= fails to compile: invokes amd64 assembler
BROKEN_i386= fails to compile: invokes amd64 assembler
-BROKEN_mips= fails to compile: unrecognized command line option "-mpopcnt"
-BROKEN_mips64= fails to compile: unrecognized command line option "-mpopcnt"
BROKEN_riscv64= fails to compile: invokes amd64 assembler
USES= gmake zip
diff --git a/games/flightgear-data/Makefile b/games/flightgear-data/Makefile
--- a/games/flightgear-data/Makefile
+++ b/games/flightgear-data/Makefile
@@ -10,8 +10,6 @@
LICENSE= GPLv2
-BROKEN_mips64= fails to install: runaway process
-
USES= tar:txz
NO_BUILD= yes
diff --git a/games/freecell-solver/Makefile b/games/freecell-solver/Makefile
--- a/games/freecell-solver/Makefile
+++ b/games/freecell-solver/Makefile
@@ -26,7 +26,6 @@
LIB_DEPENDS_armv6= libgmp.so:math/gmp
LIB_DEPENDS_armv7= libgmp.so:math/gmp
LIB_DEPENDS_i386= libgmp.so:math/gmp
-LIB_DEPENDS_mips= libgmp.so:math/gmp
LIB_DEPENDS_powerpc= libgmp.so:math/gmp
OPTIONS_DEFINE= DOCS TCMALLOC
diff --git a/games/gcompris-qt/Makefile b/games/gcompris-qt/Makefile
--- a/games/gcompris-qt/Makefile
+++ b/games/gcompris-qt/Makefile
@@ -12,8 +12,6 @@
LICENSE_FILE_AGPLv3= ${WRKSRC}/LICENSES/AGPL-3.0-only.txt
LICENSE_FILE_GPLv3= ${WRKSRC}/LICENSES/GPL-3.0-or-later.txt
-IGNORE_FreeBSD_13= is not supported on systems with OpenSSL 1.1.1
-
BUILD_DEPENDS= ${LOCALBASE}/include/vulkan/vulkan.h:graphics/vulkan-headers
# libqmlbox2d.so is a QML plugin...don't use LIB_DEPENDS
diff --git a/games/lmpc/Makefile b/games/lmpc/Makefile
--- a/games/lmpc/Makefile
+++ b/games/lmpc/Makefile
@@ -12,7 +12,7 @@
LICENSE= GPLv2+
-ONLY_FOR_ARCHS= armv6 armv7 i386 mips powerpc
+ONLY_FOR_ARCHS= armv6 armv7 i386 powerpc
ONLY_FOR_ARCHS_REASON= assumes sizeof(long) == 4
USES= gmake perl5 shebangfix
diff --git a/games/openrct2/Makefile b/games/openrct2/Makefile
--- a/games/openrct2/Makefile
+++ b/games/openrct2/Makefile
@@ -18,7 +18,7 @@
LICENSE= GPLv3+
LICENSE_FILE= ${WRKSRC}/licence.txt
-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= Only for little-endian architectures
BUILD_DEPENDS= nlohmann-json>0:devel/nlohmann-json
diff --git a/games/regoth/Makefile b/games/regoth/Makefile
--- a/games/regoth/Makefile
+++ b/games/regoth/Makefile
@@ -10,7 +10,6 @@
LICENSE= GPLv3
-BROKEN_FreeBSD_13_powerpc64= fails to build: mmintrin.h:33:5: error: use of undeclared identifier '__builtin_ia32_emms'; did you mean '__builtin_isless'?
BROKEN_riscv64= fails to build: mmintrin.h:33:5: error: use of undeclared identifier '__builtin_ia32_emms'; did you mean '__builtin_isless'?
LIB_DEPENDS= libsndfile.so:audio/libsndfile
diff --git a/games/ufoai-data/Makefile b/games/ufoai-data/Makefile
--- a/games/ufoai-data/Makefile
+++ b/games/ufoai-data/Makefile
@@ -16,8 +16,6 @@
LICENSE= GPLv2 CC-BY-SA-3.0
LICENSE_COMB= multi
-BROKEN_mips64= Fails to install: runaway process
-
EXTRACT_DEPENDS= ${UNZIP_CMD}:archivers/unzip
NO_BUILD= yes
diff --git a/games/urbanterror-data/Makefile b/games/urbanterror-data/Makefile
--- a/games/urbanterror-data/Makefile
+++ b/games/urbanterror-data/Makefile
@@ -19,9 +19,6 @@
LICENSE_TEXT= The mod files may not be sold or distributed on physical media unless with permission from id Software.
LICENSE_PERMS= dist-mirror pkg-mirror auto-accept
-BROKEN_mips= Fails to install: runaway process
-BROKEN_mips64= Fails to install: runaway process
-
NO_BUILD= yes
DATADIR= ${PREFIX}/share/quake3
diff --git a/games/xoids/Makefile b/games/xoids/Makefile
--- a/games/xoids/Makefile
+++ b/games/xoids/Makefile
@@ -7,9 +7,6 @@
MAINTAINER= ports@FreeBSD.org
COMMENT= X Window Asteroids style game with full color pixmaps
-NOT_FOR_ARCHS= mips64
-NOT_FOR_ARCHS_REASON= unknown architecture
-
USES= imake xorg
USE_XORG= x11 xpm
CFLAGS+= -fcommon
diff --git a/graphics/Makefile b/graphics/Makefile
--- a/graphics/Makefile
+++ b/graphics/Makefile
@@ -154,7 +154,6 @@
SUBDIR += drawing
SUBDIR += drawio
SUBDIR += drawpile
- SUBDIR += drm-510-kmod
SUBDIR += drm-515-kmod
SUBDIR += drm-61-kmod
SUBDIR += drm-66-kmod
@@ -631,8 +630,6 @@
SUBDIR += npretty
SUBDIR += nsxiv
SUBDIR += nurbs++
- SUBDIR += nvidia-drm-510-kmod
- SUBDIR += nvidia-drm-510-kmod-devel
SUBDIR += nvidia-drm-515-kmod
SUBDIR += nvidia-drm-515-kmod-devel
SUBDIR += nvidia-drm-61-kmod
diff --git a/graphics/R-cran-s2/Makefile b/graphics/R-cran-s2/Makefile
--- a/graphics/R-cran-s2/Makefile
+++ b/graphics/R-cran-s2/Makefile
@@ -9,7 +9,7 @@
LICENSE= APACHE20
-NOT_FOR_ARCHS= armv6 mips
+NOT_FOR_ARCHS= armv6
NOT_FOR_ARCHS_REASON= is currently 64-bit only
CRAN_DEPENDS= R-cran-Rcpp>0:devel/R-cran-Rcpp \
diff --git a/graphics/drm-510-kmod/Makefile b/graphics/drm-510-kmod/Makefile
deleted file mode 100644
--- a/graphics/drm-510-kmod/Makefile
+++ /dev/null
@@ -1,62 +0,0 @@
-PORTNAME= drm-510-kmod
-PORTVERSION= ${DRM_KMOD_DISTVERSION}
-PORTREVISION= 13
-CATEGORIES= graphics kld
-
-.include "Makefile.version"
-
-MAINTAINER= x11@FreeBSD.org
-COMMENT= Direct Rendering Manager GPU drivers
-WWW= https://github.com/freebsd/drm-kmod/
-
-LICENSE= BSD2CLAUSE MIT GPLv2
-LICENSE_COMB= multi
-
-ONLY_FOR_ARCHS= aarch64 amd64 i386 powerpc64 powerpc64le
-ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64, i386, aarch64, and powerpc64
-
-CONFLICTS_INSTALL= drm-515-kmod \
- drm-61-kmod \
- drm-66-kmod
-
-USES= kmod uidfix compiler:c++11-lang
-
-USE_GITHUB= yes
-GH_ACCOUNT= freebsd
-GH_PROJECT= drm-kmod
-GH_TAGNAME= ${DRM_KMOD_GH_TAGNAME}
-
-.include <bsd.port.options.mk>
-
-SUB_FILES= pkg-message
-SUB_LIST= OPSYS=${OPSYS} OSREL=${OSREL}
-
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1401501
-IGNORE= not supported on FreeBSD 14.2 and higher
-.endif
-
-.if ${OPSYS} != FreeBSD
-IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
-.endif
-
-.if ${ARCH} == "amd64"
-PLIST_SUB+= AMDGPU=""
-PLIST_SUB+= I915=""
-.elif ${ARCH} == "i386"
-PLIST_SUB+= AMDGPU="@comment "
-PLIST_SUB+= I915=""
-.elif ${ARCH} == "aarch64" || ${ARCH:Mpowerpc*}
-PLIST_SUB+= AMDGPU=""
-PLIST_SUB+= I915="@comment "
-.else
-PLIST_SUB+= AMDGPU="@comment "
-PLIST_SUB+= I915="@comment "
-.endif
-
-MAKE_ENV+= MAKEOBJDIRPREFIX=${WRKSRC}/obj
-
-pre-build:
- ${MKDIR} ${WRKSRC}/obj
- (cd ${WRKSRC} ; ${SETENV} ${MAKE_ENV} ${MAKE_CMD} obj)
-
-.include <bsd.port.mk>
diff --git a/graphics/drm-510-kmod/Makefile.version b/graphics/drm-510-kmod/Makefile.version
deleted file mode 100644
--- a/graphics/drm-510-kmod/Makefile.version
+++ /dev/null
@@ -1,5 +0,0 @@
-# drm-kmod common version definition
-#
-# This will be included from consumers such as nvidia-drm
-DRM_KMOD_DISTVERSION= 5.10.163
-DRM_KMOD_GH_TAGNAME= drm_v5.10.163_9
diff --git a/graphics/drm-510-kmod/distinfo b/graphics/drm-510-kmod/distinfo
deleted file mode 100644
--- a/graphics/drm-510-kmod/distinfo
+++ /dev/null
@@ -1,3 +0,0 @@
-TIMESTAMP = 1760982866
-SHA256 (freebsd-drm-kmod-5.10.163-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
-SIZE (freebsd-drm-kmod-5.10.163-drm_v5.10.163_9_GH0.tar.gz) = 20095205
diff --git a/graphics/drm-510-kmod/files/patch-drivers_gpu_drm_drm__os__freebsd.c b/graphics/drm-510-kmod/files/patch-drivers_gpu_drm_drm__os__freebsd.c
deleted file mode 100644
--- a/graphics/drm-510-kmod/files/patch-drivers_gpu_drm_drm__os__freebsd.c
+++ /dev/null
@@ -1,18 +0,0 @@
---- drivers/gpu/drm/drm_os_freebsd.c.bak 2022-11-05 15:37:52.826643000 -0400
-+++ drivers/gpu/drm/drm_os_freebsd.c 2022-11-05 15:38:25.740620000 -0400
-@@ -202,11 +202,15 @@
- #if __FreeBSD_version >= 1301505
- #if __FreeBSD_version >= 1400058
- DRIVER_MODULE(iicbus, drmn, iicbus_driver, NULL, NULL);
-+#if defined(__amd64__) || defined(__aarch64__) || defined(__i386__)
- DRIVER_MODULE(acpi_iicbus, drmn, acpi_iicbus_driver, NULL, NULL);
-+#endif
- #else
- DRIVER_MODULE(iicbus, drmn, iicbus_driver, iicbus_devclass, NULL, NULL);
-+#if defined(__amd64__) || defined(__aarch64__) || defined(__i386__)
- DRIVER_MODULE(acpi_iicbus, drmn, acpi_iicbus_driver, iicbus_devclass, NULL,
- NULL);
-+#endif
- #endif
- MODULE_DEPEND(drmn, iicbus, IICBUS_MINVER, IICBUS_PREFVER, IICBUS_MAXVER);
- MODULE_DEPEND(drmn, iic, 1, 1, 1);
diff --git a/graphics/drm-510-kmod/files/pkg-message.in b/graphics/drm-510-kmod/files/pkg-message.in
deleted file mode 100644
--- a/graphics/drm-510-kmod/files/pkg-message.in
+++ /dev/null
@@ -1,22 +0,0 @@
-[
-{ type: install
- message: <<EOM
-The drm-510-kmod port can be enabled for amdgpu (for AMD
-GPUs starting with the HD7000 series / Tahiti) or i915kms (for Intel
-APUs starting with HD3000 / Sandy Bridge) through kld_list in
-/etc/rc.conf. radeonkms for older AMD GPUs can be loaded and there are
-some positive reports if EFI boot is NOT enabled (similar to amdgpu).
-
-For amdgpu: kld_list="amdgpu"
-For Intel: kld_list="i915kms"
-For radeonkms: kld_list="radeonkms"
-
-Please ensure that all users requiring graphics are members of the
-"video" group.
-
-Please note that this package was built for %%OPSYS%% %%OSREL%%.
-If this is not your current running version, please rebuild
-it from ports to prevent panics when loading the module.
-EOM
-}
-]
diff --git a/graphics/drm-510-kmod/pkg-descr b/graphics/drm-510-kmod/pkg-descr
deleted file mode 100644
--- a/graphics/drm-510-kmod/pkg-descr
+++ /dev/null
@@ -1,3 +0,0 @@
-amdgpu, i915, and radeon DRM drivers modules.
-Currently corresponding to Linux 5.10 DRM.
-This version is for FreeBSD 13.1 and above.
diff --git a/graphics/drm-510-kmod/pkg-plist b/graphics/drm-510-kmod/pkg-plist
deleted file mode 100644
--- a/graphics/drm-510-kmod/pkg-plist
+++ /dev/null
@@ -1,7 +0,0 @@
-/%%KMODDIR%%/dmabuf.ko
-%%AMDGPU%%/%%KMODDIR%%/amdgpu.ko
-/%%KMODDIR%%/drm.ko
-%%I915%%/%%KMODDIR%%/i915kms.ko
-/%%KMODDIR%%/linuxkpi_gplv2.ko
-/%%KMODDIR%%/radeonkms.ko
-/%%KMODDIR%%/ttm.ko
diff --git a/graphics/drm-515-kmod/Makefile b/graphics/drm-515-kmod/Makefile
--- a/graphics/drm-515-kmod/Makefile
+++ b/graphics/drm-515-kmod/Makefile
@@ -15,8 +15,7 @@
ONLY_FOR_ARCHS= amd64 powerpc64 powerpc64le
ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64 and powerpc64
-CONFLICTS_INSTALL= drm-510-kmod \
- drm-61-kmod \
+CONFLICTS_INSTALL= drm-61-kmod \
drm-66-kmod
USES= kmod uidfix compiler:c++11-lang
@@ -31,9 +30,7 @@
SUB_FILES= pkg-message
SUB_LIST= OPSYS=${OPSYS} OSREL=${OSREL}
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400081
-IGNORE= not supported on older than 14.0, no kernel support
-.elif ${OPSYS} == FreeBSD && ${OSVERSION} >= 1600000
+.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1600000
IGNORE= not supported on FreeBSD 16.0 and higher
.endif
.if ${OPSYS} != FreeBSD
diff --git a/graphics/drm-61-kmod/Makefile b/graphics/drm-61-kmod/Makefile
--- a/graphics/drm-61-kmod/Makefile
+++ b/graphics/drm-61-kmod/Makefile
@@ -15,8 +15,7 @@
ONLY_FOR_ARCHS= amd64 powerpc64 powerpc64le
ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64 and powerpc64
-CONFLICTS_INSTALL= drm-510-kmod \
- drm-515-kmod \
+CONFLICTS_INSTALL= drm-515-kmod \
drm-66-kmod
USES= kmod uidfix compiler:c++11-lang
@@ -31,9 +30,6 @@
SUB_FILES= pkg-message
SUB_LIST= OPSYS=${OPSYS} OSREL=${OSREL}
-.if ${OPSYS} == FreeBSD && !( ${OSVERSION} >= 1500008 || ( ${OSVERSION} >= 1400508 && ${OSVERSION} < 1500000 ))
-IGNORE= not supported on older than 14-STABLE 1400508, no kernel support
-.endif
.if ${OPSYS} != FreeBSD
IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
.endif
diff --git a/graphics/drm-66-kmod/Makefile b/graphics/drm-66-kmod/Makefile
--- a/graphics/drm-66-kmod/Makefile
+++ b/graphics/drm-66-kmod/Makefile
@@ -15,8 +15,7 @@
ONLY_FOR_ARCHS= amd64
ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64
-CONFLICTS_INSTALL= drm-510-kmod \
- drm-515-kmod \
+CONFLICTS_INSTALL= drm-515-kmod \
drm-61-kmod
USES= kmod uidfix compiler:c++11-lang
@@ -31,7 +30,7 @@
SUB_FILES= pkg-message
SUB_LIST= PORTNAME=${PORTNAME} OPSYS=${OPSYS} OSREL=${OSREL}
-.if ${OPSYS} == FreeBSD && !( ${OSVERSION} >= 1500031 )
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500031
IGNORE= not supported on older than 1500031, no kernel support
.endif
.if ${OPSYS} != FreeBSD
diff --git a/graphics/drm-kmod/Makefile b/graphics/drm-kmod/Makefile
--- a/graphics/drm-kmod/Makefile
+++ b/graphics/drm-kmod/Makefile
@@ -15,20 +15,12 @@
.if ${OPSYS} != FreeBSD
IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
.else
-. if ${OSVERSION} >= 1302000 && ${OSVERSION} < 1400097
-RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-510-kmod
-_DRM_ARCHS= aarch64 amd64 i386 powerpc64 powerpc64le
-. elif ${OSVERSION} >= 1400097 && (${ARCH} == i386 || ${ARCH} == aarch64)
-RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-510-kmod
-_DRM_ARCHS= aarch64 i386
-. elif ${OSVERSION} >= 1500031 && ${ARCH} == amd64
+. if ${OSVERSION} >= 1500031 && ${ARCH} == amd64
RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-66-kmod
_DRM_ARCHS= amd64
-. elif ${OSVERSION} >= 1400508
+. else
RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-61-kmod
_DRM_ARCHS= amd64 powerpc64 powerpc64le
-. else
-_DRM_ARCHS=
. endif
. if ! ${_DRM_ARCHS:M${ARCH}}
IGNORE= not supported for this configuration
diff --git a/graphics/drm-latest-kmod/Makefile b/graphics/drm-latest-kmod/Makefile
--- a/graphics/drm-latest-kmod/Makefile
+++ b/graphics/drm-latest-kmod/Makefile
@@ -15,8 +15,7 @@
ONLY_FOR_ARCHS= amd64
ONLY_FOR_ARCHS_REASON= the new KMS components are only supported on amd64
-CONFLICTS_INSTALL= drm-510-kmod \
- drm-515-kmod \
+CONFLICTS_INSTALL= drm-515-kmod \
drm-61-kmod
USES= kmod uidfix compiler:c++11-lang
@@ -31,7 +30,7 @@
SUB_FILES= pkg-message
SUB_LIST= PORTNAME=${PORTNAME} OPSYS=${OPSYS} OSREL=${OSREL}
-.if ${OPSYS} == FreeBSD && !( ${OSVERSION} >= 1500058 )
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500058
IGNORE= not supported on older than 1500058, no kernel support
.endif
.if ${OPSYS} != FreeBSD
diff --git a/graphics/dspdfviewer/Makefile b/graphics/dspdfviewer/Makefile
--- a/graphics/dspdfviewer/Makefile
+++ b/graphics/dspdfviewer/Makefile
@@ -49,9 +49,7 @@
CFLAGS+= -Wno-error=suggest-destructor-override
CFLAGS+= -Wno-error=suggest-override
# Fixes build failure for Clang 14.0.3
-.if ${OSVERSION} >= 1400059
CFLAGS+= -Wno-error=bitwise-instead-of-logical
-.endif
# Fixes build failure for Clang 16.0.6
CFLAGS+= -Wno-error=unsafe-buffer-usage
# Fixes build failure for Clang 18.1.4
diff --git a/graphics/exiv2/Makefile b/graphics/exiv2/Makefile
--- a/graphics/exiv2/Makefile
+++ b/graphics/exiv2/Makefile
@@ -30,9 +30,6 @@
CMAKE_ON= EXIV2_ENABLE_VIDEO
CMAKE_OFF= EXIV2_ENABLE_EXTERNAL_XMP
-LDFLAGS_mips= -lintl
-LDFLAGS_mips64= -lintl
-
PLIST_SUB= SOVER=${DISTVERSION:R:E} \
SOVERSION=${DISTVERSION}
diff --git a/graphics/freeimage/Makefile b/graphics/freeimage/Makefile
--- a/graphics/freeimage/Makefile
+++ b/graphics/freeimage/Makefile
@@ -17,9 +17,6 @@
LICENSE_FILE_GPLv3= ${WRKSRC}/license-gplv3.txt
LICENSE_PERMS_FIPL= dist-mirror pkg-mirror auto-accept
-BROKEN_mips= fails to compile: section referenced in discarded section
-BROKEN_mips64= fails to compile: opcode not supported on this processor: mips3 (mips3) 'madd $4,$5'
-
USES= cpe dos2unix gmake zip
USE_CXXSTD= gnu++14
CPE_VENDOR= ${PORTNAME}_project
diff --git a/graphics/gdchart/Makefile b/graphics/gdchart/Makefile
--- a/graphics/gdchart/Makefile
+++ b/graphics/gdchart/Makefile
@@ -26,7 +26,7 @@
.include <bsd.port.options.mk>
-.if defined(NO_PROFILE) || ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
+.if defined(NO_PROFILE) || ${OPSYS} == FreeBSD
PLIST_SUB+= PROFILE="@comment "
.else
PLIST_SUB+= PROFILE=""
diff --git a/graphics/gifsicle/Makefile b/graphics/gifsicle/Makefile
--- a/graphics/gifsicle/Makefile
+++ b/graphics/gifsicle/Makefile
@@ -10,9 +10,6 @@
LICENSE= GPLv2
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= fails to build: undefined reference to '__sync_add_and_fetch_4'
-BROKEN_mips64= fails to build: undefined reference to '__sync_add_and_fetch_4'
-
FLAVORS= x11 nox11
FLAVOR?= ${FLAVORS:[1]}
nox11_PKGNAMESUFFIX= -nox11
diff --git a/graphics/mozjpeg/Makefile b/graphics/mozjpeg/Makefile
--- a/graphics/mozjpeg/Makefile
+++ b/graphics/mozjpeg/Makefile
@@ -10,8 +10,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE.md
-BROKEN_mips64= does not configure: error: SIMD support cannot be enabled
-
BUILD_DEPENDS= nasm>=2.10,1:devel/nasm
LIB_DEPENDS= libpng.so:graphics/png
diff --git a/graphics/nvidia-drm-510-kmod-devel/Makefile b/graphics/nvidia-drm-510-kmod-devel/Makefile
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod-devel/Makefile
+++ /dev/null
@@ -1,7 +0,0 @@
-NVIDIA_DISTVERSION?= 590.48.01
-# Explicitly set PORTREVISION as it can be overridden by the master port
-PORTREVISION= 0
-MASTERDIR= ${.CURDIR}/../nvidia-drm-510-kmod
-PKGNAMESUFFIX= -devel
-
-.include "${MASTERDIR}/Makefile"
diff --git a/graphics/nvidia-drm-510-kmod-devel/distinfo b/graphics/nvidia-drm-510-kmod-devel/distinfo
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod-devel/distinfo
+++ /dev/null
@@ -1,5 +0,0 @@
-TIMESTAMP = 1766366072
-SHA256 (NVIDIA-FreeBSD-x86_64-590.48.01.tar.xz) = 0af5248bfeb3d753fa502759e01301fde1674f8ed17624d6c080058f85adbb31
-SIZE (NVIDIA-FreeBSD-x86_64-590.48.01.tar.xz) = 326979472
-SHA256 (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
-SIZE (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = 20095205
diff --git a/graphics/nvidia-drm-510-kmod/Makefile b/graphics/nvidia-drm-510-kmod/Makefile
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/Makefile
+++ /dev/null
@@ -1,12 +0,0 @@
-PORTNAME= nvidia-drm-510-kmod
-PORTREVISION= 0
-CATEGORIES= graphics
-
-RUN_DEPENDS+= ${KMODDIR}/drm.ko:graphics/drm-510-kmod
-CONFLICTS_INSTALL= nvidia-drm-515-kmod* nvidia-drm-61-kmod* nvidia-drm-66-kmod*
-
-.include "${.CURDIR}/../drm-510-kmod/Makefile.version"
-.include "${.CURDIR}/../nvidia-drm-kmod/Makefile.common"
-.include <bsd.port.options.mk>
-
-.include <bsd.port.mk>
diff --git a/graphics/nvidia-drm-510-kmod/distinfo b/graphics/nvidia-drm-510-kmod/distinfo
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/distinfo
+++ /dev/null
@@ -1,5 +0,0 @@
-TIMESTAMP = 1771348889
-SHA256 (NVIDIA-FreeBSD-x86_64-580.126.18.tar.xz) = df4b43e8c7c3865cd7b9dc9ad97469d01a7d64580c9cf2336dca36c2a463184c
-SIZE (NVIDIA-FreeBSD-x86_64-580.126.18.tar.xz) = 288927652
-SHA256 (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = e4e77f5907418bd5e4be12c26d77fd176f51b82fe8a074b1237cde58be5ce385
-SIZE (freebsd-drm-kmod-drm_v5.10.163_9_GH0.tar.gz) = 20095205
diff --git a/graphics/nvidia-drm-510-kmod/files/20-nvidia-drm-outputclass.conf.in b/graphics/nvidia-drm-510-kmod/files/20-nvidia-drm-outputclass.conf.in
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/files/20-nvidia-drm-outputclass.conf.in
+++ /dev/null
@@ -1,8 +0,0 @@
-Section "OutputClass"
- Identifier "nvidia"
- MatchDriver "nvidia-drm"
- Driver "nvidia"
- Option "PrimaryGPU" "yes"
- ModulePath "%%LOCALBASE%%/lib/nvidia/xorg"
- ModulePath "%%LOCALBASE%%/lib/xorg/modules"
-EndSection
diff --git a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-conftest.h b/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-conftest.h
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-conftest.h
+++ /dev/null
@@ -1,14 +0,0 @@
---- nvidia-drm-conftest.h.orig 2024-02-22 01:03:15 UTC
-+++ nvidia-drm-conftest.h
-@@ -85,7 +85,11 @@
-
- /* For nv_drm_gem_prime_force_fence_signal */
- #ifndef spin_is_locked
-+#if ((__FreeBSD_version >= 1500000) && (__FreeBSD_version < 1500018)) || (__FreeBSD_version < 1401501)
- #define spin_is_locked(lock) mtx_owned(lock.m)
-+#else
-+#define spin_is_locked(lock) mtx_owned(lock)
-+#endif
- #endif
-
- #ifndef rwsem_is_locked
diff --git a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-freebsd-lkpi.c b/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-freebsd-lkpi.c
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/files/extra-patch-nvidia-drm-freebsd-lkpi.c
+++ /dev/null
@@ -1,46 +0,0 @@
---- nvidia-drm-freebsd-lkpi.c.orig 2024-02-22 01:03:15 UTC
-+++ nvidia-drm-freebsd-lkpi.c
-@@ -115,6 +115,7 @@ int nv_drm_probe_devices(void)
- * by the native nvidia.ko by using our devclass.
- */
- for (int i = 0; i < NV_MAX_DEVICES; i++) {
-+ struct pci_dev *pdev;
- nv_gpu_info_t gpu_info;
- struct nvidia_softc *sc = devclass_get_softc(nvidia_devclass, i);
- if (!sc) {
-@@ -124,11 +125,33 @@ int nv_drm_probe_devices(void)
- nv_state_t *nv = sc->nv_state;
-
- /*
-+ * Set the ivars for this device if they are not already populated. This
-+ * is the bus specific data, and linuxkpi will try to use it.
-+ */
-+ if (!device_get_ivars(sc->dev)) {
-+ device_t parent = device_get_parent(sc->dev);
-+ struct pci_devinfo *dinfo = device_get_ivars(parent);
-+ device_set_ivars(sc->dev, dinfo);
-+ }
-+
-+ /*
- * Now we have the state (which gives us the device_t), but what nvidia-drm
- * wants is a pci_dev suitable for use with linuxkpi code. We can use
-- * lkpinew_pci_dev to fill in a pci_dev struct,
-+ * lkpinew_pci_dev to fill in a pci_dev struct, or linux_pci_attach on more
-+ * recent kernels (introduced by 253dbe7487705).
- */
-- struct pci_dev *pdev = lkpinew_pci_dev(sc->dev);
-+#if __FreeBSD_version < 1300093
-+ pdev = lkpinew_pci_dev(sc->dev);
-+#else
-+ pdev = malloc(sizeof(*pdev), M_DEVBUF, M_WAITOK|M_ZERO);
-+ if (!pdev) {
-+ return -ENOMEM;
-+ }
-+
-+ if (linux_pci_attach_device(sc->dev, NULL, NULL, pdev)) {
-+ return -ENOMEM;
-+ }
-+#endif
- nv_lkpi_pci_devs[i] = pdev;
-
- gpu_info.gpu_id = nv->gpu_id;
diff --git a/graphics/nvidia-drm-510-kmod/files/patch-nvidia-drm-conftest.h b/graphics/nvidia-drm-510-kmod/files/patch-nvidia-drm-conftest.h
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/files/patch-nvidia-drm-conftest.h
+++ /dev/null
@@ -1,14 +0,0 @@
---- nvidia-drm-conftest.h.orig 2024-03-11 17:52:16 UTC
-+++ nvidia-drm-conftest.h
-@@ -122,11 +122,9 @@
- */
- #define drm_atomic_state_free drm_atomic_state_put
-
--#if __FreeBSD_version < 1300000
- /* redefine LIST_HEAD_INIT to the linux version */
- #include <linux/list.h>
- #define LIST_HEAD_INIT(name) LINUX_LIST_HEAD_INIT(name)
--#endif
-
- /*
- * FreeBSD currently has only vmf_insert_pfn_prot defined, and it has a
diff --git a/graphics/nvidia-drm-510-kmod/pkg-descr b/graphics/nvidia-drm-510-kmod/pkg-descr
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/pkg-descr
+++ /dev/null
@@ -1,3 +0,0 @@
-FreeBSD port of Linux's nvidia-drm.ko Kernel module.
-
-This version is compatible with drm.ko 5.10.
diff --git a/graphics/nvidia-drm-510-kmod/pkg-message b/graphics/nvidia-drm-510-kmod/pkg-message
deleted file mode 100644
--- a/graphics/nvidia-drm-510-kmod/pkg-message
+++ /dev/null
@@ -1,8 +0,0 @@
-Modesetting must be enabled to use nvidia-drm.ko for graphics. This can be done
-by setting the modeset sysctl, the equivalent of the modeset kernel parameter
-on Linux.
-
-hw.nvidiadrm.modeset=1
-
-This must be set before loading nvidia-drm.ko, most easily done by placing the
-above in /boot/loader.conf.
diff --git a/graphics/nvidia-drm-kmod/Makefile b/graphics/nvidia-drm-kmod/Makefile
--- a/graphics/nvidia-drm-kmod/Makefile
+++ b/graphics/nvidia-drm-kmod/Makefile
@@ -15,13 +15,9 @@
.if ${OPSYS} != FreeBSD
IGNORE= not supported on anything but FreeBSD (missing linuxkpi functionality)
.else
-. if ${OSVERSION} >= 1302000 && ${OSVERSION} < 1400097
-RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-510-kmod${PKGNAMESUFFIX}
-. elif ${OSVERSION} >= 1400097 && (${ARCH} == i386 || ${ARCH} == aarch64)
-RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-510-kmod${PKGNAMESUFFIX}
-. elif ${OSVERSION} >= 1500031 && ${ARCH} == amd64
+. if ${OSVERSION} >= 1500031 && ${ARCH} == amd64
RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-66-kmod${PKGNAMESUFFIX}
-. elif ${OSVERSION} >= 1400508
+. else
RUN_DEPENDS+= ${KMODDIR}/nvidia-drm.ko:graphics/nvidia-drm-61-kmod${PKGNAMESUFFIX}
. endif
.endif
diff --git a/graphics/ttyplot/Makefile b/graphics/ttyplot/Makefile
--- a/graphics/ttyplot/Makefile
+++ b/graphics/ttyplot/Makefile
@@ -9,8 +9,6 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= fails to build: Package 'ncursesw' not found
-
USES= ncurses pkgconfig
USE_GITHUB= yes
GH_ACCOUNT= tenox7
diff --git a/graphics/wings/Makefile b/graphics/wings/Makefile
--- a/graphics/wings/Makefile
+++ b/graphics/wings/Makefile
@@ -14,7 +14,7 @@
LICENSE_PERMS= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
# c_src/Makefile line 103
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
NOT_FOR_ARCHS_REASON= subcomponent libigl does not support 32bit platforms
BUILD_DEPENDS= erl:lang/erlang \
diff --git a/irc/undernet-ircu/Makefile b/irc/undernet-ircu/Makefile
--- a/irc/undernet-ircu/Makefile
+++ b/irc/undernet-ircu/Makefile
@@ -63,10 +63,6 @@
.include <bsd.port.options.mk>
-.if !defined(NO_PROFILE) && ( ${OPSYS} == FreeBSD && ${OSVERSION} < 1400079 )
-CONFIGURE_ARGS+= --enable-profile
-.endif
-
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/ircd/ircd ${STAGEDIR}${PREFIX}/sbin
${INSTALL_PROGRAM} ${WRKSRC}/ircd/convert-conf \
diff --git a/japanese/man/Makefile b/japanese/man/Makefile
--- a/japanese/man/Makefile
+++ b/japanese/man/Makefile
@@ -18,8 +18,6 @@
RUN_DEPENDS= ${LOCALBASE}/bin/groff:japanese/groff \
jless:japanese/less
-BROKEN_mips= fails to compile: man.c:37:10: fatal error: 'config.h' file not found
-
MAKE_ENV= GZCAT=${GZCAT} GZIP_CMD="${GZIP_CMD}"
USES= shebangfix
SHEBANG_FILES= catman/catman.perl makewhatis/makewhatis.perl
diff --git a/japanese/mecab/Makefile b/japanese/mecab/Makefile
--- a/japanese/mecab/Makefile
+++ b/japanese/mecab/Makefile
@@ -11,9 +11,6 @@
LICENSE= BSD3CLAUSE GPLv2 LGPL21
LICENSE_COMB= multi
-BROKEN_mips= fails to link: Nonrepresentable section on output
-BROKEN_mips64= fails to link: Nonrepresentable section on output
-
USES= gettext-tools iconv libtool localbase perl5
USE_CXXSTD= c++14
USE_LDCONFIG= yes
diff --git a/japanese/mozc-server/Makefile b/japanese/mozc-server/Makefile
--- a/japanese/mozc-server/Makefile
+++ b/japanese/mozc-server/Makefile
@@ -14,7 +14,6 @@
libzinnia.so:japanese/zinnia
RUN_DEPENDS= xdg-open:devel/xdg-utils
-BROKEN_FreeBSD_13_powerpc64= fails to build: ERROR: ninja -v -C out_linux/Release mozc_server: Error code 1
BROKEN_powerpc= fails to compile: segfault
USE_GITHUB= yes
diff --git a/java/openjdk11/Makefile b/java/openjdk11/Makefile
--- a/java/openjdk11/Makefile
+++ b/java/openjdk11/Makefile
@@ -133,11 +133,6 @@
.include <bsd.port.pre.mk>
-# portsfallout.com shows flapping builds on 13.5 and 14.2
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1403000
-MAKE_JOBS_UNSAFE= yes
-.endif
-
.if !${PORT_OPTIONS:MCUPS}
MASTER_SITES+= https://codeload.github.com/OpenPrinting/cups/tar.gz/v${CUPS_INC_VER}?dummy=/:cups
.endif
diff --git a/java/openjdk17/Makefile b/java/openjdk17/Makefile
--- a/java/openjdk17/Makefile
+++ b/java/openjdk17/Makefile
@@ -121,11 +121,6 @@
.include <bsd.port.pre.mk>
-# portsfallout.com shows flapping builds on 13.5 and 14.2
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1500000
-MAKE_JOBS_NUMBER_LIMIT= 3
-.endif
-
JDK_BUILD_JVM= server
MAKE_ENV+= --with-toolchain-type=${COMPILER_TYPE}
diff --git a/java/openjdk23/Makefile b/java/openjdk23/Makefile
--- a/java/openjdk23/Makefile
+++ b/java/openjdk23/Makefile
@@ -21,7 +21,6 @@
# On FreeBSD 14 and 15 the i386 build fails with a segfault in java during the
# buildtools_create_symbols_javac__the.COMPILE_CREATE_SYMBOLS_batch build step.
#
-BROKEN_FreeBSD_13_i386= Build failed for target 'images' in configuration 'bsd-x86-server-release'
BROKEN_FreeBSD_14_i386= Build failed for target 'images' in configuration 'bsd-x86-server-release'
BROKEN_FreeBSD_15_i386= Build failed for target 'images' in configuration 'bsd-x86-server-release'
diff --git a/lang/crystal/Makefile b/lang/crystal/Makefile
--- a/lang/crystal/Makefile
+++ b/lang/crystal/Makefile
@@ -76,14 +76,7 @@
@${RLN} x86_64-freebsd ${WRKSRC}/src/lib_c/aarch64-unknown-freebsd
post-patch:
-.if ${SSL_DEFAULT} == "base" && ${OSREL:R} <= 13
- @${REINPLACE_CMD} -i '' \
- -e 's|CRYSTAL_SSL_VERSION|1.1.1|g' \
- -e 's|CRYSTAL_SSL_LDFLAGS|${OPENSSLLIB}|g' \
- ${WRKSRC}/src/openssl/lib_ssl.cr \
- ${WRKSRC}/src/openssl/lib_crypto.cr
-.endif
-.if ${SSL_DEFAULT} == "base" && ${OSREL:R} >= 14
+.if ${SSL_DEFAULT} == "base"
@${REINPLACE_CMD} -i '' \
-e 's|CRYSTAL_SSL_VERSION|3.0.10|g' \
-e 's|CRYSTAL_SSL_LDFLAGS|${OPENSSLLIB}|g' \
diff --git a/lang/dotnet/Makefile b/lang/dotnet/Makefile
--- a/lang/dotnet/Makefile
+++ b/lang/dotnet/Makefile
@@ -22,7 +22,8 @@
cmake:devel/cmake-core \
git:devel/git \
ggrep:textproc/gnugrep \
- terminfo-db>0:misc/terminfo-db
+ terminfo-db>0:misc/terminfo-db \
+ ${LOCALBASE}/lib/compat/libssl.so.111:misc/compat13x
LIB_DEPENDS= libbrotlienc.so:archivers/brotli \
libicuuc.so:devel/icu \
libinotify.so:devel/libinotify \
@@ -89,10 +90,6 @@
EXTRA_PATCHES= ${PATCHDIR}/extra-patch-base-openssl
.endif
-.if ${OSVERSION} >= 1400000
-BUILD_DEPENDS+= ${LOCALBASE}/lib/compat/libssl.so.111:misc/compat13x
-.endif
-
.if ${ARCH} == amd64
PLIST_SUB+= VXSORT=
.else
diff --git a/lang/ecl/Makefile b/lang/ecl/Makefile
--- a/lang/ecl/Makefile
+++ b/lang/ecl/Makefile
@@ -9,9 +9,6 @@
LICENSE= LGPL20
-BROKEN_mips= fails to build: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
-BROKEN_mips64= fails to build: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
-
BUILD_DEPENDS= ${LOCALBASE}/lib/libatomic_ops.a:devel/libatomic_ops
LIB_DEPENDS= libgc.so:devel/boehm-gc \
libgmp.so:math/gmp
diff --git a/lang/erlang-runtime22/Makefile b/lang/erlang-runtime22/Makefile
--- a/lang/erlang-runtime22/Makefile
+++ b/lang/erlang-runtime22/Makefile
@@ -106,7 +106,7 @@
MAKE_ARGS+= ARCH=arm
.endif
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
CFLAGS+= -Wno-error=implicit-function-declaration
OPTIONS_EXCLUDE= OPENSSL
.endif
diff --git a/lang/erlang-runtime23/Makefile b/lang/erlang-runtime23/Makefile
--- a/lang/erlang-runtime23/Makefile
+++ b/lang/erlang-runtime23/Makefile
@@ -105,7 +105,7 @@
MAKE_ARGS+= ARCH=arm
.endif
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
CFLAGS+= -Wno-error=implicit-function-declaration
OPTIONS_EXCLUDE= OPENSSL
.endif
diff --git a/lang/f2c/Makefile b/lang/f2c/Makefile
--- a/lang/f2c/Makefile
+++ b/lang/f2c/Makefile
@@ -15,9 +15,6 @@
LICENSE_FILE= ${WRKSRC}/libf2c/Notice
LICENSE_PERMS= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
-BROKEN_mips= fails to compile: /usr/include/sigfpe.h: No such file or directory
-BROKEN_mips64= fails to compile: /usr/include/sigfpe.h: No such file or directory
-
USES= gmake
USE_LDCONFIG= yes
diff --git a/lang/gauche/Makefile b/lang/gauche/Makefile
--- a/lang/gauche/Makefile
+++ b/lang/gauche/Makefile
@@ -12,8 +12,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= Fails to build: redefinition of GC_register_dynamic_libraries
-BROKEN_mips64= Fails to build: redefinition of GC_register_dynamic_libraries
BROKEN_riscv64= Fails to build: ./include/private/gcconfig.h:709:5: The collector has not been ported to this machine/OS combination
USES= compiler:c11 cpe gmake iconv makeinfo tar:tgz
diff --git a/lang/inko/Makefile b/lang/inko/Makefile
--- a/lang/inko/Makefile
+++ b/lang/inko/Makefile
@@ -12,7 +12,7 @@
LICENSE= MPL20
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc # build fails on non-64-bit architectures: Inko requires a 64-bits architecture
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc # build fails on non-64-bit architectures: Inko requires a 64-bits architecture
LIB_DEPENDS= libffi.so:devel/libffi \
libzstd.so:archivers/zstd
diff --git a/lang/luajit-openresty/Makefile b/lang/luajit-openresty/Makefile
--- a/lang/luajit-openresty/Makefile
+++ b/lang/luajit-openresty/Makefile
@@ -34,10 +34,6 @@
.include <bsd.port.options.mk>
-.if ${ARCH:Mmips*}
-USE_GCC=yes
-.endif
-
post-install:
${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/${PORTNAME}-${LUAJIT_SOVERSION}
${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libluajit-5.1.so.${LUAJIT_SOVERSION}
diff --git a/lang/mosh/Makefile b/lang/mosh/Makefile
--- a/lang/mosh/Makefile
+++ b/lang/mosh/Makefile
@@ -12,7 +12,6 @@
BROKEN_armv6= fails to link: os_dep.c: undefined reference to '__stack_base__'
BROKEN_armv7= fails to link: os_dep.c: undefined reference to '__stack_base__'
-BROKEN_mips64= fails to compile: os_dep.c: redefinition of 'GC_register_dynamic_libraries'
NOT_FOR_ARCHS= aarch64 riscv64
NOT_FOR_ARCHS_REASON= gcconfig.h: the collector has not been ported to this machine/OS combination
diff --git a/lang/mosml/Makefile b/lang/mosml/Makefile
--- a/lang/mosml/Makefile
+++ b/lang/mosml/Makefile
@@ -14,8 +14,6 @@
LICENSE_TEXT= Restrictions on for-profit distribution
LICENSE_PERMS= auto-accept
-BROKEN_mips= does not configure: this architecture seems to be neither big endian nor little endian
-BROKEN_mips64= does not configure: this architecture seems to be neither big endian nor little endian
BROKEN_powerpc64= does not configure: this architecture seems to be neither big endian nor little endian
LIB_DEPENDS= libgmp.so:math/gmp \
diff --git a/lang/opencoarrays/Makefile b/lang/opencoarrays/Makefile
--- a/lang/opencoarrays/Makefile
+++ b/lang/opencoarrays/Makefile
@@ -35,13 +35,11 @@
OPTIONS_EXCLUDE_armv6= MPICH
OPTIONS_EXCLUDE_armv7= MPICH
OPTIONS_EXCLUDE_i386= MPICH
-OPTIONS_EXCLUDE_mips= MPICH
OPTIONS_EXCLUDE_powerpc= MPICH
OPTIONS_EXCLUDE_powerpcspe= MPICH
OPTIONS_DEFAULT_armv6= OPENMPI
OPTIONS_DEFAULT_armv7= OPENMPI
OPTIONS_DEFAULT_i386= OPENMPI
-OPTIONS_DEFAULT_mips= OPENMPI
OPTIONS_DEFAULT_powerpc= OPENMPI
OPTIONS_DEFAULT_powerpcspe= OPENMPI
diff --git a/lang/opensycl/Makefile b/lang/opensycl/Makefile
--- a/lang/opensycl/Makefile
+++ b/lang/opensycl/Makefile
@@ -11,7 +11,6 @@
LICENSE_FILE= ${WRKSRC}/LICENSE
BROKEN_i386= fails to compile: error: static_assert failed due to requirement 'sizeof(hipsycl::glue::unique_id) == 2 * sizeof(void *)'
-BROKEN_FreeBSD_13_armv7= configure fails: Cannot run simple program using std::filesystem
BUILD_DEPENDS= boost-libs>0:devel/boost-libs
diff --git a/lang/perl5-devel/Makefile b/lang/perl5-devel/Makefile
--- a/lang/perl5-devel/Makefile
+++ b/lang/perl5-devel/Makefile
@@ -143,7 +143,6 @@
OPTIONS_EXCLUDE= DTRACE
.endif
.for a in aarch64 armv6 armv7 \
- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
riscv64 riscv64sf
OPTIONS_EXCLUDE_${a}= DTRACE
.endfor
diff --git a/lang/perl5.38/Makefile b/lang/perl5.38/Makefile
--- a/lang/perl5.38/Makefile
+++ b/lang/perl5.38/Makefile
@@ -132,7 +132,6 @@
OPTIONS_EXCLUDE= DTRACE
.endif
.for a in aarch64 armv6 armv7 \
- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
riscv64 riscv64sf
OPTIONS_EXCLUDE_${a}= DTRACE
.endfor
diff --git a/lang/perl5.40/Makefile b/lang/perl5.40/Makefile
--- a/lang/perl5.40/Makefile
+++ b/lang/perl5.40/Makefile
@@ -132,7 +132,6 @@
OPTIONS_EXCLUDE= DTRACE
.endif
.for a in aarch64 armv6 armv7 \
- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
riscv64 riscv64sf
OPTIONS_EXCLUDE_${a}= DTRACE
.endfor
diff --git a/lang/perl5.42/Makefile b/lang/perl5.42/Makefile
--- a/lang/perl5.42/Makefile
+++ b/lang/perl5.42/Makefile
@@ -134,7 +134,6 @@
OPTIONS_EXCLUDE= DTRACE
.endif
.for a in aarch64 armv6 armv7 \
- mips mips64 mips64el mips64elhf mips64hf mipsel mipselhf mipshf mipsn32 \
riscv64 riscv64sf
OPTIONS_EXCLUDE_${a}= DTRACE
.endfor
diff --git a/lang/php82/Makefile b/lang/php82/Makefile
--- a/lang/php82/Makefile
+++ b/lang/php82/Makefile
@@ -47,9 +47,6 @@
# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
OPTIONS_EXCLUDE_armv6= DTRACE
OPTIONS_EXCLUDE_armv7= DTRACE
-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
-OPTIONS_EXCLUDE_mips= DTRACE FPM
-OPTIONS_EXCLUDE_mips64= DTRACE FPM
OPTIONS_EXCLUDE_riscv64= DTRACE
NO_OPTIONS_SORT= yes
OPTIONS_SUB= yes
diff --git a/lang/php83/Makefile b/lang/php83/Makefile
--- a/lang/php83/Makefile
+++ b/lang/php83/Makefile
@@ -47,9 +47,6 @@
# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
OPTIONS_EXCLUDE_armv6= DTRACE
OPTIONS_EXCLUDE_armv7= DTRACE
-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
-OPTIONS_EXCLUDE_mips= DTRACE FPM
-OPTIONS_EXCLUDE_mips64= DTRACE FPM
OPTIONS_EXCLUDE_riscv64= DTRACE
NO_OPTIONS_SORT= yes
OPTIONS_SUB= yes
diff --git a/lang/php84/Makefile b/lang/php84/Makefile
--- a/lang/php84/Makefile
+++ b/lang/php84/Makefile
@@ -45,9 +45,6 @@
# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
OPTIONS_EXCLUDE_armv6= DTRACE
OPTIONS_EXCLUDE_armv7= DTRACE
-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
-OPTIONS_EXCLUDE_mips= DTRACE FPM
-OPTIONS_EXCLUDE_mips64= DTRACE FPM
OPTIONS_EXCLUDE_riscv64= DTRACE
NO_OPTIONS_SORT= yes
OPTIONS_SUB= yes
diff --git a/lang/php85/Makefile b/lang/php85/Makefile
--- a/lang/php85/Makefile
+++ b/lang/php85/Makefile
@@ -46,9 +46,6 @@
# dt_modtext:opensolaris/ib/libdtrace/common/dt_link.c: arm not impemented
OPTIONS_EXCLUDE_armv6= DTRACE
OPTIONS_EXCLUDE_armv7= DTRACE
-# Bug 197128: No ASM code for MIPS/MIPS64, disable FPM
-OPTIONS_EXCLUDE_mips= DTRACE FPM
-OPTIONS_EXCLUDE_mips64= DTRACE FPM
OPTIONS_EXCLUDE_riscv64= DTRACE
NO_OPTIONS_SORT= yes
OPTIONS_SUB= yes
diff --git a/lang/python27/Makefile b/lang/python27/Makefile
--- a/lang/python27/Makefile
+++ b/lang/python27/Makefile
@@ -120,7 +120,7 @@
# openssl/opensslv.h so setup.py just detects the string as 00000000
# However care should be taken for the OSVERSION. If OpenSSL 3.0.9
# lands later the OSVERSION string should be fixed accordingly
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && (${SSL_DEFAULT} == base || \
+.if ${OPSYS} == FreeBSD && (${SSL_DEFAULT} == base || \
${SSL_DEFAULT} == openssl || ${SSL_DEFAULT:Mopenssl3*} )
@${REINPLACE_CMD} -e 's|00907000|00000000|' \
${WRKSRC}/setup.py
diff --git a/lang/swift510/Makefile b/lang/swift510/Makefile
--- a/lang/swift510/Makefile
+++ b/lang/swift510/Makefile
@@ -80,12 +80,6 @@
PLIST_SUB= SWIFT_ARCH=${swift_arch} \
SWIFT_TARGET_TRIPLE=${swift_arch}-unknown-freebsd${OSREL}
-.include <bsd.port.pre.mk>
-
-.if ${OSVERSION} >= 1304500 && ${OSVERSION} <= 1305502
-BROKEN= Unbuildable due to a problem with libc++. See <https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=286342>
-.endif
-
pre-patch:
@${MKDIR} ${WRKSRC}/llbuild/lib/LLBSQLite3
@@ -111,4 +105,4 @@
${COPYTREE_SHARE} .${swift_install_prefix}/$${subdir} ${STAGEDIR} ; \
done
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/lang/swipl/Makefile b/lang/swipl/Makefile
--- a/lang/swipl/Makefile
+++ b/lang/swipl/Makefile
@@ -12,8 +12,6 @@
LICENSE= BSD2CLAUSE
BROKEN_i386= FAILED: man/lib/clpfdlib.tex
-BROKEN_mips= fails to link: libswipl.so: undefined reference to '__sync_sub_and_fetch_4'
-BROKEN_mips64= fails to link: libswipl.so: undefined reference to '__sync_sub_and_fetch_4'
LIB_DEPENDS= libpcre2-posix.so:devel/pcre2 \
libossp-uuid.so:misc/ossp-uuid \
diff --git a/mail/archiveopteryx/Makefile b/mail/archiveopteryx/Makefile
--- a/mail/archiveopteryx/Makefile
+++ b/mail/archiveopteryx/Makefile
@@ -50,7 +50,7 @@
${WRKSRC}/Jamsettings
${REINPLACE_CMD} -e "s|\(-lcrypto\)|-L${OPENSSLLIB} \1|g" \
${WRKSRC}/server/Jamfile
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
@${REINPLACE_CMD} -e 's|-Werror|-Werror -DOPENSSL_API_COMPAT=0x10100000L|g' \
${WRKSRC}/Jamsettings
.endif
diff --git a/mail/fetchmail/Makefile b/mail/fetchmail/Makefile
--- a/mail/fetchmail/Makefile
+++ b/mail/fetchmail/Makefile
@@ -108,10 +108,8 @@
.include <bsd.port.pre.mk>
.if ${PORT_OPTIONS:MOPIE} && ${MASTERDIR} == ${.CURDIR} && ${OPSYS} == FreeBSD
-. if ${OSVERSION} >= 1400072
LIB_DEPENDS+= libopie.so:security/opie # moved to port (from base in 13.X)
CPPFLAGS+= -I${LOCALBASE}/include
-. endif
.endif
.include <bsd.port.post.mk>
diff --git a/mail/rmilter/Makefile b/mail/rmilter/Makefile
--- a/mail/rmilter/Makefile
+++ b/mail/rmilter/Makefile
@@ -11,9 +11,6 @@
LIB_DEPENDS= libpcre.so:devel/pcre
-NOT_FOR_ARCHS= mips
-NOT_FOR_ARCHS_REASON= fails to compile: error: Unsupported word size
-
USE_GITHUB= yes
GH_ACCOUNT= vstakhov
diff --git a/math/colpack/Makefile b/math/colpack/Makefile
--- a/math/colpack/Makefile
+++ b/math/colpack/Makefile
@@ -12,8 +12,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13_armv7= compilation fails: error: expected identifier before '__is_convertible'
-
USES= cmake
USE_LDCONFIG= yes
diff --git a/math/gecode/Makefile b/math/gecode/Makefile
--- a/math/gecode/Makefile
+++ b/math/gecode/Makefile
@@ -11,7 +11,7 @@
LICENSE= BSL MIT
LICENSE_COMB= multi
-NOT_FOR_ARCHS= armv6 armv7 mips mips64
+NOT_FOR_ARCHS= armv6 armv7
NOT_FOR_ARCHS_REASON= needs code written to specify rounding control mechanism in Boost.Numeric.Interval
USES= bison:build compiler:c++11-lang gmake perl5
diff --git a/math/gmp/Makefile b/math/gmp/Makefile
--- a/math/gmp/Makefile
+++ b/math/gmp/Makefile
@@ -31,10 +31,6 @@
.include <bsd.port.pre.mk>
-.if ${ARCH:Mmips*}
-MAKE_JOBS_UNSAFE=yes
-.endif
-
.if ! ${PORT_OPTIONS:MCPU_OPTS}
CONFIGURE_ARGS+=--build=${CONFIGURE_TARGET}
.elif ${ARCH:S/64//} != ${ARCH}
diff --git a/math/gretl/Makefile b/math/gretl/Makefile
--- a/math/gretl/Makefile
+++ b/math/gretl/Makefile
@@ -11,8 +11,6 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_FreeBSD_13= configure fails: checking for gnuplot >= 5.2 with cairo support... no
-
LIB_DEPENDS= libcurl.so:ftp/curl \
libfftw3.so:math/fftw3 \
libgmp.so:math/gmp \
diff --git a/math/heyoka/Makefile b/math/heyoka/Makefile
--- a/math/heyoka/Makefile
+++ b/math/heyoka/Makefile
@@ -12,7 +12,6 @@
LICENSE_FILE= ${WRKSRC}/COPYING
BROKEN= Fails to build with fmt 12+, The supported fmt versions are in the range [9, 11], but version 12 was found instead.
-#BROKEN_FreeBSD_13= compilation fails: no member named 'transform' in namespace 'std::ranges'; did you mean 'llvm::transform' (std::ranges::transform isn't present)
LIB_DEPENDS= libboost_serialization.so:devel/boost-libs \
libfmt.so:devel/libfmt \
diff --git a/math/lean4/Makefile b/math/lean4/Makefile
--- a/math/lean4/Makefile
+++ b/math/lean4/Makefile
@@ -11,7 +11,6 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= compilation fails: error: use of undeclared identifier 'clearenv'
BROKEN_armv7= compilation fails: ../../.build/stage1/lib/temp/Init/Coe.depend: No such file or directory
BROKEN_i386= linking fails: INTERNAL PANIC: out of memory (during: Linking runLinter)
diff --git a/math/lp_solve/Makefile b/math/lp_solve/Makefile
--- a/math/lp_solve/Makefile
+++ b/math/lp_solve/Makefile
@@ -19,7 +19,7 @@
.include <bsd.port.pre.mk>
-.if ${ARCH} == armv6 || ${ARCH} == armv7 || ${ARCH} == i386 || ${ARCH} == mips || \
+.if ${ARCH} == armv6 || ${ARCH} == armv7 || ${ARCH} == i386 || \
${ARCH} == powerpc || ${ARCH} == powerpcspe
LPSOLVE_ARCH= ux32
.else
diff --git a/math/onednn/Makefile b/math/onednn/Makefile
--- a/math/onednn/Makefile
+++ b/math/onednn/Makefile
@@ -10,7 +10,7 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
BROKEN_aarch64= error: sys/prctl.h file not found
.if !exists(/usr/include/omp.h)
BROKEN= requires OpenMP support that is missing on this architecture
diff --git a/math/onednn252/Makefile b/math/onednn252/Makefile
--- a/math/onednn252/Makefile
+++ b/math/onednn252/Makefile
@@ -11,7 +11,7 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
BROKEN_aarch64= error: sys/prctl.h file not found
.if !exists(/usr/include/omp.h)
BROKEN= requires OpenMP support that is missing on this architecture
diff --git a/math/pari/Makefile b/math/pari/Makefile
--- a/math/pari/Makefile
+++ b/math/pari/Makefile
@@ -11,8 +11,6 @@
LICENSE= GPLv2
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips64= fails to link: mpker.c:(.text+0x33bc): relocation truncated to fit: R_MIPS_TLS_GD against 'PARI_SIGINT_block'
-
LIB_DEPENDS= libgmp.so:math/gmp
USES= bison perl5 readline
diff --git a/misc/libpostal/Makefile b/misc/libpostal/Makefile
--- a/misc/libpostal/Makefile
+++ b/misc/libpostal/Makefile
@@ -15,9 +15,6 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_mips= fails to compile: tagger.h:5: redefinition of typedef 'tagger_feature_function'
-BROKEN_mips64= fails to compile: tagger.h:5: redefinition of typedef 'tagger_feature_function'
-
RUN_DEPENDS= curl:ftp/curl
USES= autoreconf libtool localbase
diff --git a/misc/mtx/Makefile b/misc/mtx/Makefile
--- a/misc/mtx/Makefile
+++ b/misc/mtx/Makefile
@@ -18,13 +18,10 @@
PLIST_FILES= sbin/mtx sbin/tapeinfo sbin/loaderinfo sbin/scsitape sbin/scsieject \
share/man/man1/loaderinfo.1.gz share/man/man1/mtx.1.gz share/man/man1/tapeinfo.1.gz \
share/man/man1/scsitape.1.gz share/man/man1/scsieject.1.gz
+EXTRA_PATCHES= ${PATCHDIR}/extra-patch-FreeBSD_14
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079
-EXTRA_PATCHES= ${PATCHDIR}/extra-patch-FreeBSD_14
-.endif
-
post-patch:
${REINPLACE_CMD} -e 's|@prefix@|${STAGEDIR}${PREFIX}|g' \
${WRKSRC}/Makefile.in
diff --git a/misc/qman/Makefile b/misc/qman/Makefile
--- a/misc/qman/Makefile
+++ b/misc/qman/Makefile
@@ -12,7 +12,7 @@
BUILD_DEPENDS= cog:devel/py-cogapp
-USES= groff:run meson pkgconfig
+USES= groff:run meson ncurses pkgconfig
USE_GITHUB= yes
GH_ACCOUNT= plp13
@@ -39,13 +39,6 @@
.include <bsd.port.options.mk>
-# FreeBSD 13 is missing /usr/libdata/pkgconfig/ncursesw.pc
-.if ${OPSYS} == FreeBSD && ${OSREL:R} == 13
-USES+= ncurses:port
-.else
-USES+= ncurses
-.endif
-
post-patch:
@${REINPLACE_CMD} -e 's|%%LOCALBASE%%|${LOCALBASE}|' \
${WRKSRC}/config/qman.conf
diff --git a/misc/thrill/Makefile b/misc/thrill/Makefile
--- a/misc/thrill/Makefile
+++ b/misc/thrill/Makefile
@@ -10,7 +10,7 @@
LICENSE= BSD2CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe # static_assert failed due to requirement 'sizeof(unsigned int) == 8' "FOXXLL supports only 64-bit builds"
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe # static_assert failed due to requirement 'sizeof(unsigned int) == 8' "FOXXLL supports only 64-bit builds"
LIB_DEPENDS= libmpi_cxx.so:net/openmpi4
diff --git a/multimedia/ab25/Makefile b/multimedia/ab25/Makefile
--- a/multimedia/ab25/Makefile
+++ b/multimedia/ab25/Makefile
@@ -23,11 +23,7 @@
OPTIONS_DEFINE= DOCS
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS} == FreeBSD && ${OSVERSION} <= 1400079
-PLIST_FILES+= lib/libab25_p.a
-.endif
+.include <bsd.port.options.mk>
pre-install:
@${MKDIR} ${STAGEDIR}${PREFIX}/include/ab25
@@ -36,4 +32,4 @@
@${MKDIR} ${STAGEDIR}${DOCSDIR}
cd ${WRKSRC} && ${INSTALL_DATA} ${PORTDOCS} ${STAGEDIR}${DOCSDIR}
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/multimedia/ffmpeg3/Makefile b/multimedia/ffmpeg3/Makefile
--- a/multimedia/ffmpeg3/Makefile
+++ b/multimedia/ffmpeg3/Makefile
@@ -16,7 +16,7 @@
LICENSE= GPLv2+ LGPL21+
LICENSE_COMB= multi
-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= emulators/ppsspp only supports little-endian, see \
https://github.com/hrydgard/ppsspp/issues/8823
diff --git a/multimedia/gst123/Makefile b/multimedia/gst123/Makefile
--- a/multimedia/gst123/Makefile
+++ b/multimedia/gst123/Makefile
@@ -19,15 +19,8 @@
PLIST_FILES= bin/${PORTNAME} share/man/man1/${PORTNAME}.1.gz
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
-CONFIGURE_ENV= NCURSES_CFLAGS=-I${NCURSESINC} NCURSES_LIBS=-L${NCURSESLIB}
-LDFLAGS+= ${TINFO_LIB}
-.endif
-
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/src/${PORTNAME} ${STAGEDIR}${PREFIX}/bin
${INSTALL_MAN} ${WRKSRC}/docs/${PORTNAME}.1 ${STAGEDIR}${PREFIX}/share/man/man1
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/multimedia/lms/Makefile b/multimedia/lms/Makefile
--- a/multimedia/lms/Makefile
+++ b/multimedia/lms/Makefile
@@ -47,11 +47,6 @@
MAGICK_CMAKE_ON= -DLMS_IMAGE_BACKEND:STRING=graphicsmagick
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000
-USES+= llvm:17 # fix the build failure on 13: error: object of type 'const lms::core::LiteralString' cannot be compared because its 'operator<=>' is implicitly deleted
-.else
-USES+= compiler:c++20-lang
-.endif
post-patch:
@${REINPLACE_CMD} -e 's|"/etc"|"${PREFIX}/etc"|' \
diff --git a/multimedia/oscam/Makefile b/multimedia/oscam/Makefile
--- a/multimedia/oscam/Makefile
+++ b/multimedia/oscam/Makefile
@@ -26,12 +26,6 @@
WRKSRC= ${WRKDIR}/${PORTNAME}-ef7f844
-.include <bsd.port.pre.mk>
-
-.if ${ARCH:Mmips*}
-USE_GCC= yes
-.endif
-
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/Distribution/oscam ${STAGEDIR}${PREFIX}/bin/
${INSTALL_MAN} ${WRKSRC}/Distribution/doc/man/*.1 ${STAGEDIR}${PREFIX}/share/man/man1/
@@ -41,4 +35,4 @@
${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/
${INSTALL_DATA} ${WRKSRC}/Distribution/doc/example/* ${STAGEDIR}${EXAMPLESDIR}/
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/multimedia/tsduck/Makefile b/multimedia/tsduck/Makefile
--- a/multimedia/tsduck/Makefile
+++ b/multimedia/tsduck/Makefile
@@ -11,8 +11,6 @@
LICENSE= BSD2CLAUSE
-BROKEN_FreeBSD_13= requires OpenSSL 3.0
-
BUILD_DEPENDS= bash:shells/bash \
coreutils>0:sysutils/coreutils \
dos2unix:converters/unix2dos \
diff --git a/net-im/kaccounts-integration/Makefile b/net-im/kaccounts-integration/Makefile
--- a/net-im/kaccounts-integration/Makefile
+++ b/net-im/kaccounts-integration/Makefile
@@ -18,10 +18,4 @@
iconthemes:run
USE_QT= base declarative
-.include <bsd.port.options.mk>
-
-.if ${ARCH:Mpowerpc*} && ${OSVERSION} < 1400092
-USES+= llvm:min=16
-.endif
-
.include <bsd.port.mk>
diff --git a/net-im/prosody/Makefile b/net-im/prosody/Makefile
--- a/net-im/prosody/Makefile
+++ b/net-im/prosody/Makefile
@@ -61,10 +61,4 @@
@${MKDIR} ${STAGEDIR}/var/run/prosody
@${RM} ${STAGEDIR}${ETCDIR}/certs/*
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000 && ${SSL_DEFAULT} == base
-EXTRA_PATCHES= ${PATCHDIR}/freebsd-13-patches
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/net-mgmt/andwatch/Makefile b/net-mgmt/andwatch/Makefile
--- a/net-mgmt/andwatch/Makefile
+++ b/net-mgmt/andwatch/Makefile
@@ -9,8 +9,6 @@
LICENSE= BSD2CLAUSE
-BROKEN_FreeBSD_13= Does not build
-
LIB_DEPENDS= libsqlite3.so:databases/sqlite3 \
libcurl.so:ftp/curl
diff --git a/net-mgmt/ipfixcol2/Makefile b/net-mgmt/ipfixcol2/Makefile
--- a/net-mgmt/ipfixcol2/Makefile
+++ b/net-mgmt/ipfixcol2/Makefile
@@ -34,12 +34,6 @@
OPTIONS_DEFINE= EXAMPLES
-# XXX Drop after FreeBSD 13 EOL around 2026-04-30
-.if !exists(/usr/include/sys/timerfd.h)
-CFLAGS+= `pkg-config --cflags epoll-shim`
-LDFLAGS+= `pkg-config --libs epoll-shim`
-.endif
-
post-install:
${MKDIR} ${STAGEDIR}${ETCDIR} ${STAGEDIR}/var/run/${PORTNAME}
${INSTALL_DATA} ${WRKSRC}/doc/data/configs/udp2json.xml \
diff --git a/net-mgmt/net-snmp/Makefile b/net-mgmt/net-snmp/Makefile
--- a/net-mgmt/net-snmp/Makefile
+++ b/net-mgmt/net-snmp/Makefile
@@ -14,9 +14,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/COPYING
-NOT_FOR_ARCHS= mips mips64
-NOT_FOR_ARCHS_REASON= SSP is currently broken on MIPS
-
OPTIONS_DEFINE= MFD_REWRITES PERL PERL_EMBEDDED PYTHON DUMMY TKMIB \
MYSQL AX_SOCKONLY UNPRIVILEGED SMUX DOCS AX_DISABLE_TRAP \
TLS NEWSYSLOG NOLIBPKG SCTP AES
diff --git a/net-p2p/hostd/Makefile b/net-p2p/hostd/Makefile
--- a/net-p2p/hostd/Makefile
+++ b/net-p2p/hostd/Makefile
@@ -11,7 +11,7 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= requires 64-bit architecture
USES= go:1.24+,modules
diff --git a/net-p2p/ncdc/Makefile b/net-p2p/ncdc/Makefile
--- a/net-p2p/ncdc/Makefile
+++ b/net-p2p/ncdc/Makefile
@@ -28,8 +28,4 @@
.include <bsd.port.options.mk>
-.if ${OPSYS}_${OSREL:R} == FreeBSD_13
-CONFIGURE_ENV= NCURSES_CFLAGS="-L${NCURSESLIB}" NCURSES_LIBS="-lncursesw"
-.endif
-
.include <bsd.port.mk>
diff --git a/net-p2p/qbittorrent/Makefile b/net-p2p/qbittorrent/Makefile
--- a/net-p2p/qbittorrent/Makefile
+++ b/net-p2p/qbittorrent/Makefile
@@ -70,13 +70,6 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000
-#LIB_DEPENDS+= libcrypto.so:security/openssl # LIB_DEPENDS doesn't work here (after bsd.port.options.mk)
-BUILD_DEPENDS+= openssl>0:security/openssl
-RUN_DEPENDS+= openssl>0:security/openssl
-CMAKE_ARGS= -DOPENSSL_ROOT_DIR=${LOCALBASE}
-.endif
-
post-patch-PYTHON-on:
@${REINPLACE_CMD} \
-e 's|"python3"|"${PYTHON_CMD}"|' \
diff --git a/net-p2p/renterd/Makefile b/net-p2p/renterd/Makefile
--- a/net-p2p/renterd/Makefile
+++ b/net-p2p/renterd/Makefile
@@ -11,7 +11,7 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= requires 64-bit architecture
USES= go:1.24+,modules
diff --git a/net-p2p/tremotesf/Makefile b/net-p2p/tremotesf/Makefile
--- a/net-p2p/tremotesf/Makefile
+++ b/net-p2p/tremotesf/Makefile
@@ -28,7 +28,7 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092
+.if ${OPSYS} == FreeBSD
TEST_DEPENDS= cpp-httplib>0:www/cpp-httplib
CMAKE_ARGS= -DTREMOTESF_WITH_HTTPLIB=system
.else
diff --git a/net-p2p/walletd/Makefile b/net-p2p/walletd/Makefile
--- a/net-p2p/walletd/Makefile
+++ b/net-p2p/walletd/Makefile
@@ -12,7 +12,7 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= requires 64-bit architecture
USES= go:1.24+,modules
diff --git a/net/aoe/Makefile b/net/aoe/Makefile
--- a/net/aoe/Makefile
+++ b/net/aoe/Makefile
@@ -13,7 +13,6 @@
BROKEN= aoenet.c:119:20: error: incomplete definition of type 'struct ifnet'
BROKEN_armv6= fails to compile: implicit declaration of function 'cp15_pmccntr_get' is invalid in C99
-BROKEN_FreeBSD_13= crashes dereferencing vnet_entry_ifnet
BROKEN_FreeBSD_14= crashes dereferencing vnet_entry_ifnet
USES= kmod uidfix
diff --git a/net/asterisk20/Makefile b/net/asterisk20/Makefile
--- a/net/asterisk20/Makefile
+++ b/net/asterisk20/Makefile
@@ -234,7 +234,7 @@
EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-third-party_pjproject_Makefile
.endif
-.if (${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base) || \
+.if (${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base) || \
${SSL_DEFAULT:Mopenssl3*}
LIB_DEPENDS+= libgnutls.so:security/gnutls
CFLAGS+= -DOPENSSL_API_COMPAT=0x10100000L
diff --git a/net/asterisk22/Makefile b/net/asterisk22/Makefile
--- a/net/asterisk22/Makefile
+++ b/net/asterisk22/Makefile
@@ -232,7 +232,7 @@
EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-third-party_pjproject_Makefile
.endif
-.if (${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base) || \
+.if (${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base) || \
${SSL_DEFAULT:Mopenssl3*}
LIB_DEPENDS+= libgnutls.so:security/gnutls
CFLAGS+= -DOPENSSL_API_COMPAT=0x10100000L
diff --git a/net/bctoolbox/Makefile b/net/bctoolbox/Makefile
--- a/net/bctoolbox/Makefile
+++ b/net/bctoolbox/Makefile
@@ -27,12 +27,6 @@
CFLAGS+= -DHAVE_ARC4RANDOM
LDFLAGS+= -lpthread
-.include <bsd.port.options.mk>
-
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} < 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl111}
-IGNORE= is not supported on systems with OpenSSL 1.1.1
-.endif
-
post-patch:
@${REINPLACE_CMD} '/clock_gettime/d' ${WRKSRC}/CMakeLists.txt
diff --git a/net/bird2/Makefile b/net/bird2/Makefile
--- a/net/bird2/Makefile
+++ b/net/bird2/Makefile
@@ -67,14 +67,4 @@
CONFIGURE_ARGS+=--with-sysconfig=bsd-netlink
.endif
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400000
-FLAVORS= rtsock netlink
-netlink_PKGNAMESUFFIX= 2-netlink
-rtsock_PKGNAMESUFFIX= 2
-.endif
-
-.if ${OPSYS} == FreeBSD && (${OSVERSION} >= 1500000 && ${OSVERSION} < 1500017)
-EXTRA_PATCHES= ${PATCHDIR}/extra-patch-netlink-route
-.endif
-
.include <bsd.port.mk>
diff --git a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-route.h b/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-route.h
deleted file mode 100644
--- a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-route.h
+++ /dev/null
@@ -1,370 +0,0 @@
---- /dev/null 2024-03-22 15:39:07.538356000 +0100
-+++ sysdep/bsd-netlink/netlink-route.h 2024-03-22 15:39:02.226088000 +0100
-@@ -0,0 +1,367 @@
-+/*-
-+ * SPDX-License-Identifier: BSD-2-Clause
-+ *
-+ * Copyright (c) 2022 Alexander V. Chernikov <melifaro@FreeBSD.org>
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ * notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ * notice, this list of conditions and the following disclaimer in the
-+ * documentation and/or other materials provided with the distribution.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ */
-+
-+/*
-+ * Route-related (RTM_<NEW|DEL|GET>ROUTE) message header and attributes.
-+ */
-+
-+#ifndef _NETLINK_ROUTE_ROUTE_H_
-+#define _NETLINK_ROUTE_ROUTE_H_
-+
-+/* Base header for all of the relevant messages */
-+struct rtmsg {
-+ unsigned char rtm_family; /* address family */
-+ unsigned char rtm_dst_len; /* Prefix length */
-+ unsigned char rtm_src_len; /* Source prefix length (not used) */
-+ unsigned char rtm_tos; /* Type of service (not used) */
-+ unsigned char rtm_table; /* rtable id */
-+ unsigned char rtm_protocol; /* Routing protocol id (RTPROT_) */
-+ unsigned char rtm_scope; /* Route distance (RT_SCOPE_) */
-+ unsigned char rtm_type; /* Route type (RTN_) */
-+ unsigned rtm_flags; /* Route flags (RTM_F_) */
-+};
-+
-+/*
-+ * RFC 3549, 3.1.1, route type (rtm_type field).
-+ */
-+enum {
-+ RTN_UNSPEC,
-+ RTN_UNICAST, /* Unicast route */
-+ RTN_LOCAL, /* Accept locally (not supported) */
-+ RTN_BROADCAST, /* Accept locally as broadcast, send as broadcast */
-+ RTN_ANYCAST, /* Accept locally as broadcast, but send as unicast */
-+ RTN_MULTICAST, /* Multicast route */
-+ RTN_BLACKHOLE, /* Drop traffic towards destination */
-+ RTN_UNREACHABLE, /* Destination is unreachable */
-+ RTN_PROHIBIT, /* Administratively prohibited */
-+ RTN_THROW, /* Not in this table (not supported) */
-+ RTN_NAT, /* Translate this address (not supported) */
-+ RTN_XRESOLVE, /* Use external resolver (not supported) */
-+ __RTN_MAX,
-+};
-+#define RTN_MAX (__RTN_MAX - 1)
-+
-+/*
-+ * RFC 3549, 3.1.1, protocol (Identifies what/who added the route).
-+ * Values larger than RTPROT_STATIC(4) are not interpreted by the
-+ * kernel, they are just for user information.
-+ */
-+#define RTPROT_UNSPEC 0
-+#define RTPROT_REDIRECT 1 /* Route installed by ICMP redirect */
-+#define RTPROT_KERNEL 2 /* Route installed by kernel */
-+#define RTPROT_BOOT 3 /* Route installed during boot */
-+#define RTPROT_STATIC 4 /* Route installed by administrator */
-+
-+#define RTPROT_GATED 8
-+#define RTPROT_RA 9
-+#define RTPROT_MRT 1
-+#define RTPROT_ZEBRA 11
-+#define RTPROT_BIRD 12
-+#define RTPROT_DNROUTED 13
-+#define RTPROT_XORP 14
-+#define RTPROT_NTK 15
-+#define RTPROT_DHCP 16
-+#define RTPROT_MROUTED 17
-+#define RTPROT_KEEPALIVED 18
-+#define RTPROT_BABEL 42
-+#define RTPROT_OPENR 99
-+#define RTPROT_BGP 186
-+#define RTPROT_ISIS 187
-+#define RTPROT_OSPF 188
-+#define RTPROT_RIP 189
-+#define RTPROT_EIGRP 192
-+
-+/*
-+ * RFC 3549 3.1.1 Route scope (valid distance to destination).
-+ *
-+ * The values between RT_SCOPE_UNIVERSE(0) and RT_SCOPE_SITE(200)
-+ * are available to the user.
-+ */
-+enum rt_scope_t {
-+ RT_SCOPE_UNIVERSE = 0,
-+ /* User defined values */
-+ RT_SCOPE_SITE = 200,
-+ RT_SCOPE_LINK = 253,
-+ RT_SCOPE_HOST = 254,
-+ RT_SCOPE_NOWHERE = 255
-+};
-+
-+/*
-+ * RFC 3549 3.1.1 Route flags (rtm_flags).
-+ * Is a composition of RTNH_F flags (0x1..0x40 range), RTM_F flags (below)
-+ * and per-protocol (IPv4/IPv6) flags.
-+ */
-+#define RTM_F_NOTIFY 0x00000100 /* not supported */
-+#define RTM_F_CLONED 0x00000200 /* not supported */
-+#define RTM_F_EQUALIZE 0x00000400 /* not supported */
-+#define RTM_F_PREFIX 0x00000800 /* not supported */
-+#define RTM_F_LOOKUP_TABLE 0x00001000 /* not supported */
-+#define RTM_F_FIB_MATCH 0x00002000 /* not supported */
-+#define RTM_F_OFFLOAD 0x00004000 /* not supported */
-+#define RTM_F_TRAP 0x00008000 /* not supported */
-+#define RTM_F_OFFLOAD_FAILED 0x20000000 /* not supported */
-+
-+/* Compatibility handling helpers */
-+#ifndef _KERNEL
-+#define NL_RTM_HDRLEN ((int)sizeof(struct rtmsg))
-+#define RTM_RTA(_rtm) ((struct rtattr *)((char *)(_rtm) + NL_RTM_HDRLEN))
-+#define RTM_PAYLOAD(_hdr) NLMSG_PAYLOAD((_hdr), NL_RTM_HDRLEN)
-+#endif
-+
-+/*
-+ * Routing table identifiers.
-+ * FreeBSD route table numbering starts from 0, where 0 is a valid default routing table.
-+ * Indicating "all tables" via netlink can be done by not including RTA_TABLE attribute
-+ * and keeping rtm_table=0 (compatibility) or setting RTA_TABLE value to RT_TABLE_UNSPEC.
-+ */
-+#define RT_TABLE_MAIN 0 /* RT_DEFAULT_FIB */
-+#define RT_TABLE_UNSPEC 0xFFFFFFFF /* RT_ALL_FIBS */
-+
-+enum rtattr_type_t {
-+ NL_RTA_UNSPEC,
-+ NL_RTA_DST = 1, /* binary, IPv4/IPv6 destination */
-+ NL_RTA_SRC = 2, /* binary, preferred source address */
-+ NL_RTA_IIF = 3, /* not supported */
-+ NL_RTA_OIF = 4, /* u32, transmit ifindex */
-+ NL_RTA_GATEWAY = 5, /* binary: IPv4/IPv6 gateway */
-+ NL_RTA_PRIORITY = 6, /* not supported */
-+ NL_RTA_PREFSRC = 7, /* not supported */
-+ NL_RTA_METRICS = 8, /* nested, list of NL_RTAX* attrs */
-+ NL_RTA_MULTIPATH = 9, /* binary, array of struct rtnexthop */
-+ NL_RTA_PROTOINFO = 10, /* not supported / deprecated */
-+ NL_RTA_KNH_ID = 10, /* u32, FreeBSD specific, kernel nexthop index */
-+ NL_RTA_FLOW = 11, /* not supported */
-+ NL_RTA_CACHEINFO = 12, /* not supported */
-+ NL_RTA_SESSION = 13, /* not supported / deprecated */
-+ NL_RTA_WEIGHT = 13, /* u32, FreeBSD specific, path weight */
-+ NL_RTA_MP_ALGO = 14, /* not supported / deprecated */
-+ NL_RTA_RTFLAGS = 14, /* u32, FreeBSD specific, path flags (RTF_)*/
-+ NL_RTA_TABLE = 15, /* u32, fibnum */
-+ NL_RTA_MARK = 16, /* not supported */
-+ NL_RTA_MFC_STATS = 17, /* not supported */
-+ NL_RTA_VIA = 18, /* binary, struct rtvia */
-+ NL_RTA_NEWDST = 19, /* not supported */
-+ NL_RTA_PREF = 20, /* not supported */
-+ NL_RTA_ENCAP_TYPE = 21, /* not supported */
-+ NL_RTA_ENCAP = 22, /* not supported */
-+ NL_RTA_EXPIRES = 23, /* u32, seconds till expiration */
-+ NL_RTA_PAD = 24, /* not supported */
-+ NL_RTA_UID = 25, /* not supported */
-+ NL_RTA_TTL_PROPAGATE = 26, /* not supported */
-+ NL_RTA_IP_PROTO = 27, /* not supported */
-+ NL_RTA_SPORT = 28, /* not supported */
-+ NL_RTA_DPORT = 29, /* not supported */
-+ NL_RTA_NH_ID = 30, /* u32, nexthop/nexthop group index */
-+ __RTA_MAX
-+};
-+#define NL_RTA_MAX (__RTA_MAX - 1)
-+
-+/*
-+ * Attributes that can be used as filters:
-+ *
-+ */
-+
-+#ifndef _KERNEL
-+/*
-+ * RTA_* space has clashes with rtsock namespace.
-+ * Use NL_RTA_ prefix in the kernel and map to
-+ * RTA_ for userland.
-+ */
-+#define RTA_UNSPEC NL_RTA_UNSPEC
-+#define RTA_DST NL_RTA_DST
-+#define RTA_SRC NL_RTA_SRC
-+#define RTA_IIF NL_RTA_IIF
-+#define RTA_OIF NL_RTA_OIF
-+#define RTA_GATEWAY NL_RTA_GATEWAY
-+#define RTA_PRIORITY NL_RTA_PRIORITY
-+#define RTA_PREFSRC NL_RTA_PREFSRC
-+#define RTA_METRICS NL_RTA_METRICS
-+#define RTA_MULTIPATH NL_RTA_MULTIPATH
-+#define RTA_PROTOINFO NL_RTA_PROTOINFO
-+#define RTA_KNH_ID NL_RTA_KNH_ID
-+#define RTA_FLOW NL_RTA_FLOW
-+#define RTA_CACHEINFO NL_RTA_CACHEINFO
-+#define RTA_SESSION NL_RTA_SESSION
-+#define RTA_MP_ALGO NL_RTA_MP_ALGO
-+#define RTA_TABLE NL_RTA_TABLE
-+#define RTA_MARK NL_RTA_MARK
-+#define RTA_MFC_STATS NL_RTA_MFC_STATS
-+#define RTA_VIA NL_RTA_VIA
-+#define RTA_NEWDST NL_RTA_NEWDST
-+#define RTA_PREF NL_RTA_PREF
-+#define RTA_ENCAP_TYPE NL_RTA_ENCAP_TYPE
-+#define RTA_ENCAP NL_RTA_ENCAP
-+#define RTA_EXPIRES NL_RTA_EXPIRES
-+#define RTA_PAD NL_RTA_PAD
-+#define RTA_UID NL_RTA_UID
-+#define RTA_TTL_PROPAGATE NL_RTA_TTL_PROPAGATE
-+#define RTA_IP_PROTO NL_RTA_IP_PROTO
-+#define RTA_SPORT NL_RTA_SPORT
-+#define RTA_DPORT NL_RTA_DPORT
-+#define RTA_NH_ID NL_RTA_NH_ID
-+#define RTA_MAX NL_RTA_MAX
-+#endif
-+
-+/* route attribute header */
-+struct rtattr {
-+ unsigned short rta_len;
-+ unsigned short rta_type;
-+};
-+
-+#define NL_RTA_ALIGN_SIZE NL_ITEM_ALIGN_SIZE
-+#define NL_RTA_ALIGN NL_ITEM_ALIGN
-+#define NL_RTA_HDRLEN ((int)sizeof(struct rtattr))
-+#define NL_RTA_DATA_LEN(_rta) ((int)((_rta)->rta_len - NL_RTA_HDRLEN))
-+#define NL_RTA_DATA(_rta) NL_ITEM_DATA(_rta, NL_RTA_HDRLEN)
-+#define NL_RTA_DATA_CONST(_rta) NL_ITEM_DATA_CONST(_rta, NL_RTA_HDRLEN)
-+
-+/* Compatibility attribute handling helpers */
-+#ifndef _KERNEL
-+#define RTA_ALIGNTO NL_RTA_ALIGN_SIZE
-+#define RTA_ALIGN(_len) NL_RTA_ALIGN(_len)
-+#define _RTA_LEN(_rta) ((int)(_rta)->rta_len)
-+#define _RTA_ALIGNED_LEN(_rta) RTA_ALIGN(_RTA_LEN(_rta))
-+#define RTA_OK(_rta, _len) NL_ITEM_OK(_rta, _len, NL_RTA_HDRLEN, _RTA_LEN)
-+#define RTA_NEXT(_rta, _len) NL_ITEM_ITER(_rta, _len, _RTA_ALIGNED_LEN)
-+#define RTA_LENGTH(_len) (NL_RTA_HDRLEN + (_len))
-+#define RTA_SPACE(_len) RTA_ALIGN(RTA_LENGTH(_len))
-+#define RTA_DATA(_rta) NL_RTA_DATA(_rta)
-+#define RTA_PAYLOAD(_rta) ((int)(_RTA_LEN(_rta) - NL_RTA_HDRLEN))
-+#endif
-+
-+/* RTA attribute headers */
-+
-+/* RTA_VIA */
-+struct rtvia {
-+ sa_family_t rtvia_family;
-+ uint8_t rtvia_addr[0];
-+};
-+
-+/*
-+ * RTA_METRICS is a nested attribute, consisting of a list of
-+ * TLVs with types defined below.
-+ */
-+ enum {
-+ NL_RTAX_UNSPEC,
-+ NL_RTAX_LOCK = 1, /* not supported */
-+ NL_RTAX_MTU = 2, /* desired path MTU */
-+ NL_RTAX_WINDOW = 3, /* not supported */
-+ NL_RTAX_RTT = 4, /* not supported */
-+ NL_RTAX_RTTVAR = 5, /* not supported */
-+ NL_RTAX_SSTHRESH = 6, /* not supported */
-+ NL_RTAX_CWND = 7, /* not supported */
-+ NL_RTAX_ADVMSS = 8, /* not supported */
-+ NL_RTAX_REORDERING = 9, /* not supported */
-+ NL_RTAX_HOPLIMIT = 10, /* not supported */
-+ NL_RTAX_INITCWND = 11, /* not supporrted */
-+ NL_RTAX_FEATURES = 12, /* not supported */
-+ NL_RTAX_RTO_MIN = 13, /* not supported */
-+ NL_RTAX_INITRWND = 14, /* not supported */
-+ NL_RTAX_QUICKACK = 15, /* not supported */
-+ NL_RTAX_CC_ALGO = 16, /* not supported */
-+ NL_RTAX_FASTOPEN_NO_COOKIE = 17, /* not supported */
-+ __NL_RTAX_MAX
-+};
-+#define NL_RTAX_MAX (__NL_RTAX_MAX - 1)
-+
-+#define RTAX_FEATURE_ECN (1 << 0)
-+#define RTAX_FEATURE_SACK (1 << 1)
-+#define RTAX_FEATURE_TIMESTAMP (1 << 2)
-+#define RTAX_FEATURE_ALLFRAG (1 << 3)
-+
-+#define RTAX_FEATURE_MASK \
-+ (RTAX_FEATURE_ECN | RTAX_FEATURE_SACK | RTAX_FEATURE_TIMESTAMP | \
-+ RTAX_FEATURE_ALLFRAG)
-+
-+#ifndef _KERNEL
-+
-+/*
-+ * RTAX_* space clashes with rtsock namespace.
-+ * Use NL_RTAX_ prefix in the kernel and map to
-+ * RTAX_ for userland.
-+ */
-+#define RTAX_UNSPEC NL_RTAX_UNSPEC
-+#define RTAX_LOCK NL_RTAX_LOCK
-+#define RTAX_MTU NL_RTAX_MTU
-+#define RTAX_WINDOW NL_RTAX_WINDOW
-+#define RTAX_RTT NL_RTAX_RTT
-+#define RTAX_RTTVAR NL_RTAX_RTTVAR
-+#define RTAX_SSTHRESH NL_RTAX_SSTHRESH
-+#define RTAX_CWND NL_RTAX_CWND
-+#define RTAX_ADVMSS NL_RTAX_ADVMSS
-+#define RTAX_REORDERING NL_RTAX_REORDERING
-+#define RTAX_HOPLIMIT NL_RTAX_HOPLIMIT
-+#define RTAX_INITCWND NL_RTAX_INITCWND
-+#define RTAX_FEATURES NL_RTAX_FEATURES
-+#define RTAX_RTO_MIN NL_RTAX_RTO_MIN
-+#define RTAX_INITRWND NL_RTAX_INITRWND
-+#define RTAX_QUICKACK NL_RTAX_QUICKACK
-+#define RTAX_CC_ALGO NL_RTAX_CC_ALGO
-+#define RTAX_FASTOPEN_NO_COOKIE NL_RTAX_FASTOPEN_NO_COOKIE
-+#endif
-+
-+/*
-+ * RTA_MULTIPATH consists of an array of rtnexthop structures.
-+ * Each rtnexthop structure contains RTA_GATEWAY or RTA_VIA
-+ * attribute following the header.
-+ */
-+struct rtnexthop {
-+ unsigned short rtnh_len;
-+ unsigned char rtnh_flags;
-+ unsigned char rtnh_hops; /* nexthop weight */
-+ int rtnh_ifindex;
-+};
-+
-+/* rtnh_flags */
-+#define RTNH_F_DEAD 0x01 /* not supported */
-+#define RTNH_F_PERVASIVE 0x02 /* not supported */
-+#define RTNH_F_ONLINK 0x04 /* not supported */
-+#define RTNH_F_OFFLOAD 0x08 /* not supported */
-+#define RTNH_F_LINKDOWN 0x10 /* not supported */
-+#define RTNH_F_UNRESOLVED 0x20 /* not supported */
-+#define RTNH_F_TRAP 0x40 /* not supported */
-+
-+#define RTNH_COMPARE_MASK (RTNH_F_DEAD | RTNH_F_LINKDOWN | \
-+ RTNH_F_OFFLOAD | RTNH_F_TRAP)
-+
-+/* Macros to handle hexthops */
-+#define RTNH_ALIGNTO NL_ITEM_ALIGN_SIZE
-+#define RTNH_ALIGN(_len) NL_ITEM_ALIGN(_len)
-+#define RTNH_HDRLEN ((int)sizeof(struct rtnexthop))
-+#define _RTNH_LEN(_nh) ((int)(_nh)->rtnh_len)
-+#define _RTNH_ALIGNED_LEN(_nh) RTNH_ALIGN(_RTNH_LEN(_nh))
-+#define RTNH_OK(_nh, _len) NL_ITEM_OK(_nh, _len, RTNH_HDRLEN, _RTNH_LEN)
-+#define RTNH_NEXT(_nh) ((struct rtnexthop *)((char *)(_nh) + _RTNH_ALIGNED_LEN(_nh)))
-+#define RTNH_LENGTH(_len) (RTNH_HDRLEN + (_len))
-+#define RTNH_SPACE(_len) RTNH_ALIGN(RTNH_LENGTH(_len))
-+#define RTNH_DATA(_nh) ((struct rtattr *)NL_ITEM_DATA(_nh, RTNH_HDRLEN))
-+
-+struct rtgenmsg {
-+ unsigned char rtgen_family;
-+};
-+
-+#endif
diff --git a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-sys.h b/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-sys.h
deleted file mode 100644
--- a/net/bird2/files/extra-patch-netlink-route/patch-sysdep_bsd-netlink_netlink-sys.h
+++ /dev/null
@@ -1,10 +0,0 @@
---- sysdep/bsd-netlink/netlink-sys.h.orig 2024-03-22 14:19:18 UTC
-+++ sysdep/bsd-netlink/netlink-sys.h
-@@ -9,6 +9,7 @@
- #ifndef _BIRD_NETLINK_SYS_H_
- #define _BIRD_NETLINK_SYS_H_
-
-+#include "netlink-route.h"
- #include <netlink/netlink.h>
- #include <netlink/netlink_route.h>
-
diff --git a/net/cloud-init-devel/Makefile b/net/cloud-init-devel/Makefile
--- a/net/cloud-init-devel/Makefile
+++ b/net/cloud-init-devel/Makefile
@@ -54,7 +54,7 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} > 1400000
+.if ${OPSYS} == FreeBSD
EXTRA_PATCHES= ${PATCHDIR}/extra-cloudinit_distros_freebsd.py
.endif
diff --git a/net/cloud-init/Makefile b/net/cloud-init/Makefile
--- a/net/cloud-init/Makefile
+++ b/net/cloud-init/Makefile
@@ -46,7 +46,7 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400000
+.if ${OPSYS} == FreeBSD
EXTRA_PATCHES+= ${PATCHDIR}/extra-cloudinit_distros_freebsd.py
.endif
diff --git a/net/delegate/Makefile b/net/delegate/Makefile
--- a/net/delegate/Makefile
+++ b/net/delegate/Makefile
@@ -15,9 +15,6 @@
LICENSE_FILE= ${WRKSRC}/LICENSE.txt
LICENSE_PERMS= dist-mirror pkg-mirror auto-accept
-BROKEN_mips= fails to build: gmake[1]: [Makefile:116: mkmake.exe] Error 1
-BROKEN_mips64= fails to build: gmake[1]: [Makefile:116: mkmake.exe] Error 1
-
USES= compiler:c11 cpe gmake
SUB_FILES= pkg-message
diff --git a/net/eternalterminal/Makefile b/net/eternalterminal/Makefile
--- a/net/eternalterminal/Makefile
+++ b/net/eternalterminal/Makefile
@@ -11,8 +11,6 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= OpenSSL versions prior to 3.0.0 are not supported
-
LIB_DEPENDS= libabsl_log_internal_check_op.so:devel/abseil \
libprotobuf.so:devel/protobuf \
libsodium.so:security/libsodium \
diff --git a/net/gotify-server/Makefile b/net/gotify-server/Makefile
--- a/net/gotify-server/Makefile
+++ b/net/gotify-server/Makefile
@@ -32,7 +32,7 @@
.include <bsd.port.pre.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400000
+.if ${OPSYS} == FreeBSD
MAKE_ENV+= NODE_OPTIONS=--openssl-legacy-provider
.endif
diff --git a/net/hsflowd/Makefile b/net/hsflowd/Makefile
--- a/net/hsflowd/Makefile
+++ b/net/hsflowd/Makefile
@@ -7,9 +7,6 @@
COMMENT= Agent that exports metrics using the sFlow protocol
WWW= https://host-sflow.sourceforge.net/
-BROKEN_mips= fails to compile: src/FreeBSD/Makefile: Malformed conditional (empty $(BINDIR))
-BROKEN_mips64= fails to compile: src/FreeBSD/Makefile: Malformed conditional (empty $(BINDIR))
-
SUB_FILES= pkg-message
USE_RC_SUBR= ${PORTNAME}
MAKE_ENV= BINDIR=${PREFIX}/sbin INITDIR=${PREFIX}/etc/rc.d \
diff --git a/net/kdenetwork-filesharing/Makefile b/net/kdenetwork-filesharing/Makefile
--- a/net/kdenetwork-filesharing/Makefile
+++ b/net/kdenetwork-filesharing/Makefile
@@ -16,11 +16,4 @@
OPTIONS_DEFINE= DOCS
-.include <bsd.port.options.mk>
-
-.if ${ARCH:Mpowerpc*} && ${OSVERSION} < 1400092
-CXX= clang++${LLVM_VERSION}
-USES+= llvm:min=16
-.endif
-
.include <bsd.port.mk>
diff --git a/net/librdkafka/Makefile b/net/librdkafka/Makefile
--- a/net/librdkafka/Makefile
+++ b/net/librdkafka/Makefile
@@ -10,9 +10,6 @@
LICENSE= BSD2CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_mips= fails to build: undefined reference to __sync_add_and_fetch_4
-BROKEN_mips64= fails to build: undefined reference to __sync_add_and_fetch_4
-
BUILD_DEPENDS= bash:shells/bash \
${LOCALBASE}/include/rapidjson/schema.h:devel/rapidjson
LIB_DEPENDS= libcurl.so:ftp/curl \
diff --git a/net/libusrsctp/Makefile b/net/libusrsctp/Makefile
--- a/net/libusrsctp/Makefile
+++ b/net/libusrsctp/Makefile
@@ -26,11 +26,4 @@
CFLAGS+= -Wno-error
-.include <bsd.port.pre.mk>
-
-post-patch:
-.if ${OSVERSION} >= 1400000
- @${REINPLACE_CMD} -e 's|ip6protosw.h|ip6_var.h|g' \
- ${WRKSRC}/usrsctplib/netinet/sctp_os_userspace.h
-.endif
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/net/messagelib/Makefile b/net/messagelib/Makefile
--- a/net/messagelib/Makefile
+++ b/net/messagelib/Makefile
@@ -8,8 +8,6 @@
LICENSE= LGPL21
-IGNORE_FreeBSD_13= is not supported on systems with OpenSSL 1.1.1
-
BUILD_DEPENDS= ${LOCALBASE}/include/boost/range/algorithm.hpp:devel/boost-libs
LIB_DEPENDS= libassuan.so:security/libassuan \
libgpg-error.so:security/libgpg-error \
diff --git a/net/openmpi/Makefile b/net/openmpi/Makefile
--- a/net/openmpi/Makefile
+++ b/net/openmpi/Makefile
@@ -61,8 +61,6 @@
OPTIONS_EXCLUDE_armv6= AVX SLURM
OPTIONS_EXCLUDE_armv7= AVX SLURM
OPTIONS_EXCLUDE_i386= SLURM
-OPTIONS_EXCLUDE_mips= AVX SLURM
-OPTIONS_EXCLUDE_mips64= AVX
OPTIONS_EXCLUDE_powerpc= AVX SLURM
OPTIONS_EXCLUDE_powerpc64= AVX
OPTIONS_EXCLUDE_powerpc64le= AVX
diff --git a/net/openmpi4/Makefile b/net/openmpi4/Makefile
--- a/net/openmpi4/Makefile
+++ b/net/openmpi4/Makefile
@@ -60,8 +60,6 @@
OPTIONS_EXCLUDE_armv6= AVX SLURM
OPTIONS_EXCLUDE_armv7= AVX SLURM
OPTIONS_EXCLUDE_i386= SLURM
-OPTIONS_EXCLUDE_mips= AVX SLURM
-OPTIONS_EXCLUDE_mips64= AVX
OPTIONS_EXCLUDE_powerpc= AVX SLURM
OPTIONS_EXCLUDE_powerpc64= AVX
OPTIONS_EXCLUDE_powerpc64le= AVX
diff --git a/net/openvswitch/Makefile b/net/openvswitch/Makefile
--- a/net/openvswitch/Makefile
+++ b/net/openvswitch/Makefile
@@ -9,8 +9,6 @@
LICENSE= APACHE20
-BROKEN_mips64= fails to compile: ofp-actions.h:486: flexible array member in otherwise empty struct
-
BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}six>0:devel/py-six@${PY_FLAVOR}
USES= compiler:c11 cpe gmake libtool perl5 pkgconfig python \
diff --git a/net/p5-Net-AMQP-RabbitMQ/Makefile b/net/p5-Net-AMQP-RabbitMQ/Makefile
--- a/net/p5-Net-AMQP-RabbitMQ/Makefile
+++ b/net/p5-Net-AMQP-RabbitMQ/Makefile
@@ -13,9 +13,6 @@
LICENSE_FILE_MIT= ${WRKSRC}/LICENSE-MIT
LICENSE_FILE_MPL11= ${WRKSRC}/LICENSE-MPL-1.1
-NOT_FOR_ARCHS= mips mips64
-NOT_FOR_ARCHS_REASON= Endianness not known
-
BUILD_DEPENDS= p5-Devel-CheckLib>=0:devel/p5-Devel-CheckLib \
${RUN_DEPENDS}
RUN_DEPENDS= p5-Math-Int64>0.34:math/p5-Math-Int64
diff --git a/net/pvm/Makefile b/net/pvm/Makefile
--- a/net/pvm/Makefile
+++ b/net/pvm/Makefile
@@ -11,8 +11,6 @@
LICENSE= MIT
-BROKEN_mips= fails to compile: 'SIGCLD' undeclared (first use in this function)
-BROKEN_mips64= fails to compile: 'SIGCLD' undeclared (first use in this function)
BROKEN_riscv64= fails to build: grep: pvm3/conf/UNKNOWN.def: No such file or directory
USES= tar:tgz
diff --git a/net/realtek-rge-kmod/Makefile b/net/realtek-rge-kmod/Makefile
--- a/net/realtek-rge-kmod/Makefile
+++ b/net/realtek-rge-kmod/Makefile
@@ -11,8 +11,6 @@
LICENSE= BSD2CLAUSE
-IGNORE_FreeBSD_13= Does not build on FreeBSD <=13
-
USES= kmod tar:tgz uidfix
USE_GITHUB= yes
diff --git a/net/samba416/Makefile b/net/samba416/Makefile
--- a/net/samba416/Makefile
+++ b/net/samba416/Makefile
@@ -536,7 +536,7 @@
.endif
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
. if defined(SAMBA4_BUNDLED_LDB) && ${SAMBA4_BUNDLED_LDB} == yes && (${PORT_OPTIONS:MAD_DC} || ${PORT_OPTIONS:MDEVELOPER})
# LMDB
SAMBA4_LMDB_DEPENDS= lmdb>=0.9.16:databases/lmdb
diff --git a/net/samba419/Makefile b/net/samba419/Makefile
--- a/net/samba419/Makefile
+++ b/net/samba419/Makefile
@@ -524,7 +524,7 @@
.include <bsd.port.pre.mk>
##############################################################################
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
. if defined(SAMBA4_BUNDLED_LDB) && ${SAMBA4_BUNDLED_LDB} == yes && (${PORT_OPTIONS:MAD_DC} || ${PORT_OPTIONS:MDEVELOPER})
# LMDB
SAMBA4_LMDB_DEPENDS= lmdb>=0.9.16:databases/lmdb
diff --git a/net/samba420/Makefile b/net/samba420/Makefile
--- a/net/samba420/Makefile
+++ b/net/samba420/Makefile
@@ -523,7 +523,7 @@
.include <bsd.port.pre.mk>
##############################################################################
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
. if defined(SAMBA4_BUNDLED_LDB) && ${SAMBA4_BUNDLED_LDB} == yes && (${PORT_OPTIONS:MAD_DC} || ${PORT_OPTIONS:MDEVELOPER})
# LMDB
SAMBA4_LMDB_DEPENDS= lmdb>=0.9.16:databases/lmdb
diff --git a/net/samba422/Makefile b/net/samba422/Makefile
--- a/net/samba422/Makefile
+++ b/net/samba422/Makefile
@@ -434,7 +434,7 @@
.endif
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
. if (${PORT_OPTIONS:MAD_DC} || ${PORT_OPTIONS:MDEVELOPER})
# LMDB
_LMDB_DEPDENDS= lmdb>=0.9.16:databases/lmdb
diff --git a/net/samba423/Makefile b/net/samba423/Makefile
--- a/net/samba423/Makefile
+++ b/net/samba423/Makefile
@@ -426,7 +426,7 @@
.endif
# Only for 64-bit architectures
-.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != mips && ${ARCH} != powerpc && ${ARCH} != powerpcspe
+.if ${ARCH} != armv6 && ${ARCH} != armv7 && ${ARCH} != i386 && ${ARCH} != powerpc && ${ARCH} != powerpcspe
. if (${PORT_OPTIONS:MAD_DC} || ${PORT_OPTIONS:MDEVELOPER})
# LMDB
_LMDB_DEPDENDS= lmdb>=0.9.16:databases/lmdb
diff --git a/net/tcplog_dumper/Makefile b/net/tcplog_dumper/Makefile
--- a/net/tcplog_dumper/Makefile
+++ b/net/tcplog_dumper/Makefile
@@ -10,7 +10,7 @@
LICENSE= BSD2CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE
-ONLY_FOR_ARCHS= aarch64 amd64 mips64 mips64el mips64elhf mips64hf powerpc64 powerpc64le riscv64 riscv64sf
+ONLY_FOR_ARCHS= aarch64 amd64 powerpc64 powerpc64le riscv64 riscv64sf
ONLY_FOR_ARCHS_REASON= only 64-bit platforms are supported
USE_GITHUB= yes
diff --git a/net/vpp/Makefile b/net/vpp/Makefile
--- a/net/vpp/Makefile
+++ b/net/vpp/Makefile
@@ -16,8 +16,6 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE
-IGNORE_FreeBSD_13= is not supported on FreeBSD 13.x due to missing timerfd library shim
-
BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}ply>0:devel/py-ply@${PY_FLAVOR} \
bash:shells/bash \
cmake:devel/cmake-core
diff --git a/net/wifi-firmware-kmod/Makefile.inc b/net/wifi-firmware-kmod/Makefile.inc
--- a/net/wifi-firmware-kmod/Makefile.inc
+++ b/net/wifi-firmware-kmod/Makefile.inc
@@ -91,13 +91,6 @@
# allows direct loading of firmware files.
# We write a PLIST file so we can then simply use COPYTREE_SHARE with adjusted
# permissions to copy the files over.
-.if (${OSVERSION} < 1402000) || (${OSVERSION} >= 1500000 && ${OSVERSION} < 1500014)
-# For 13.5, which is the last supported release before plain firmware loading is
-# implemented, we did ship firmware in src/ still so there is no need to build.
-# Also mtw (mt7601u) was never in a version earlier than this.
-# XXX remove comment after April 2026 when 13.5 goes out of support as well.
-IGNORE= Not supported for this osversion.
-.endif
BOOT_LOADERCONFD= /boot/loader.conf.d
BOOTFWDIR?= /boot/firmware
diff --git a/net/wifibox-core/Makefile b/net/wifibox-core/Makefile
--- a/net/wifibox-core/Makefile
+++ b/net/wifibox-core/Makefile
@@ -36,13 +36,7 @@
MAKE_ARGS+= GUEST_ROOT=${LOCALBASE}/share/wifibox \
GUEST_MAN=${LOCALBASE}/share/man/man5/wifibox-alpine.5.gz \
VERSION=${PORTVERSION} \
- RECOVERY_METHOD=${PORT_OPTIONS:MRECOVER_*:S/RECOVER_//:tl}
-
-.if ${OSVERSION} > 1400089
-MAKE_ARGS+= DEVD_FIX=
-PLIST_SUB+= DEVD_FIX="@comment "
-.else
-PLIST_SUB+= DEVD_FIX=""
-.endif
+ RECOVERY_METHOD=${PORT_OPTIONS:MRECOVER_*:S/RECOVER_//:tl} \
+ DEVD_FIX=
.include <bsd.port.mk>
diff --git a/net/wifibox-core/pkg-plist b/net/wifibox-core/pkg-plist
--- a/net/wifibox-core/pkg-plist
+++ b/net/wifibox-core/pkg-plist
@@ -1,6 +1,5 @@
@sample etc/wifibox/bhyve.conf.sample
@sample etc/wifibox/core.conf.sample
-%%DEVD_FIX%%@sample etc/devd/wifibox.conf.sample
etc/rc.d/wifibox
sbin/wifibox
share/man/man5/wifibox-guest.5.gz
diff --git a/ports-mgmt/Makefile b/ports-mgmt/Makefile
--- a/ports-mgmt/Makefile
+++ b/ports-mgmt/Makefile
@@ -61,7 +61,6 @@
SUBDIR += portsearch
SUBDIR += portshaker
SUBDIR += portshaker-config
- SUBDIR += portsnap
SUBDIR += portsreinstall
SUBDIR += porttools
SUBDIR += porttree
diff --git a/ports-mgmt/pkg-devel/Makefile b/ports-mgmt/pkg-devel/Makefile
--- a/ports-mgmt/pkg-devel/Makefile
+++ b/ports-mgmt/pkg-devel/Makefile
@@ -39,7 +39,7 @@
.endif
# TODO: activate in april 2021
-#.if ${OPSYS} == FreeBSD && ${OSVERSION} > 1400000
+#.if ${OPSYS} == FreeBSD
#CONFIGURE_ARGS+= --default-format=tzst
#.endif
diff --git a/ports-mgmt/pkg-provides/Makefile b/ports-mgmt/pkg-provides/Makefile
--- a/ports-mgmt/pkg-provides/Makefile
+++ b/ports-mgmt/pkg-provides/Makefile
@@ -9,7 +9,7 @@
LICENSE= BSD2CLAUSE BSD3CLAUSE BSD4CLAUSE
LICENSE_COMB= multi
-NOT_FOR_ARCHS= armv6 mips mips64
+NOT_FOR_ARCHS= armv6
BUILD_DEPENDS= ${LOCALBASE}/include/uthash.h:devel/uthash
LIB_DEPENDS= libpcre2-8.so:devel/pcre2
diff --git a/ports-mgmt/portsnap/Makefile b/ports-mgmt/portsnap/Makefile
deleted file mode 100644
--- a/ports-mgmt/portsnap/Makefile
+++ /dev/null
@@ -1,44 +0,0 @@
-PORTNAME= portsnap
-PORTVERSION= 1.1
-PORTREVISION= 3
-CATEGORIES= ports-mgmt net
-MASTER_SITES= http://www.daemonology.net/portsnap/
-
-MAINTAINER= bofh@FreeBSD.org
-COMMENT= Provides secure snapshots of the ports directory
-WWW= http://www.daemonology.net/portsnap/
-
-LICENSE= BSD2CLAUSE
-
-DEPRECATED= portsnap infrastructure will be removed after the EOL of 13.x
-EXPIRATION_DATE=2026-04-30
-
-SUB_FILES= pkg-message
-
-PLIST_FILES= "@sample etc/portsnap.conf.sample" \
- libexec/make_index \
- sbin/portsnap \
- share/man/man5/portsnap.conf.5.gz \
- share/man/man8/portsnap.8.gz
-
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400087
-IGNORE= portsnap is in base systems and has been removed from 14.0-RELEASE
-.endif
-
-post-patch:
- ${REINPLACE_CMD} -e "s,%%PREFIX%%,${PREFIX},g" \
- ${WRKSRC}/portsnap \
- ${WRKSRC}/portsnap.conf.5 \
- ${WRKSRC}/portsnap.8
-
-do-install:
- ${INSTALL_SCRIPT} ${WRKSRC}/portsnap ${STAGEDIR}/${PREFIX}/sbin
- ${INSTALL_PROGRAM} ${WRKSRC}/make_index ${STAGEDIR}/${PREFIX}/libexec
- ${INSTALL_MAN} ${WRKSRC}/portsnap.conf.5 ${STAGEDIR}/${PREFIX}/share/man/man5/
- ${INSTALL_MAN} ${WRKSRC}/portsnap.8 ${STAGEDIR}/${PREFIX}/share/man/man8/
- ${INSTALL_DATA} ${WRKSRC}/portsnap.conf \
- ${STAGEDIR}/${PREFIX}/etc/portsnap.conf.sample
-
-.include <bsd.port.post.mk>
diff --git a/ports-mgmt/portsnap/distinfo b/ports-mgmt/portsnap/distinfo
deleted file mode 100644
--- a/ports-mgmt/portsnap/distinfo
+++ /dev/null
@@ -1,3 +0,0 @@
-TIMESTAMP = 1681052114
-SHA256 (portsnap-1.1.tar.gz) = 08bf6db8738d5c4fe757737d97366e7e899a6d0cfb244a46055f97f4b116b36c
-SIZE (portsnap-1.1.tar.gz) = 20875
diff --git a/ports-mgmt/portsnap/files/patch-Makefile b/ports-mgmt/portsnap/files/patch-Makefile
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/patch-Makefile
+++ /dev/null
@@ -1,12 +0,0 @@
---- Makefile.orig 2023-04-09 15:24:50 UTC
-+++ Makefile
-@@ -1,8 +1,6 @@
--all: make_index phttpget
-+all: make_index
-
- make_index: make_index.c
--
--phttpget: phttpget.c
-
- install:
- install -m 555 portsnap /usr/local/sbin
diff --git a/ports-mgmt/portsnap/files/patch-make__index.c b/ports-mgmt/portsnap/files/patch-make__index.c
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/patch-make__index.c
+++ /dev/null
@@ -1,18 +0,0 @@
---- make_index.c.orig 2023-04-09 15:19:46 UTC
-+++ make_index.c
-@@ -1,4 +1,6 @@
- /*-
-+ * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
-+ *
- * Copyright 2005 Colin Percival
- * All rights reserved
- *
-@@ -25,7 +27,7 @@
- */
-
- #include <sys/cdefs.h>
--__FBSDID("$FreeBSD: src/usr.sbin/portsnap/make_index/make_index.c,v 1.5 2005/12/01 22:14:44 cperciva Exp $");
-+__FBSDID("$FreeBSD$");
-
- #include <err.h>
- #include <stdio.h>
diff --git a/ports-mgmt/portsnap/files/patch-portsnap b/ports-mgmt/portsnap/files/patch-portsnap
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/patch-portsnap
+++ /dev/null
@@ -1,654 +0,0 @@
---- portsnap.orig 2006-05-26 23:24:34 UTC
-+++ portsnap
-@@ -1,11 +1,13 @@
- #!/bin/sh
-
- #-
-+# SPDX-License-Identifier: BSD-2-Clause-FreeBSD
-+#
- # Copyright 2004-2005 Colin Percival
- # All rights reserved
- #
- # Redistribution and use in source and binary forms, with or without
--# modification, are permitted providing that the following conditions
-+# modification, are permitted providing that the following conditions
- # are met:
- # 1. Redistributions of source code must retain the above copyright
- # notice, this list of conditions and the following disclaimer.
-@@ -25,7 +27,7 @@
- # IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- # POSSIBILITY OF SUCH DAMAGE.
-
--# $FreeBSD: src/usr.sbin/portsnap/portsnap/portsnap.sh,v 1.24 2006/05/13 15:56:35 cperciva Exp $
-+# $FreeBSD$
-
- #### Usage function -- called from command-line handling code.
-
-@@ -38,7 +40,7 @@ usage: `basename $0` [options] command ... [path]
-
- Options:
- -d workdir -- Store working files in workdir
-- (default: ${PREFIX}/portsnap/)
-+ (default: /var/db/portsnap/)
- -f conffile -- Read configuration options from conffile
- (default: ${PREFIX}/etc/portsnap.conf)
- -I -- Update INDEX only. (update command only)
-@@ -48,6 +50,9 @@ Options:
- (default: /usr/ports/)
- -s server -- Server from which to fetch updates.
- (default: portsnap.FreeBSD.org)
-+ --interactive -- interactive: override auto-detection of calling process
-+ (use this when calling portsnap from an interactive, non-
-+ terminal application AND NEVER ELSE).
- path -- Extract only parts of the tree starting with the given
- string. (extract command only)
- Commands:
-@@ -58,6 +63,8 @@ Commands:
- files and directories.
- update -- Update ports tree to match current snapshot, replacing
- files and directories which have changed.
-+ auto -- Fetch updates, and either extract a new ports tree or
-+ update an existing tree.
- EOF
- exit 0
- }
-@@ -81,10 +88,11 @@ init_params() {
- NDEBUG=""
- DDSTATS=""
- INDEXONLY=""
-- PREFIX="/usr/local"
-+ PREFIX="%%PREFIX%%"
- SERVERNAME=""
- REFUSE=""
- LOCALDESC=""
-+ INTERACTIVE=""
- }
-
- # Parse the command line
-@@ -104,6 +112,9 @@ parse_cmdline() {
- XARGST="-t"
- DDSTATS=".."
- ;;
-+ --interactive)
-+ INTERACTIVE="YES"
-+ ;;
- -f)
- if [ $# -eq 1 ]; then usage; fi
- if [ ! -z "${CONFFILE}" ]; then usage; fi
-@@ -141,9 +152,15 @@ parse_cmdline() {
- if [ ! -z "${SERVERNAME}" ]; then usage; fi
- shift; SERVERNAME="$1"
- ;;
-- cron | extract | fetch | update)
-+ cron | extract | fetch | update | auto)
- COMMANDS="${COMMANDS} $1"
- ;;
-+ up)
-+ COMMANDS="${COMMANDS} update"
-+ ;;
-+ alfred)
-+ COMMANDS="${COMMANDS} auto"
-+ ;;
- *)
- if [ $# -gt 1 ]; then usage; fi
- if echo ${COMMANDS} | grep -vq extract; then
-@@ -200,6 +217,12 @@ parse_conffile() {
- cut -c 7- | xargs echo | tr ' ' '|'
- `)"
- fi
-+
-+ if grep -qE "^INDEX[[:space:]]" ${CONFFILE}; then
-+ INDEXPAIRS="`
-+ grep -E "^INDEX[[:space:]]" "${CONFFILE}" |
-+ cut -c 7- | tr ' ' '|' | xargs echo`"
-+ fi
- fi
- }
-
-@@ -208,7 +231,7 @@ default_params() {
- _QUIETREDIR="/dev/null"
- _QUIETFLAG="-q"
- _STATSREDIR="/dev/stdout"
-- _WORKDIR="${PREFIX}/portsnap"
-+ _WORKDIR="/var/db/portsnap"
- _PORTSDIR="/usr/ports"
- _NDEBUG="-n"
- _LOCALDESC="/dev/null"
-@@ -220,13 +243,20 @@ default_params() {
- eval ${X}=${__}
- fi
- done
-+ if [ -z "${INTERACTIVE}" ]; then
-+ if [ -t 0 ]; then
-+ INTERACTIVE="YES"
-+ else
-+ INTERACTIVE="NO"
-+ fi
-+ fi
- }
-
- # Perform sanity checks and set some final parameters
- # in preparation for fetching files. Also chdir into
- # the working directory.
- fetch_check_params() {
-- export HTTP_USER_AGENT="portsnap/1.1 (${COMMAND})"
-+ export HTTP_USER_AGENT="portsnap (${COMMAND}, `uname -r`)"
-
- _SERVERNAME_z=\
- "SERVERNAME must be given via command line or configuration file."
-@@ -258,28 +288,9 @@ fetch_check_params() {
- fi
- cd ${WORKDIR} || exit 1
-
-- BSPATCH=`which bspatch || echo ${PREFIX}/bin/bspatch`
-- SHA256=`which sha256 || echo ${PREFIX}/sbin/sha256`
-- PHTTPGET=${PREFIX}/libexec/phttpget
-- if ! [ -x ${BSPATCH} ]; then
-- echo -n "`basename $0`: "
-- echo "bspatch is needed but cannot be found."
-- echo -n "Please install it from the ports tree "
-- echo "(misc/bsdiff)."
-- exit 1
-- fi
-- if ! [ -x ${SHA256} ]; then
-- echo -n "`basename $0`: "
-- echo "sha256 is needed but cannot be found."
-- echo -n "Please install it from the ports tree "
-- echo "(sysutils/freebsd-sha256)."
-- exit 1
-- fi
-- if ! [ -x ${PHTTPGET} ]; then
-- echo -n "`basename $0`: "
-- echo "Cannot find ${PHTTPGET}."
-- exit 1
-- fi
-+ BSPATCH=/usr/bin/bspatch
-+ SHA256=/sbin/sha256
-+ PHTTPGET=/usr/libexec/phttpget
- }
-
- # Perform sanity checks and set some final parameters
-@@ -311,11 +322,6 @@ extract_check_params() {
- fi
-
- MKINDEX=${PREFIX}/libexec/make_index
-- if ! [ -x ${MKINDEX} ]; then
-- echo -n "`basename $0`: "
-- echo "Cannot find ${MKINDEX}."
-- exit 1
-- fi
- }
-
- # Perform sanity checks and set some final parameters
-@@ -364,7 +370,7 @@ fetch_pick_server_init() {
- # "$name server selection ..."; we allow either format.
- MLIST="_http._tcp.${SERVERNAME}"
- host -t srv "${MLIST}" |
-- sed -nE "s/${MLIST} (has SRV record|server selection) //p" |
-+ sed -nE "s/${MLIST} (has SRV record|server selection) //Ip" |
- cut -f 1,2,4 -d ' ' |
- sed -e 's/\.$//' |
- sort > serverlist_full
-@@ -406,7 +412,7 @@ fetch_pick_server() {
- SRV_PRIORITY=`cut -f 1 -d ' ' serverlist | sort -n | head -1`
-
- # Add up the weights of the response lines at that priority level.
-- SRV_WSUM=0;
-+ SRV_WSUM=0
- while read X; do
- case "$X" in
- ${SRV_PRIORITY}\ *)
-@@ -555,9 +561,9 @@ fetch_metadata() {
- rm -f ${SNAPSHOTHASH} tINDEX.new
-
- echo ${NDEBUG} "Fetching snapshot metadata... "
-- fetch ${QUIETFLAG} http://${SERVERNAME}/t/${SNAPSHOTHASH}
-+ fetch ${QUIETFLAG} http://${SERVERNAME}/t/${SNAPSHOTHASH} \
- 2>${QUIETREDIR} || return
-- if [ `${SHA256} -q ${SNAPSHOTHASH}` != ${SNAPSHOTHASH} ]; then
-+ if [ "`${SHA256} -q ${SNAPSHOTHASH}`" != ${SNAPSHOTHASH} ]; then
- echo "snapshot metadata corrupt."
- return 1
- fi
-@@ -589,14 +595,15 @@ fetch_metadata_sanity() {
-
- # Take a list of ${oldhash}|${newhash} and output a list of needed patches
- fetch_make_patchlist() {
-- grep -vE "^([0-9a-f]{64})\|\1$" |
-- while read LINE; do
-- X=`echo ${LINE} | cut -f 1 -d '|'`
-- Y=`echo ${LINE} | cut -f 2 -d '|'`
-- if [ -f "files/${Y}.gz" ]; then continue; fi
-- if [ ! -f "files/${X}.gz" ]; then continue; fi
-- echo "${LINE}"
-+ local IFS='|'
-+ echo "" 1>${QUIETREDIR}
-+ grep -vE "^([0-9a-f]{64})\|\1$" |
-+ while read X Y; do
-+ printf "Processing: $X $Y ...\r" 1>${QUIETREDIR}
-+ if [ -f "files/${Y}.gz" -o ! -f "files/${X}.gz" ]; then continue; fi
-+ echo "${X}|${Y}"
- done
-+ echo "" 1>${QUIETREDIR}
- }
-
- # Print user-friendly progress statistics
-@@ -613,6 +620,30 @@ fetch_progress() {
- echo -n " "
- }
-
-+pct_fmt()
-+{
-+ if [ $TOTAL -gt 0 ]; then
-+ printf " \r"
-+ printf "($1/$2) %02.2f%% " `echo "scale=4;$LNC / $TOTAL * 100"|bc`
-+ fi
-+}
-+
-+fetch_progress_percent() {
-+ TOTAL=$1
-+ LNC=0
-+ pct_fmt $LNC $TOTAL
-+ while read x; do
-+ LNC=$(($LNC + 1))
-+ if [ $(($LNC % 100)) = 0 ]; then
-+ pct_fmt $LNC $TOTAL
-+ elif [ $(($LNC % 10)) = 0 ]; then
-+ echo -n .
-+ fi
-+ done
-+ pct_fmt $LNC $TOTAL
-+ echo " done. "
-+}
-+
- # Sanity-check an index file
- fetch_index_sanity() {
- if grep -qvE "^[-_+./@0-9A-Za-z]+\|[0-9a-f]{64}$" INDEX.new ||
-@@ -625,7 +656,7 @@ fetch_index_sanity() {
- # Verify a list of files
- fetch_snapshot_verify() {
- while read F; do
-- if [ `gunzip -c snap/${F} | ${SHA256} -q` != ${F} ]; then
-+ if [ "`gunzip -c < snap/${F}.gz | ${SHA256} -q`" != ${F} ]; then
- echo "snapshot corrupt."
- return 1
- fi
-@@ -651,7 +682,7 @@ fetch_snapshot() {
- fetch -r http://${SERVERNAME}/s/${SNAPSHOTHASH}.tgz || return 1
-
- echo -n "Extracting snapshot... "
-- tar -xzf ${SNAPSHOTHASH}.tgz snap/ || return 1
-+ tar -xz --numeric-owner -f ${SNAPSHOTHASH}.tgz snap/ || return 1
- rm ${SNAPSHOTHASH}.tgz
- echo "done."
-
-@@ -660,11 +691,19 @@ fetch_snapshot() {
- cut -f 2 -d '|' tINDEX.new | fetch_snapshot_verify || return 1
- # Extract the index
- rm -f INDEX.new
-- gunzip -c snap/`look INDEX tINDEX.new |
-+ gunzip -c < snap/`look INDEX tINDEX.new |
- cut -f 2 -d '|'`.gz > INDEX.new
- fetch_index_sanity || return 1
- # Verify the snapshot contents
- cut -f 2 -d '|' INDEX.new | fetch_snapshot_verify || return 1
-+ cut -f 2 -d '|' tINDEX.new INDEX.new | sort -u |
-+ lam -s 'snap/' - -s '.gz' > files.expected
-+ find snap -mindepth 1 | sort > files.snap
-+ if ! cmp -s files.expected files.snap; then
-+ echo "unexpected files in snapshot."
-+ return 1
-+ fi
-+ rm files.expected files.snap
- echo "done."
-
- # Move files into their proper locations
-@@ -711,9 +750,8 @@ fetch_update() {
-
- # Attempt to apply metadata patches
- echo -n "Applying metadata patches... "
-- while read LINE; do
-- X=`echo ${LINE} | cut -f 1 -d '|'`
-- Y=`echo ${LINE} | cut -f 2 -d '|'`
-+ local oldifs="$IFS" IFS='|'
-+ while read X Y; do
- if [ ! -f "${X}-${Y}.gz" ]; then continue; fi
- gunzip -c < ${X}-${Y}.gz > diff
- gunzip -c < files/${X}.gz > OLD
-@@ -726,6 +764,7 @@ fetch_update() {
- fi
- rm -f diff OLD NEW ${X}-${Y}.gz ptmp
- done < patchlist 2>${QUIETREDIR}
-+ IFS="$oldifs"
- echo "done."
-
- # Update metadata without patches
-@@ -733,7 +772,7 @@ fetch_update() {
- cut -f 2 -d '|' /dev/stdin patchlist |
- while read Y; do
- if [ ! -f "files/${Y}.gz" ]; then
-- echo ${Y};
-+ echo ${Y}
- fi
- done > filelist
- echo -n "Fetching `wc -l < filelist | tr -d ' '` "
-@@ -743,17 +782,20 @@ fetch_update() {
- 2>${QUIETREDIR}
-
- while read Y; do
-+ echo -n "Verifying ${Y}... " 1>${QUIETREDIR}
- if [ `gunzip -c < ${Y}.gz | ${SHA256} -q` = ${Y} ]; then
- mv ${Y}.gz files/${Y}.gz
- else
- echo "metadata is corrupt."
- return 1
- fi
-+ echo "ok." 1>${QUIETREDIR}
- done < filelist
- echo "done."
-
- # Extract the index
-- gunzip -c files/`look INDEX tINDEX.new |
-+ echo -n "Extracting index... " 1>${QUIETREDIR}
-+ gunzip -c < files/`look INDEX tINDEX.new |
- cut -f 2 -d '|'`.gz > INDEX.new
- fetch_index_sanity || return 1
-
-@@ -773,23 +815,39 @@ fetch_update() {
- fi
-
- # Generate a list of wanted ports patches
-+ echo -n "Generating list of wanted patches..." 1>${QUIETREDIR}
- join -t '|' -o 1.2,2.2 INDEX INDEX.new |
- fetch_make_patchlist > patchlist
-+ echo " done." 1>${QUIETREDIR}
-
- # Attempt to fetch ports patches
-- echo -n "Fetching `wc -l < patchlist | tr -d ' '` "
-+ patchcnt=`wc -l < patchlist | tr -d ' '`
-+ echo -n "Fetching $patchcnt "
- echo ${NDEBUG} "patches.${DDSTATS}"
-+ echo " "
- tr '|' '-' < patchlist | lam -s "bp/" - |
- xargs ${XARGST} ${PHTTPGET} ${SERVERNAME} \
-- 2>${STATSREDIR} | fetch_progress
-+ 2>${STATSREDIR} | fetch_progress_percent $patchcnt
- echo "done."
-
- # Attempt to apply ports patches
-- echo -n "Applying patches... "
-- while read LINE; do
-- X=`echo ${LINE} | cut -f 1 -d '|'`
-- Y=`echo ${LINE} | cut -f 2 -d '|'`
-- if [ ! -f "${X}-${Y}" ]; then continue; fi
-+ PATCHCNT=`wc -l patchlist`
-+ echo "Applying patches... "
-+ local oldifs="$IFS" IFS='|'
-+ I=0
-+ while read X Y; do
-+ I=$(($I + 1))
-+ F="${X}-${Y}"
-+ if [ ! -f "${F}" ]; then
-+ XS=${X%[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
-+ XE=${X#[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
-+ YS=${Y%[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
-+ YE=${Y#[0-9a-f][0-9a-f][0-9a-f][0-9a-f]}
-+ F="${X%${XE}}...${X#${XS}}-${Y%${YE}}...${Y#${YS}}"
-+ printf " Skipping ${F} (${I} of ${PATCHCNT}).\r"
-+ continue
-+ fi
-+ echo " Processing ${F}..." 1>${QUIETREDIR}
- gunzip -c < files/${X}.gz > OLD
- ${BSPATCH} OLD NEW ${X}-${Y}
- if [ `${SHA256} -q NEW` = ${Y} ]; then
-@@ -798,6 +856,7 @@ fetch_update() {
- fi
- rm -f diff OLD NEW ${X}-${Y}
- done < patchlist 2>${QUIETREDIR}
-+ IFS="$oldifs"
- echo "done."
-
- # Update ports without patches
-@@ -805,7 +864,7 @@ fetch_update() {
- cut -f 2 -d '|' /dev/stdin patchlist |
- while read Y; do
- if [ ! -f "files/${Y}.gz" ]; then
-- echo ${Y};
-+ echo ${Y}
- fi
- done > filelist
- echo -n "Fetching `wc -l < filelist | tr -d ' '` "
-@@ -814,7 +873,10 @@ fetch_update() {
- xargs ${XARGST} ${PHTTPGET} ${SERVERNAME} \
- 2>${QUIETREDIR}
-
-+ I=0
- while read Y; do
-+ I=$(($I + 1))
-+ printf " Processing ${Y} (${I} of ${PATCHCNT}).\r" 1>${QUIETREDIR}
- if [ `gunzip -c < ${Y}.gz | ${SHA256} -q` = ${Y} ]; then
- mv ${Y}.gz files/${Y}.gz
- else
-@@ -825,8 +887,8 @@ fetch_update() {
- echo "done."
-
- # Remove files which are no longer needed
-- cut -f 2 -d '|' tINDEX INDEX | sort > oldfiles
-- cut -f 2 -d '|' tINDEX.new INDEX.new | sort | comm -13 - oldfiles |
-+ cut -f 2 -d '|' tINDEX INDEX | sort -u > oldfiles
-+ cut -f 2 -d '|' tINDEX.new INDEX.new | sort -u | comm -13 - oldfiles |
- lam -s "files/" - -s ".gz" | xargs rm -f
- rm patchlist filelist oldfiles
-
-@@ -854,18 +916,25 @@ fetch_run() {
-
- # Build a ports INDEX file
- extract_make_index() {
-- gunzip -c "${WORKDIR}/files/`look $1 ${WORKDIR}/tINDEX |
-+ if ! look $1 ${WORKDIR}/tINDEX > /dev/null; then
-+ echo -n "$1 not provided by portsnap server; "
-+ echo "$2 not being generated."
-+ else
-+ gunzip -c < "${WORKDIR}/files/`look $1 ${WORKDIR}/tINDEX |
- cut -f 2 -d '|'`.gz" |
- cat - ${LOCALDESC} |
- ${MKINDEX} /dev/stdin > ${PORTSDIR}/$2
-+ fi
- }
-
- # Create INDEX, INDEX-5, INDEX-6
- extract_indices() {
- echo -n "Building new INDEX files... "
-- extract_make_index DESCRIBE.4 INDEX || return 1
-- extract_make_index DESCRIBE.5 INDEX-5 || return 1
-- extract_make_index DESCRIBE.6 INDEX-6 || return 1
-+ for PAIR in ${INDEXPAIRS}; do
-+ INDEXFILE=`echo ${PAIR} | cut -f 1 -d '|'`
-+ DESCRIBEFILE=`echo ${PAIR} | cut -f 2 -d '|'`
-+ extract_make_index ${DESCRIBEFILE} ${INDEXFILE} || return 1
-+ done
- echo "done."
- }
-
-@@ -889,6 +958,7 @@ extract_metadata() {
-
- # Do the actual work involved in "extract"
- extract_run() {
-+ local oldifs="$IFS" IFS='|'
- mkdir -p ${PORTSDIR} || return 1
-
- if !
-@@ -898,25 +968,22 @@ extract_run() {
- grep -vE "${REFUSE}" ${WORKDIR}/INDEX
- else
- cat ${WORKDIR}/INDEX
-- fi | while read LINE; do
-- FILE=`echo ${LINE} | cut -f 1 -d '|'`
-- HASH=`echo ${LINE} | cut -f 2 -d '|'`
-+ fi | while read FILE HASH; do
- echo ${PORTSDIR}/${FILE}
-- if ! [ -r "${WORKDIR}/files/${HASH}.gz" ]; then
-+ if ! [ -s "${WORKDIR}/files/${HASH}.gz" ]; then
- echo "files/${HASH}.gz not found -- snapshot corrupt."
- return 1
- fi
- case ${FILE} in
- */)
-- DIR=`echo ${FILE} | sed -e 's|/$||'`
-- rm -rf ${PORTSDIR}/${DIR}
-+ rm -rf ${PORTSDIR}/${FILE%/}
- mkdir -p ${PORTSDIR}/${FILE}
-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
- -C ${PORTSDIR}/${FILE}
- ;;
- *)
- rm -f ${PORTSDIR}/${FILE}
-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
- -C ${PORTSDIR} ${FILE}
- ;;
- esac
-@@ -924,13 +991,49 @@ extract_run() {
- return 1
- fi
- if [ ! -z "${EXTRACTPATH}" ]; then
-- return 0;
-+ return 0
- fi
-
-+ IFS="$oldifs"
-+
- extract_metadata
- extract_indices
- }
-
-+update_run_extract() {
-+ local IFS='|'
-+
-+# Install new files
-+ echo "Extracting new files:"
-+ if !
-+ if ! [ -z "${REFUSE}" ]; then
-+ grep -vE "${REFUSE}" ${WORKDIR}/INDEX | sort
-+ else
-+ sort ${WORKDIR}/INDEX
-+ fi |
-+ comm -13 ${PORTSDIR}/.portsnap.INDEX - |
-+ while read FILE HASH; do
-+ echo ${PORTSDIR}/${FILE}
-+ if ! [ -s "${WORKDIR}/files/${HASH}.gz" ]; then
-+ echo "files/${HASH}.gz not found -- snapshot corrupt."
-+ return 1
-+ fi
-+ case ${FILE} in
-+ */)
-+ mkdir -p ${PORTSDIR}/${FILE}
-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
-+ -C ${PORTSDIR}/${FILE}
-+ ;;
-+ *)
-+ tar -xz --numeric-owner -f ${WORKDIR}/files/${HASH}.gz \
-+ -C ${PORTSDIR} ${FILE}
-+ ;;
-+ esac
-+ done; then
-+ return 1
-+ fi
-+}
-+
- # Do the actual work involved in "update"
- update_run() {
- if ! [ -z "${INDEXONLY}" ]; then
-@@ -947,7 +1050,7 @@ update_run() {
- # If we are REFUSEing to touch certain directories, don't remove files
- # from those directories (even if they are out of date)
- echo -n "Removing old files and directories... "
-- if ! [ -z "${REFUSE}" ]; then
-+ if ! [ -z "${REFUSE}" ]; then
- sort ${WORKDIR}/INDEX |
- comm -23 ${PORTSDIR}/.portsnap.INDEX - | cut -f 1 -d '|' |
- grep -vE "${REFUSE}" |
-@@ -961,38 +1064,7 @@ update_run() {
- fi
- echo "done."
-
--# Install new files
-- echo "Extracting new files:"
-- if !
-- if ! [ -z "${REFUSE}" ]; then
-- grep -vE "${REFUSE}" ${WORKDIR}/INDEX | sort
-- else
-- sort ${WORKDIR}/INDEX
-- fi |
-- comm -13 ${PORTSDIR}/.portsnap.INDEX - |
-- while read LINE; do
-- FILE=`echo ${LINE} | cut -f 1 -d '|'`
-- HASH=`echo ${LINE} | cut -f 2 -d '|'`
-- echo ${PORTSDIR}/${FILE}
-- if ! [ -r "${WORKDIR}/files/${HASH}.gz" ]; then
-- echo "files/${HASH}.gz not found -- snapshot corrupt."
-- return 1
-- fi
-- case ${FILE} in
-- */)
-- mkdir -p ${PORTSDIR}/${FILE}
-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
-- -C ${PORTSDIR}/${FILE}
-- ;;
-- *)
-- tar -xzf ${WORKDIR}/files/${HASH}.gz \
-- -C ${PORTSDIR} ${FILE}
-- ;;
-- esac
-- done; then
-- return 1
-- fi
--
-+ update_run_extract || return 1
- extract_metadata
- extract_indices
- }
-@@ -1013,10 +1085,10 @@ get_params() {
- # Fetch command. Make sure that we're being called
- # interactively, then run fetch_check_params and fetch_run
- cmd_fetch() {
-- if [ ! -t 0 ]; then
-+ if [ "${INTERACTIVE}" != "YES" ]; then
- echo -n "`basename $0` fetch should not "
- echo "be run non-interactively."
-- echo "Run `basename $0` cron instead."
-+ echo "Run `basename $0` cron instead"
- exit 1
- fi
- fetch_check_params
-@@ -1055,10 +1127,29 @@ cmd_update() {
- update_run || exit 1
- }
-
-+# Auto command. Run 'fetch' or 'cron' depending on
-+# whether stdin is a terminal; then run 'update' or
-+# 'extract' depending on whether ${PORTSDIR} exists.
-+cmd_auto() {
-+ if [ "${INTERACTIVE}" = "YES" ]; then
-+ cmd_fetch
-+ else
-+ cmd_cron
-+ fi
-+ if [ -r ${PORTSDIR}/.portsnap.INDEX ]; then
-+ cmd_update
-+ else
-+ cmd_extract
-+ fi
-+}
-+
- #### Entry point
-
- # Make sure we find utilities from the base system
- export PATH=/sbin:/bin:/usr/sbin:/usr/bin:${PATH}
-+
-+# Set LC_ALL in order to avoid problems with character ranges like [A-Z].
-+export LC_ALL=C
-
- get_params $@
- for COMMAND in ${COMMANDS}; do
diff --git a/ports-mgmt/portsnap/files/patch-portsnap.8 b/ports-mgmt/portsnap/files/patch-portsnap.8
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/patch-portsnap.8
+++ /dev/null
@@ -1,183 +0,0 @@
---- portsnap.8.orig 2006-05-26 23:21:29 UTC
-+++ portsnap.8
-@@ -23,9 +23,9 @@
- .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- .\" POSSIBILITY OF SUCH DAMAGE.
- .\"
--.\" $FreeBSD: src/usr.sbin/portsnap/portsnap/portsnap.8,v 1.9 2006/05/13 18:04:48 cperciva Exp $
-+.\" $FreeBSD$
- .\"
--.Dd August 13, 2005
-+.Dd July 1, 2018
- .Dt PORTSNAP 8
- .Os FreeBSD
- .Sh NAME
-@@ -50,20 +50,25 @@ of the
- .Fx
- ports tree, and extract and update an
- uncompressed ports tree.
-+.Pp
-+In a normal update operation,
-+.Nm
-+will routinely restore modified files to their unmodified state and
-+delete unrecognized local files.
- .Sh OPTIONS
- The following options are supported:
- .Bl -tag -width "-f conffile"
- .It Fl d Ar workdir
--Store working files (e.g. downloaded updates) in
-+Store working files (e.g.\& downloaded updates) in
- .Ar workdir .
- (default:
--.Pa $PREFIX/portsnap ,
-+.Pa /var/db/portsnap ,
- or as given in the configuration file.)
- .It Fl f Ar conffile
--Read the configuration from from
-+Read the configuration from
- .Ar conffile .
- (default:
--.Pa $PREFIX/etc/portsnap.conf )
-+.Pa %%PREFIX%%/etc/portsnap.conf )
- .It Fl I
- For the
- .Cm update
-@@ -72,7 +77,7 @@ command, update INDEX files, but not the rest of the p
- Expect a public key with given SHA256 hash.
- (default: read value from configuration file.)
- .It Fl l Ar descfile
--Merge the specified local describes file into the INDEX files being
-+Merge the specified local describes file into the INDEX files being
- built.
- The
- .Ar descfile
-@@ -88,25 +93,30 @@ operate on the directory
- or as given in the configuration file.)
- .It Fl s Ar server
- Fetch files from the specified server or server pool.
--(default: portsnap.FreeBSD.org , or as given in the
-+(default: portsnap.FreeBSD.org, or as given in the
- configuration file.)
- .It path
- For
- .Cm extract
- command only, operate only on parts of the ports tree starting with
- .Ar path .
--(e.g.
-+(e.g.\&
- .Nm
--.cm extract
-+.Cm extract
- .Ar sysutils/port
- would extract sysutils/portsman, sysutils/portsnap,
- sysutils/portupgrade, etc.)
-+.It Fl Fl interactive
-+override auto-detection of calling process.
-+Only use this when calling portsnap from an
-+.Sy interactive, non-terminal application.
-+(Cron jobs are particularly bad since they cause
-+load spikes on the Portsnap mirrors.)
- .El
- .Sh COMMANDS
- The
- .Cm command
- can be any one of the following:
--.Pp
- .Bl -tag -width "-f conffile"
- .It fetch
- Fetch a compressed snapshot of the ports tree, or update
-@@ -151,21 +161,52 @@ or
- commands.
- Again, note that in the parts of the ports tree which are being
- updated, any local changes or additions will be removed.
-+.It auto
-+Run
-+.Cm fetch
-+or
-+.Cm cron
-+depending on whether stdin is a terminal; then run
-+.Cm update
-+or
-+.Cm extract
-+depending on whether
-+.Ar portsdir
-+exists.
- .El
- .Sh TIPS
- .Bl -bullet
- .It
- If your clock is set to local time, adding the line
- .Pp
--.Dl 0 3 * * * root /usr/local/sbin/portsnap cron
-+.Dl 0 3 * * * root %%PREFIX%%/sbin/portsnap cron
- .Pp
--to /etc/crontab is a good way to make sure you always have
-+to
-+.Pa /etc/crontab
-+is a good way to make sure you always have
- an up-to-date snapshot of the ports tree available which
- can quickly be extracted into
- .Pa /usr/ports .
- If your clock is set to UTC, please pick a random time other
- than 3AM, to avoid overly imposing an uneven load on the
- server(s) hosting the snapshots.
-+.Pp
-+Note that running
-+.Nm
-+.Cm cron
-+or
-+.Nm
-+.Cm fetch
-+does not apply the changes that were received: they only download
-+them.
-+To apply the changes, you must follow these commands with
-+.Nm
-+.Cm update .
-+The
-+.Nm
-+.Cm update
-+command is normally run by hand at a time when you are sure that
-+no one is manually working in the ports tree.
- .It
- Running
- .Nm
-@@ -183,7 +224,7 @@ However, running
- .Fl I
- .Cm update
- is probably safe, and can be used together with
--.Xr portversion 1
-+.Xr pkg-version 8
- to identify installed software which is out of date.
- .It
- If you wish to use
-@@ -206,22 +247,22 @@ of files are not needed by any particular client.
- .Sh PRIVACY NOTICE
- As an unavoidable part of its operation, a machine running
- .Nm
--will make its public IP address and the list of files it fetches
-+will make its public IP address and the list of files it fetches
- available to the server from which it fetches updates.
--Using these it may be possible to recognize a machine over an extended
--period of time, determine when it is updated, and identify which
--portions of the FreeBSD ports tree, if any, are being ignored using
-+Using these it may be possible to recognize a machine over an extended
-+period of time, determine when it is updated, and identify which
-+portions of the FreeBSD ports tree, if any, are being ignored using
- "REFUSE" directives in
- .Pa portsnap.conf .
- .Pp
--Statistical data generated from information collected in this manner
-+Statistical data generated from information collected in this manner
- may be published, but only in aggregate and after anonymizing the
- individual systems.
- .Sh FILES
--.Bl -tag -width "$PREFIX/etc/portsnap.conf"
--.It $PREFIX/etc/portsnap.conf
-+.Bl -tag -width "%%PREFIX%%/etc/portsnap.conf"
-+.It %%PREFIX%%/etc/portsnap.conf
- Default location of the portsnap configuration file.
--.It $PREFIX/portsnap
-+.It /var/db//portsnap
- Default location where compressed snapshots are stored.
- .It /usr/ports
- Default location where the ports tree is extracted.
diff --git a/ports-mgmt/portsnap/files/patch-portsnap.conf b/ports-mgmt/portsnap/files/patch-portsnap.conf
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/patch-portsnap.conf
+++ /dev/null
@@ -1,21 +0,0 @@
---- portsnap.conf.orig 2023-04-09 15:47:31 UTC
-+++ portsnap.conf
-@@ -1,7 +1,7 @@
--# $FreeBSD: src/etc/portsnap.conf,v 1.3 2006/01/18 03:40:57 cperciva Exp $
-+# $FreeBSD$
-
- # Default directory where compressed snapshots are stored.
--# WORKDIR=/usr/local/portsnap
-+# WORKDIR=/var/db/portsnap
-
- # Default location of the ports tree (target for "update" and "extract").
- # PORTSDIR=/usr/ports
-@@ -28,3 +28,8 @@ KEYPRINT=9b5feee6d69f170e3dd0a2c8e469ddbd64f13f978f2f3
- #
- # REFUSE arabic chinese french german hebrew hungarian japanese
- # REFUSE korean polish portuguese russian ukrainian vietnamese
-+
-+# List of INDEX files to build and the DESCRIBE file to use for each
-+#INDEX INDEX-12 DESCRIBE.12
-+#INDEX INDEX-13 DESCRIBE.13
-+#INDEX INDEX-14 DESCRIBE.14
diff --git a/ports-mgmt/portsnap/files/patch-portsnap.conf.5 b/ports-mgmt/portsnap/files/patch-portsnap.conf.5
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/patch-portsnap.conf.5
+++ /dev/null
@@ -1,65 +0,0 @@
---- portsnap.conf.5.orig 2006-05-26 23:20:32 UTC
-+++ portsnap.conf.5
-@@ -23,7 +23,7 @@
- .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- .\" POSSIBILITY OF SUCH DAMAGE.
- .\"
--.\" $FreeBSD: src/share/man/man5/portsnap.conf.5,v 1.2 2005/09/06 19:28:37 cperciva Exp $
-+.\" $FreeBSD$
- .\"
- .Dd January 30, 2005
- .Dt PORTSNAP.CONF 5
-@@ -68,7 +68,8 @@ snapshot of the ports tree.
- This is equivalent to the
- .Fl d Ar workdir
- option to
--.Xr portsnap 8 , and will be ignored if the command-line option
-+.Xr portsnap 8 ,
-+and will be ignored if the command-line option
- is used.
- .Pp
- A line of the form
-@@ -82,13 +83,21 @@ commands.
- This is equivalent to the
- .Fl p Ar portsdir
- option to
--.Xr portsnap 8 , and will be ignored if the command-line option
-+.Xr portsnap 8 ,
-+and will be ignored if the command-line option
- is used.
- .Pp
- If more than one line of any of the above forms is included in
- .Nm
- then only the last one will take effect.
- .Pp
-+A line of the form
-+.Dl INDEX INDEXFILE DESCRIBEFILE
-+will instruct
-+.Xr portsnap 8
-+that the specified INDEX file is generated from the specified
-+describe file distributed by the portsnap server.
-+.Pp
- Finally, a line of the form
- .Dl REFUSE foo bar
- will instruct
-@@ -123,14 +132,14 @@ supported and may cause unexpected results.
- .Pp
- Any lines not of the above forms will be ignored.
- .Sh FILES
--.Bl -tag -width "$PREFIX/portsnap.conf"
--.It $PREFIX/portsnap.conf
-+.Bl -tag -width "%%PREFIX%%/etc/portsnap.conf"
-+.It Pa %%PREFIX%/etc/portsnap.conf
- Default location of the portsnap configuration file.
- .El
- .Sh SEE ALSO
--.Xr egrep 1
--.Xr fetch 1
-+.Xr egrep 1 ,
-+.Xr fetch 1 ,
-+.Xr sha256 1 ,
- .Xr portsnap 8
--.Xr sha256 8
- .Sh AUTHORS
--.An Colin Percival Aq cperciva@FreeBSD.org
-+.An Colin Percival Aq Mt cperciva@FreeBSD.org
diff --git a/ports-mgmt/portsnap/files/pkg-message.in b/ports-mgmt/portsnap/files/pkg-message.in
deleted file mode 100644
--- a/ports-mgmt/portsnap/files/pkg-message.in
+++ /dev/null
@@ -1,28 +0,0 @@
-[
-{ type: install
- message: <<EOM
-Before you can use portsnap, you will have to create an update configuration
-file specifying the server from which to fetch snapshots and the sha256 hash
-of the openssl public key which is trusted to sign the snapshots.
-
-A sample configuration file has been installed in
-
- %%PREFIX%%/etc/portsnap.conf.sample
-
-which will fetch snapshots built and signed by the author. If you want to
-use these updates, copy that file to
-
- %%PREFIX%%/etc/portsnap.conf
-
-otherwise, create that file as appropriate.
-EOM
-}
-{
- type: upgrade
- maximum_version: "0.3.2"
- message: <<EOM
-The structure of the portsnap configuration file has changed; you will
-have to replace your existing portsnap.conf with a new version.
-EOM
-}
-]
diff --git a/ports-mgmt/portsnap/pkg-descr b/ports-mgmt/portsnap/pkg-descr
deleted file mode 100644
--- a/ports-mgmt/portsnap/pkg-descr
+++ /dev/null
@@ -1,13 +0,0 @@
-Portsnap is a system for securely updating the ports tree by
-distributing signed compressed snapshots. This is the client
-half of that system; it downloads compressed snapshots into
-/usr/local/portsnap ("portsnap fetch") and uses those to extract
-a ports tree into /usr/ports ("portsnap extract") or update an
-existing tree ("portsnap update").
-
-In addition to operating entirely over HTTP, portsnap can use under
-a tenth of the bandwidth required by CVSup if a copy of the ports
-tree is being updated every few days.
-
-- Colin Percival
-cperciva@daemonology.net
diff --git a/security/Makefile b/security/Makefile
--- a/security/Makefile
+++ b/security/Makefile
@@ -280,7 +280,6 @@
SUBDIR += krb5-122
SUBDIR += krb5-devel
SUBDIR += kstart
- SUBDIR += ktls_isa-l_crypto-kmod
SUBDIR += kuku
SUBDIR += kwalletmanager
SUBDIR += l0pht-watch
@@ -453,7 +452,6 @@
SUBDIR += openssl-agent
SUBDIR += openssl-oqsprovider
SUBDIR += openssl-unsafe
- SUBDIR += openssl111
SUBDIR += openssl33
SUBDIR += openssl33-quictls
SUBDIR += openssl34
diff --git a/security/cyrus-sasl2/Makefile b/security/cyrus-sasl2/Makefile
--- a/security/cyrus-sasl2/Makefile
+++ b/security/cyrus-sasl2/Makefile
@@ -12,7 +12,6 @@
OPTIONS_DEFINE= ALWAYSTRUE AUTHDAEMOND DOCS KEEP_DB_OPEN \
OBSOLETE_CRAM_ATTR OBSOLETE_DIGEST_ATTR \
OPIE SASLDB_IN_VAR
-OPTIONS_EXCLUDE_FreeBSD_13= OPIE
OPTIONS_RADIO= SASLDB
OPTIONS_RADIO_SASLDB= BDB1 BDB GDBM LMDB
OPTIONS_GROUP= PLUGIN
diff --git a/security/cyrus-sasl2/Makefile.common b/security/cyrus-sasl2/Makefile.common
--- a/security/cyrus-sasl2/Makefile.common
+++ b/security/cyrus-sasl2/Makefile.common
@@ -101,7 +101,7 @@
SASLDB= "@comment "
.endif
-.if ${OPSYS} == FreeBSD && ${OSREL:R} >= 14
+.if ${OPSYS} == FreeBSD
.if ${PORT_OPTIONS:MOPIE} && ${PORT_OPTIONS:MOTP}
CONFIGURE_ARGS+=--with-opie=${LOCALBASE}
LIB_DEPENDS+= libopie.so:security/opie
diff --git a/security/ftimes/Makefile b/security/ftimes/Makefile
--- a/security/ftimes/Makefile
+++ b/security/ftimes/Makefile
@@ -12,7 +12,6 @@
LICENSE_COMB= multi
BROKEN_aarch64= fails to build: aarch64 is not currently supported
-BROKEN_mips64= fails to build: mips64 is not currently supported
BROKEN_riscv64= fails to build: riscv64 is not currently supported
GNU_CONFIGURE= yes
diff --git a/security/git-crypt/Makefile b/security/git-crypt/Makefile
--- a/security/git-crypt/Makefile
+++ b/security/git-crypt/Makefile
@@ -38,7 +38,7 @@
LDFLAGS+= -L${OPENSSLLIB}
.endif
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
CXXFLAGS+= -DOPENSSL_API_COMPAT=0x30000000L
.endif
diff --git a/security/gost-engine/Makefile b/security/gost-engine/Makefile
--- a/security/gost-engine/Makefile
+++ b/security/gost-engine/Makefile
@@ -40,7 +40,7 @@
.endif
# For OpenSSL 3.0.x in base (14+) or installed as port/package
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 || ${FLAVOR:U} == openssl30
+.if ${OPSYS} == FreeBSD || ${FLAVOR:U} == openssl30
GH_TAGNAME= 2b22503
GH_TUPLE+= provider-corner:libprov:e9f3e6a:libprov
GH_SUBDIR= libprov:libprov
diff --git a/security/helib/Makefile b/security/helib/Makefile
--- a/security/helib/Makefile
+++ b/security/helib/Makefile
@@ -10,7 +10,7 @@
LICENSE= APACHE20
LICENSE_FILE= ${WRKSRC}/LICENSE.md
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
LIB_DEPENDS= libgmp.so:math/gmp \
libntl.so:math/ntl
diff --git a/security/kanidm/Makefile b/security/kanidm/Makefile
--- a/security/kanidm/Makefile
+++ b/security/kanidm/Makefile
@@ -12,7 +12,6 @@
LICENSE= MPL20
LICENSE_FILE= ${WRKSRC}/LICENSE.md
-IGNORE_FreeBSD_13= Does not build on FreeBSD 13.x due to OpenSSL 1.1.1
ONLY_FOR_ARCHS= aarch64 amd64
FLAVORS= client server
diff --git a/security/ktls_isa-l_crypto-kmod/Makefile b/security/ktls_isa-l_crypto-kmod/Makefile
deleted file mode 100644
--- a/security/ktls_isa-l_crypto-kmod/Makefile
+++ /dev/null
@@ -1,43 +0,0 @@
-PORTNAME= isa-l_crypto
-PORTVERSION= 2.21.0
-DISTVERSIONPREFIX= v
-PORTREVISION= 1
-CATEGORIES= security
-PKGNAMEPREFIX= ktls_
-PKGNAMESUFFIX= -kmod
-
-MAINTAINER= gallatin@FreeBSD.org
-COMMENT= KTLS module using Intel(R) ISA-L crypto
-WWW= https://github.com/01org/isa-l_crypto
-
-LICENSE= BSD3CLAUSE
-LICENSE_FILE= ${WRKSRC}/LICENSE
-
-ONLY_FOR_ARCHS= amd64
-
-BUILD_DEPENDS= yasm:devel/yasm
-
-USES= kmod uidfix
-
-USE_GITHUB= yes
-GH_ACCOUNT= 01org
-
-MAKE_ENV+= ISASRC=${WRKSRC}
-
-PLIST_FILES= ${KMODDIR}/ktls_intel-isa-l.ko
-
-.include <bsd.port.pre.mk>
-
-.if !exists(${SRC_BASE}/sys/sys/ktls.h)
-IGNORE= requires KTLS support
-.endif
-
-.if ${OSVERSION} >= 1400016
-IGNORE= is only supported on FreeBSD 13
-.endif
-
-post-extract:
- ${CP} ${FILESDIR}/* ${WRKSRC}/
- ${ECHO} "#include <sys/stdint.h>" > ${WRKSRC}/include/stdint.h
-
-.include <bsd.port.post.mk>
diff --git a/security/ktls_isa-l_crypto-kmod/distinfo b/security/ktls_isa-l_crypto-kmod/distinfo
deleted file mode 100644
--- a/security/ktls_isa-l_crypto-kmod/distinfo
+++ /dev/null
@@ -1,3 +0,0 @@
-TIMESTAMP = 1566856170
-SHA256 (01org-isa-l_crypto-v2.21.0_GH0.tar.gz) = 58284d7e5e60c37d6d4c1bbc2a876e95d14ca153443775a491f91c21a4243171
-SIZE (01org-isa-l_crypto-v2.21.0_GH0.tar.gz) = 502413
diff --git a/security/ktls_isa-l_crypto-kmod/files/Makefile b/security/ktls_isa-l_crypto-kmod/files/Makefile
deleted file mode 100644
--- a/security/ktls_isa-l_crypto-kmod/files/Makefile
+++ /dev/null
@@ -1,60 +0,0 @@
-# Copyright (c) 2016-2019 Netflix, Inc
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions
-# are met:
-# 1. Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer,
-# without modification.
-# 2. Redistributions in binary form must reproduce at minimum a disclaimer
-# similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
-# redistribution must be conditioned upon including a substantially
-# similar Disclaimer requirement for further binary redistribution.
-#
-# NO WARRANTY
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
-# AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
-# THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
-# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
-# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
-# THE POSSIBILITY OF SUCH DAMAGES.
-
-ISAINC=${ISASRC}/include
-ISAAES=${ISASRC}/aes
-INCS=-I${ISAINC} -I${ISAAES}
-CFLAGS+=${INCS}
-YASM=${LOCALBASE}/bin/yasm
-
-.PATH: ${ISASRC}/aes
-.SUFFIXES: .asm
-.asm.o:
- ${YASM} -g dwarf2 -f elf64 ${INCS} -o ${.TARGET} ${.IMPSRC}
-
-KMOD= ktls_intel-isa-l
-SRCS= gcm128_avx_gen2.asm \
- gcm128_avx_gen4.asm \
- gcm128_sse.asm \
- gcm256_avx_gen2.asm \
- gcm256_avx_gen4.asm \
- gcm256_sse.asm \
- gcm_multibinary.asm \
- gcm128_avx_gen2_nt.asm \
- gcm128_avx_gen4_nt.asm \
- gcm128_sse_nt.asm \
- gcm256_avx_gen2_nt.asm \
- gcm256_avx_gen4_nt.asm \
- gcm256_sse_nt.asm \
- gcm_multibinary_nt.asm \
- keyexp_128.asm \
- keyexp_192.asm \
- keyexp_256.asm \
- keyexp_multibinary.asm \
- gcm_pre.c \
- intelisa_kern.c
-
-.include <bsd.kmod.mk>
diff --git a/security/ktls_isa-l_crypto-kmod/files/intelisa_kern.c b/security/ktls_isa-l_crypto-kmod/files/intelisa_kern.c
deleted file mode 100644
--- a/security/ktls_isa-l_crypto-kmod/files/intelisa_kern.c
+++ /dev/null
@@ -1,394 +0,0 @@
-/*-
- * SPDX-License-Identifier: BSD-2-Clause
- *
- * Copyright (c) 2014-2018 Netflix Inc.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- * notice, this list of conditions and the following disclaimer in the
- * documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *
- */
-#include <sys/cdefs.h>
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/kernel.h>
-#include <sys/ktls.h>
-#include <sys/lock.h>
-#include <sys/malloc.h>
-#include <sys/mutex.h>
-#include <sys/proc.h>
-#include <sys/sockbuf.h>
-#include <sys/filedesc.h>
-#include <sys/sysctl.h>
-#include <sys/counter.h>
-#include <sys/uio.h>
-#include <sys/module.h>
-#include <opencrypto/xform.h>
-#include <machine/fpu.h>
-
-#include "aes_gcm.h"
-
-#define KTLS_INTELISA_AEAD_TAGLEN 16
-
-struct isa_gcm_struct {
- struct gcm_key_data key_data;
- struct gcm_context_data ctx_data;
- void (*gcm_pre) (const void *key, struct gcm_key_data *); /* Done once per key */
- void (*gcm_init) (const struct gcm_key_data *key_data,
- struct gcm_context_data *context_data,
- uint8_t *iv,
- uint8_t const *aad,
- uint64_t aad_len); /* Done at start of crypt */
- void (*gcm_upd) (const struct gcm_key_data *key_data,
- struct gcm_context_data *context_data,
- uint8_t *out,
- const uint8_t *in,
- uint64_t len); /* With each block of data */
- void (*gcm_upd_nt) (const struct gcm_key_data *key_data,
- struct gcm_context_data *context_data,
- uint8_t *out,
- const uint8_t *in,
- uint64_t len); /* With each block of data */
- void (*gcm_final) (const struct gcm_key_data *key_data,
- struct gcm_context_data *context_data,
- uint8_t *tag,
- uint64_t tag_len); /* Pulls out the tag */
-};
-
-SYSCTL_DECL(_kern_ipc_tls);
-
-static int ktls_use_intel_isa_gcm = 1;
-SYSCTL_INT(_kern_ipc_tls, OID_AUTO, isa_gcm, CTLFLAG_RW,
- &ktls_use_intel_isa_gcm, 1,
- "Should we use the Intel ISA GCM if available");
-
-SYSCTL_DECL(_kern_ipc_tls_stats);
-
-static counter_u64_t ktls_offload_isa_aead;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_aead_crypts,
- CTLFLAG_RD, &ktls_offload_isa_aead,
- "Total number of Intel ISA TLS AEAD encrypts called");
-
-static counter_u64_t ktls_offload_isa_tls_13;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_tls_13_crypts,
- CTLFLAG_RD, &ktls_offload_isa_tls_13,
- "Total number of Intel ISA TLS 1.3 encrypts called");
-
-static counter_u64_t ktls_offload_isa_tls_12;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_tls_12_crypts,
- CTLFLAG_RD, &ktls_offload_isa_tls_12,
- "Total number of Intel ISA TLS 1.2 encrypts called");
-
-static counter_u64_t intelisa_unaligned_mem_b;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_unaligned_bytes,
- CTLFLAG_RD, &intelisa_unaligned_mem_b,
- "Byte cnt of intel isa unaligned");
-
-static counter_u64_t intelisa_aligned_mem_b;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_aligned_bytes,
- CTLFLAG_RD, &intelisa_aligned_mem_b,
- "Byte cnt of intel isa aligned");
-
-static counter_u64_t intelisa_unaligned_mem;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_unaligned,
- CTLFLAG_RD, &intelisa_unaligned_mem,
- "Call cnt of intel isa unaligned");
-
-static counter_u64_t intelisa_aligned_mem;
-SYSCTL_COUNTER_U64(_kern_ipc_tls_stats, OID_AUTO, isa_aligned,
- CTLFLAG_RD, &intelisa_aligned_mem,
- "Call cnt of intel isa aligned");
-
-static MALLOC_DEFINE(M_INTEL_ISA, "isal_tls", "Intel ISA-L TLS");
-
-static int
-intel_isa_seal(struct isa_gcm_struct *isa,
- struct iovec *outiov, int numiovs,
- uint8_t * iv,
- struct iovec *iniov,
- uint8_t * ad, int adlen,
- uint8_t * tagout, size_t *taglen,
- bool tls_13, uint8_t tls_13_rtype)
-{
- int i;
- bool nt = true;
- bool misaligned_len, misaligned_start;
- int fixup = 0;
- uint8_t *in;
- uint8_t *out;
- uint64_t len;
-
- isa->gcm_init(&isa->key_data, &isa->ctx_data, iv, ad, (size_t)adlen);
- for (i = 0; i < numiovs; i++) {
- in = iniov[i].iov_base;
- out = outiov[i].iov_base;
- len = iniov[i].iov_len;
-
- misaligned_start = ((uintptr_t)in & 0xf) != 0;
- misaligned_len = (len & 0xf) != 0;
-
- if (misaligned_start || misaligned_len) {
- /*
- * Try to do as much of a page using
- * non-temporals as we possibly can, and leave
- * a ragged tail as a separate chunk.
- */
- if (nt && !misaligned_start && len > 0xf) {
- len = len & ~0xf;
- fixup = iniov[i].iov_len - len;
- } else {
- nt = false;
- }
- }
-fixup_done:
- if (nt) {
- isa->gcm_upd_nt(&isa->key_data, &isa->ctx_data, out, in, len);
- counter_u64_add(intelisa_aligned_mem, 1);
- counter_u64_add(intelisa_aligned_mem_b, len);
- } else {
- isa->gcm_upd(&isa->key_data, &isa->ctx_data, out, in, len);
- counter_u64_add(intelisa_unaligned_mem, 1);
- counter_u64_add(intelisa_unaligned_mem_b, len);
- }
- if (fixup) {
- in += len;
- out += len;
- len = fixup;
- fixup = 0;
- nt = false;
- goto fixup_done;
- }
- }
- if (tls_13) {
- *tagout = tls_13_rtype;
- isa->gcm_upd(&isa->key_data, &isa->ctx_data, tagout,
- tagout, 1);
- tagout += 1;
- }
- isa->gcm_final(&isa->key_data, &isa->ctx_data, tagout, *taglen);
- return (0);
-}
-
-static int
-ktls_intelisa_aead_encrypt(struct ktls_session *tls,
- const struct tls_record_layer *hdr, uint8_t *trailer, struct iovec *iniov,
- struct iovec *outiov, int iovcnt, uint64_t seqno, uint8_t tls_rtype)
-{
- struct isa_gcm_struct *isa;
- struct tls_aead_data ad;
- struct tls_nonce_data nd;
- size_t adlen, taglen;
- uint8_t *adptr;
- int ret;
- uint16_t tls_comp_len;
- bool tls_13;
-
- isa = (struct isa_gcm_struct *)tls->cipher;
-
- KASSERT(isa != NULL, ("Null cipher"));
- counter_u64_add(ktls_offload_isa_aead, 1);
- taglen = KTLS_INTELISA_AEAD_TAGLEN;
-
- /* Setup the nonce */
- memcpy(&nd, tls->params.iv, tls->params.iv_len);
-
- /* Setup the associated data */
- ad.seq = htobe64(seqno);
- ad.type = hdr->tls_type;
- ad.tls_vmajor = hdr->tls_vmajor;
- ad.tls_vminor = hdr->tls_vminor;
-
- /* Version-specific nonce and AAD. */
- if (tls->params.tls_vminor == TLS_MINOR_VER_THREE) {
- tls_13 = true;
- counter_u64_add(ktls_offload_isa_tls_13, 1);
-
- adlen = sizeof(ad) - sizeof(ad.seq);
- adptr = &ad.type;
- ad.tls_length = hdr->tls_length;
-
- /*
- * RFC 8446 5.3: left pad the 64b seqno
- * with 0s, and xor with the IV.
- */
- nd.seq ^= htobe64(seqno);
- } else {
- tls_13 = false;
- counter_u64_add(ktls_offload_isa_tls_12, 1);
-
- tls_comp_len = ntohs(hdr->tls_length) -
- (KTLS_INTELISA_AEAD_TAGLEN + sizeof(nd.seq));
- adlen = sizeof(ad);
- adptr = (uint8_t *)&ad;
- ad.tls_length = htons(tls_comp_len);
-
- memcpy(&nd.seq, hdr + 1, sizeof(nd.seq));
- }
-
- ret = intel_isa_seal(isa, outiov, iovcnt, (uint8_t *)&nd, iniov,
- adptr, adlen, trailer, &taglen,
- tls_13, tls_rtype);
-
- return(ret);
-}
-
-
-static int
-ktls_intelisa_setup_cipher(struct isa_gcm_struct *isa, uint8_t *key)
-{
- struct fpu_kern_ctx *fpu_ctx;
-
- if (key == NULL) {
- return (EINVAL);
- }
- fpu_ctx = fpu_kern_alloc_ctx(FPU_KERN_NOWAIT);
- if (fpu_ctx == NULL) {
- return (ENOMEM);
- }
- fpu_kern_enter(curthread, fpu_ctx, FPU_KERN_NORMAL);
- isa->gcm_pre(key, &isa->key_data);
- fpu_kern_leave(curthread, fpu_ctx);
- fpu_kern_free_ctx(fpu_ctx);
- return (0);
-}
-
-static void
-ktls_intelisa_free(struct ktls_session *tls)
-{
- struct isa_gcm_struct *isa;
-
- isa = tls->cipher;
- explicit_bzero(isa, sizeof(*isa));
- free(isa, M_INTEL_ISA);
-}
-
-static int
-#if KTLS_API_VERSION >= 7
-ktls_intelisa_try(struct socket *so, struct ktls_session *tls, int direction)
-#else
-ktls_intelisa_try(struct socket *so, struct ktls_session *tls)
-#endif
-{
- struct isa_gcm_struct *isa;
- int error;
-
-#if KTLS_API_VERSION >= 7
- if (direction != KTLS_TX)
- return (EOPNOTSUPP);
-#endif
- if (ktls_use_intel_isa_gcm &&
- tls->params.cipher_algorithm == CRYPTO_AES_NIST_GCM_16) {
- isa = malloc(sizeof (*isa), M_INTEL_ISA, M_NOWAIT | M_ZERO);
- if (isa == NULL) {
- return (ENOMEM);
- }
- switch (tls->params.cipher_key_len) {
- case 16:
- isa->gcm_pre = aes_gcm_pre_128;
- isa->gcm_init = aes_gcm_init_128;
- isa->gcm_upd = aes_gcm_enc_128_update;
- isa->gcm_upd_nt = aes_gcm_enc_128_update_nt;
- isa->gcm_final = aes_gcm_enc_128_finalize;
- break;
- case 32:
- isa->gcm_pre = aes_gcm_pre_256;
- isa->gcm_init = aes_gcm_init_256;
- isa->gcm_upd = aes_gcm_enc_256_update;
- isa->gcm_upd_nt = aes_gcm_enc_256_update_nt;
- isa->gcm_final = aes_gcm_enc_256_finalize;
- break;
- default:
- free(isa, M_INTEL_ISA);
- return (EOPNOTSUPP);
- }
-
- error = ktls_intelisa_setup_cipher(isa, tls->params.cipher_key);
- if (error) {
- free(isa, M_INTEL_ISA);
- return (error);
- }
-
- tls->cipher = isa;
- tls->sw_encrypt = ktls_intelisa_aead_encrypt;
- tls->free = ktls_intelisa_free;
- return (0);
- }
- return (EOPNOTSUPP);
-}
-
-struct ktls_crypto_backend intelisa_backend = {
- .name = "Intel ISA-L",
- .prio = 20,
- .api_version = KTLS_API_VERSION,
- .try = ktls_intelisa_try,
-};
-
-static int
-intelisa_init(void)
-{
- ktls_offload_isa_aead = counter_u64_alloc(M_WAITOK);
- ktls_offload_isa_tls_12 = counter_u64_alloc(M_WAITOK);
- ktls_offload_isa_tls_13 = counter_u64_alloc(M_WAITOK);
- intelisa_aligned_mem = counter_u64_alloc(M_WAITOK);
- intelisa_aligned_mem_b = counter_u64_alloc(M_WAITOK);
- intelisa_unaligned_mem = counter_u64_alloc(M_WAITOK);
- intelisa_unaligned_mem_b = counter_u64_alloc(M_WAITOK);
- return (ktls_crypto_backend_register(&intelisa_backend));
-}
-
-static int
-intelisa_unload(void)
-{
- int error;
-
- error = ktls_crypto_backend_deregister(&intelisa_backend);
- if (error)
- return (error);
- counter_u64_free(ktls_offload_isa_aead);
- counter_u64_free(intelisa_aligned_mem);
- counter_u64_free(intelisa_aligned_mem_b);
- counter_u64_free(intelisa_unaligned_mem);
- counter_u64_free(intelisa_unaligned_mem_b);
- return (0);
-}
-
-static int
-intelisa_module_event_handler(module_t mod, int evt, void *arg)
-{
- switch (evt) {
- case MOD_LOAD:
- return (intelisa_init());
- case MOD_UNLOAD:
- return (intelisa_unload());
- default:
- return (EOPNOTSUPP);
- }
-}
-
-static moduledata_t intelisa_moduledata = {
- "intelisa",
- intelisa_module_event_handler,
- NULL
-};
-
-DECLARE_MODULE(intelisa, intelisa_moduledata, SI_SUB_PROTO_END, SI_ORDER_ANY);
diff --git a/security/ktls_isa-l_crypto-kmod/pkg-descr b/security/ktls_isa-l_crypto-kmod/pkg-descr
deleted file mode 100644
--- a/security/ktls_isa-l_crypto-kmod/pkg-descr
+++ /dev/null
@@ -1,6 +0,0 @@
-ISA-L crypto is a collection of optimized low-level functions targeting
-cryptography applications.
-
-This port provides a software encryption module for in-kernel TLS
-(KTLS) that uses routines in the ISA-L crypto library to encrypt TLS
-records.
diff --git a/security/libhijack/Makefile b/security/libhijack/Makefile
--- a/security/libhijack/Makefile
+++ b/security/libhijack/Makefile
@@ -15,7 +15,6 @@
ONLY_FOR_ARCHS= aarch64 amd64
ONLY_FOR_ARCHS_REASON= not ported to other architectures
BROKEN_aarch64= does not build, upstream is working on a fix (PR 283408)
-BROKEN_FreeBSD_13= does not build, upstream is working on a fix (PR 283408)
USE_GITLAB= yes
GL_SITE= https://git.hardenedbsd.org
diff --git a/security/libp11/Makefile b/security/libp11/Makefile
--- a/security/libp11/Makefile
+++ b/security/libp11/Makefile
@@ -36,13 +36,6 @@
.include <bsd.port.options.mk>
-.if ${SSL_DEFAULT} == "base" && ${OPSYS} == FreeBSD && ${OSREL:R} < 14
-PLIST_SUB+= PROVIDERS="@comment "
-.else
-PLIST_SUB+= PROVIDERS=""
-.endif
-
-
INSTALL_TARGET= install-strip
PORTDOCS= *
diff --git a/security/libp11/pkg-plist b/security/libp11/pkg-plist
--- a/security/libp11/pkg-plist
+++ b/security/libp11/pkg-plist
@@ -2,8 +2,8 @@
include/p11_err.h
lib/engines/libpkcs11.so
lib/engines/pkcs11.so
-%%PROVIDERS%%lib/ossl-modules/libpkcs11.so
-%%PROVIDERS%%lib/ossl-modules/pkcs11prov.so
+lib/ossl-modules/libpkcs11.so
+lib/ossl-modules/pkcs11prov.so
lib/libp11.a
lib/libp11.so
lib/libp11.so.3
diff --git a/security/nettle/Makefile b/security/nettle/Makefile
--- a/security/nettle/Makefile
+++ b/security/nettle/Makefile
@@ -36,11 +36,6 @@
.include <bsd.port.options.mk>
-.if ${ARCH} == "mips64"
-post-patch:
- @${REINPLACE_CMD} -e 's|__sgi|__unix__|' ${WRKSRC}/configure
-.endif
-
post-install:
${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/lib*.so
${INSTALL_DATA} ${WRKSRC}/nettle.info ${STAGEDIR}${PREFIX}/${INFO_PATH}/nettle.info
diff --git a/security/nmap-devel/Makefile b/security/nmap-devel/Makefile
--- a/security/nmap-devel/Makefile
+++ b/security/nmap-devel/Makefile
@@ -17,8 +17,6 @@
LICENSE_FILE= ${WRKSRC}/LICENSE
LICENSE_PERMS= auto-accept dist-mirror pkg-mirror pkg-sell
-IGNORE_FreeBSD_13= Does not build on FreeBSD 13.x due to OpenSSL 1.1.1
-
LIB_DEPENDS= libpcre2-16.so:devel/pcre2
.if !defined(MASTERDIR)
diff --git a/security/openssl-oqsprovider/Makefile b/security/openssl-oqsprovider/Makefile
--- a/security/openssl-oqsprovider/Makefile
+++ b/security/openssl-oqsprovider/Makefile
@@ -32,10 +32,6 @@
.include <bsd.port.pre.mk>
-.if !defined(OPENSSL_PORT) && ${OSVERSION} < 1400000
-BROKEN= Requires OpenSSL 3.0+, preferably 3.2+
-.endif
-
post-install:
.if ${OPENSSLLIB} == "/usr/lib"
${MKDIR} ${STAGEDIR}${PREFIX}/lib/ossl-modules
diff --git a/security/openssl-unsafe/Makefile b/security/openssl-unsafe/Makefile
--- a/security/openssl-unsafe/Makefile
+++ b/security/openssl-unsafe/Makefile
@@ -31,7 +31,7 @@
SUB_FILES= pkg-message
PLIST_SUB+= SHLIBVER=${OPENSSL_SHLIBVER}
-.if ${MACHINE_ARCH} == "amd64" || ${MACHINE_ARCH} == "mips64el"
+.if ${MACHINE_ARCH} == "amd64"
CONFIGURE_ARGS+= enable-ec_nistp_64_gcc_128
.endif
diff --git a/security/openssl/Makefile b/security/openssl/Makefile
--- a/security/openssl/Makefile
+++ b/security/openssl/Makefile
@@ -45,8 +45,6 @@
.if ${MACHINE_ARCH} == "amd64"
OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
.endif
OPTIONS_SUB= yes
diff --git a/security/openssl111/Makefile b/security/openssl111/Makefile
deleted file mode 100644
--- a/security/openssl111/Makefile
+++ /dev/null
@@ -1,161 +0,0 @@
-PORTNAME= openssl
-PORTVERSION= 1.1.1w
-PORTREVISION= 2
-CATEGORIES= security devel
-MASTER_SITES= https://www.openssl.org/source/ \
- ftp://ftp.cert.dfn.de/pub/tools/net/openssl/source/
-PKGNAMESUFFIX= 111
-
-MAINTAINER= brnrd@FreeBSD.org
-COMMENT= TLSv1.3 capable SSL and crypto library
-WWW= https://www.openssl.org/
-
-LICENSE= OpenSSL
-LICENSE_FILE= ${WRKSRC}/LICENSE
-
-DEPRECATED= End-of-life since 2023-09-11, see https://www.openssl.org/blog/blog/2023/09/11/eol-111/ \
- port will be removed when FreeBSD 13 is EoL
-EXPIRATION_DATE= 2026-04-30
-
-CONFLICTS_INSTALL= boringssl libressl libressl-devel openssl openssl3* openssl*-quictls
-
-USES= cpe perl5
-USE_PERL5= build
-TEST_TARGET= test
-
-HAS_CONFIGURE= yes
-CONFIGURE_SCRIPT= config
-CONFIGURE_ENV= PERL="${PERL}"
-CONFIGURE_ARGS= --openssldir=${OPENSSLDIR} \
- --prefix=${PREFIX}
-
-LDFLAGS_i386= -Wl,-znotext
-
-MAKE_ARGS+= WHOLE_ARCHIVE_FLAG=--whole-archive CNF_LDFLAGS="${LDFLAGS}"
-MAKE_ENV+= LIBRPATH="${PREFIX}/lib" GREP_OPTIONS=
-
-OPTIONS_GROUP= CIPHERS HASHES OPTIMIZE PROTOCOLS
-OPTIONS_GROUP_CIPHERS= ARIA DES GOST IDEA SM4 RC2 RC4 RC5 WEAK-SSL-CIPHERS
-OPTIONS_GROUP_HASHES= MD2 MD4 MDC2 RMD160 SM2 SM3
-OPTIONS_GROUP_OPTIMIZE= ASM SSE2 THREADS
-OPTIONS_DEFINE_i386= I386
-OPTIONS_GROUP_PROTOCOLS=NEXTPROTONEG SCTP SSL3 TLS1 TLS1_1 TLS1_2
-
-OPTIONS_DEFINE= ASYNC CT KTLS MAN3 RFC3779 SHARED ZLIB
-
-OPTIONS_DEFAULT=ASM ASYNC CT GOST DES EC KTLS MAN3 MD4 NEXTPROTONEG RC2 \
- RC4 RMD160 SCTP SHARED SSE2 THREADS TLS1 TLS1_1 TLS1_2
-
-.if ${MACHINE_ARCH} == "amd64"
-OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
-.endif
-
-OPTIONS_SUB= yes
-
-ARIA_DESC= ARIA (South Korean standard)
-ASM_DESC= Assembler code
-ASYNC_DESC= Asynchronous mode
-CIPHERS_DESC= Block Cipher Support
-CT_DESC= Certificate Transparency Support
-DES_DESC= (Triple) Data Encryption Standard
-EC_DESC= Optimize NIST elliptic curves
-GOST_DESC= GOST (Russian standard)
-HASHES_DESC= Hash Function Support
-I386_DESC= i386 (instead of i486+)
-IDEA_DESC= International Data Encryption Algorithm
-KTLS_DESC= Kernel TLS offload
-MAN3_DESC= Install API manpages (section 3, 7)
-MD2_DESC= MD2 (obsolete)
-MD4_DESC= MD4 (unsafe)
-MDC2_DESC= MDC-2 (patented, requires DES)
-NEXTPROTONEG_DESC= Next Protocol Negotiation (SPDY)
-OPTIMIZE_DESC= Optimizations
-PROTOCOLS_DESC= Protocol Support
-RC2_DESC= RC2 (unsafe)
-RC4_DESC= RC4 (unsafe)
-RC5_DESC= RC5 (patented)
-RMD160_DESC= RIPEMD-160
-RFC3779_DESC= RFC3779 support (BGP)
-SCTP_DESC= SCTP (Stream Control Transmission)
-SHARED_DESC= Build shared libraries
-SM2_DESC= SM2 Elliptic Curve DH (Chinese standard)
-SM3_DESC= SM3 256bit (Chinese standard)
-SM4_DESC= SM4 128bit (Chinese standard)
-SSE2_DESC= Runtime SSE2 detection
-SSL3_DESC= SSLv3 (unsafe)
-TLS1_DESC= TLSv1.0 (requires TLS1_1, TLS1_2)
-TLS1_1_DESC= TLSv1.1 (requires TLS1_2)
-TLS1_2_DESC= TLSv1.2
-WEAK-SSL-CIPHERS_DESC= Weak cipher support (unsafe)
-
-# Upstream default disabled options
-.for _option in ktls md2 rc5 sctp ssl3 zlib weak-ssl-ciphers
-${_option:tu}_CONFIGURE_ON= enable-${_option}
-.endfor
-
-# Upstream default enabled options
-.for _option in aria asm async ct des gost idea md4 mdc2 nextprotoneg rc2 rc4 \
- rfc3779 rmd160 shared sm2 sm3 sm4 sse2 threads tls1 tls1_1 tls1_2
-${_option:tu}_CONFIGURE_OFF= no-${_option}
-.endfor
-
-MDC2_IMPLIES= DES
-TLS1_IMPLIES= TLS1_1
-TLS1_1_IMPLIES= TLS1_2
-
-EC_CONFIGURE_ON= enable-ec_nistp_64_gcc_128
-I386_CONFIGURE_ON= 386
-KTLS_EXTRA_PATCHES= ${FILESDIR}/extra-patch-ktls
-MAN3_EXTRA_PATCHES_OFF= ${FILESDIR}/extra-patch-util_process__docs.pl
-SHARED_MAKE_ENV= SHLIBVER=${OPENSSL_SHLIBVER}
-SHARED_PLIST_SUB= SHLIBVER=${OPENSSL_SHLIBVER}
-SHARED_USE= ldconfig=yes
-SSL3_CONFIGURE_ON+= enable-ssl3-method
-ZLIB_CONFIGURE_ON= zlib-dynamic
-
-PORTSCOUT= limit:^1\.1\.1
-
-.include <bsd.port.pre.mk>
-.if ${PREFIX} == /usr
-IGNORE= the OpenSSL port can not be installed over the base version
-.endif
-
-OPENSSLDIR?= ${PREFIX}/openssl
-PLIST_SUB+= OPENSSLDIR=${OPENSSLDIR:S=^${PREFIX}/==}
-
-.include "version.mk"
-
-post-patch:
- ${REINPLACE_CMD} \
- -e 's| install_html_docs$$||' \
- -e 's|$$(LIBDIR)/pkgconfig|libdata/pkgconfig|g' \
- ${WRKSRC}/Configurations/unix-Makefile.tmpl
- ${REINPLACE_CMD} -e 's|\^GNU ld|GNU|' ${WRKSRC}/Configurations/shared-info.pl
-
-post-configure:
- ${REINPLACE_CMD} \
- -e 's|SHLIB_VERSION_NUMBER=1.1|SHLIB_VERSION_NUMBER=${OPENSSL_SHLIBVER}|' \
- ${WRKSRC}/Makefile
- ${REINPLACE_CMD} \
- -e 's|SHLIB_VERSION_NUMBER "1.1"|SHLIB_VERSION_NUMBER "${OPENSSL_SHLIBVER}"|' \
- ${WRKSRC}/include/openssl/opensslv.h
-
-post-install-SHARED-on:
-.for i in libcrypto libssl
- ${INSTALL_LIB} ${WRKSRC}/$i.so.${OPENSSL_SHLIBVER} ${STAGEDIR}${PREFIX}/lib
- ${LN} -sf $i.so.${OPENSSL_SHLIBVER} ${STAGEDIR}${PREFIX}/lib/$i.so
-.endfor
-.for i in capi padlock
- ${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/engines-1.1/${i}.so
-.endfor
-
-post-install:
- ${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/openssl
-
-post-install-MAN3-on:
- ( cd ${STAGEDIR}/${PREFIX} ; ${FIND} share/man/man3 share/man/man7 -not -type d ) | \
- ${SED} 's/$$/.gz/' >>${TMPPLIST}
-
-.include <bsd.port.post.mk>
diff --git a/security/openssl111/distinfo b/security/openssl111/distinfo
deleted file mode 100644
--- a/security/openssl111/distinfo
+++ /dev/null
@@ -1,3 +0,0 @@
-TIMESTAMP = 1694449777
-SHA256 (openssl-1.1.1w.tar.gz) = cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8
-SIZE (openssl-1.1.1w.tar.gz) = 9893384
diff --git a/security/openssl111/files/extra-patch-ktls b/security/openssl111/files/extra-patch-ktls
deleted file mode 100644
--- a/security/openssl111/files/extra-patch-ktls
+++ /dev/null
@@ -1,3435 +0,0 @@
-diff --git CHANGES CHANGES
-index a5522e5fa5..98961effc0 100644
---- CHANGES
-+++ CHANGES
-@@ -606,6 +606,11 @@
- necessary to configure just to create a source distribution.
- [Richard Levitte]
-
-+ *) Added support for Linux Kernel TLS data-path. The Linux Kernel data-path
-+ improves application performance by removing data copies and providing
-+ applications with zero-copy system calls such as sendfile and splice.
-+ [Boris Pismenny]
-+
- Changes between 1.1.1 and 1.1.1a [20 Nov 2018]
-
- *) Timing vulnerability in DSA signature generation
-diff --git Configure Configure
-index 4bea49d7da..e656814a7f 100755
---- Configure
-+++ Configure
-@@ -341,6 +341,7 @@ my @dtls = qw(dtls1 dtls1_2);
- # For developers: keep it sorted alphabetically
-
- my @disablables = (
-+ "ktls",
- "afalgeng",
- "aria",
- "asan",
-@@ -474,6 +475,7 @@ our %disabled = ( # "what" => "comment"
- "weak-ssl-ciphers" => "default",
- "zlib" => "default",
- "zlib-dynamic" => "default",
-+ "ktls" => "default",
- );
-
- # Note: => pair form used for aesthetics, not to truly make a hash table
-@@ -1583,6 +1585,33 @@ unless ($disabled{devcryptoeng}) {
- }
- }
-
-+unless ($disabled{ktls}) {
-+ $config{ktls}="";
-+ if ($target =~ m/^linux/) {
-+ my $usr = "/usr/$config{cross_compile_prefix}";
-+ chop($usr);
-+ if ($config{cross_compile_prefix} eq "") {
-+ $usr = "/usr";
-+ }
-+ my $minver = (4 << 16) + (13 << 8) + 0;
-+ my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
-+
-+ if ($verstr[2] < $minver) {
-+ disable('too-old-kernel', 'ktls');
-+ }
-+ } elsif ($target =~ m/^BSD/) {
-+ my $cc = $config{CROSS_COMPILE}.$config{CC};
-+ system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
-+ if ($? != 0) {
-+ disable('too-old-freebsd', 'ktls');
-+ }
-+ } else {
-+ disable('not-linux-or-freebsd', 'ktls');
-+ }
-+}
-+
-+push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
-+
- # Get the extra flags used when building shared libraries and modules. We
- # do this late because some of them depend on %disabled.
-
-diff --git INSTALL INSTALL
-index f3ac727183..f6f754fd5e 100644
---- INSTALL
-+++ INSTALL
-@@ -263,6 +263,15 @@
- Don't build the AFALG engine. This option will be forced if
- on a platform that does not support AFALG.
-
-+ enable-ktls
-+ Build with Kernel TLS support. This option will enable the
-+ use of the Kernel TLS data-path, which can improve
-+ performance and allow for the use of sendfile and splice
-+ system calls on TLS sockets. The Kernel may use TLS
-+ accelerators if any are available on the system.
-+ This option will be forced off on systems that do not support
-+ the Kernel TLS data-path.
-+
- enable-asan
- Build with the Address sanitiser. This is a developer option
- only. It may not work on all platforms and should never be
-diff --git apps/s_client.c apps/s_client.c
-index 00effc8037..5664e7e04e 100644
---- apps/s_client.c
-+++ apps/s_client.c
-@@ -3295,6 +3295,12 @@ static void print_stuff(BIO *bio, SSL *s, int full)
- BIO_printf(bio, "Expansion: %s\n",
- expansion ? SSL_COMP_get_name(expansion) : "NONE");
- #endif
-+#ifndef OPENSSL_NO_KTLS
-+ if (BIO_get_ktls_send(SSL_get_wbio(s)))
-+ BIO_printf(bio_err, "Using Kernel TLS for sending\n");
-+ if (BIO_get_ktls_recv(SSL_get_rbio(s)))
-+ BIO_printf(bio_err, "Using Kernel TLS for receiving\n");
-+#endif
-
- #ifdef SSL_DEBUG
- {
-diff --git apps/s_server.c apps/s_server.c
-index 64d53e68d0..9fcb8d7a7b 100644
---- apps/s_server.c
-+++ apps/s_server.c
-@@ -2934,6 +2934,12 @@ static void print_connection_info(SSL *con)
- }
- OPENSSL_free(exportedkeymat);
- }
-+#ifndef OPENSSL_NO_KTLS
-+ if (BIO_get_ktls_send(SSL_get_wbio(con)))
-+ BIO_printf(bio_err, "Using Kernel TLS for sending\n");
-+ if (BIO_get_ktls_recv(SSL_get_rbio(con)))
-+ BIO_printf(bio_err, "Using Kernel TLS for receiving\n");
-+#endif
-
- (void)BIO_flush(bio_s_out);
- }
-diff --git crypto/bio/b_sock2.c crypto/bio/b_sock2.c
-index 104ff31b0d..771729880e 100644
---- crypto/bio/b_sock2.c
-+++ crypto/bio/b_sock2.c
-@@ -12,6 +12,7 @@
- #include <errno.h>
-
- #include "bio_local.h"
-+#include "internal/ktls.h"
-
- #include <openssl/err.h>
-
-@@ -50,6 +51,17 @@ int BIO_socket(int domain, int socktype, int protocol, int options)
- BIOerr(BIO_F_BIO_SOCKET, BIO_R_UNABLE_TO_CREATE_SOCKET);
- return INVALID_SOCKET;
- }
-+# ifndef OPENSSL_NO_KTLS
-+ {
-+ /*
-+ * The new socket is created successfully regardless of ktls_enable.
-+ * ktls_enable doesn't change any functionality of the socket, except
-+ * changing the setsockopt to enable the processing of ktls_start.
-+ * Thus, it is not a problem to call it for non-TLS sockets.
-+ */
-+ ktls_enable(sock);
-+ }
-+# endif
-
- return sock;
- }
-diff --git crypto/bio/bss_conn.c crypto/bio/bss_conn.c
-index 807a82b23b..10cf20871c 100644
---- crypto/bio/bss_conn.c
-+++ crypto/bio/bss_conn.c
-@@ -11,6 +11,7 @@
- #include <errno.h>
-
- #include "bio_local.h"
-+#include "internal/ktls.h"
-
- #ifndef OPENSSL_NO_SOCK
-
-@@ -20,6 +21,9 @@ typedef struct bio_connect_st {
- char *param_hostname;
- char *param_service;
- int connect_mode;
-+# ifndef OPENSSL_NO_KTLS
-+ unsigned char record_type;
-+# endif
-
- BIO_ADDRINFO *addr_first;
- const BIO_ADDRINFO *addr_iter;
-@@ -320,7 +324,12 @@ static int conn_read(BIO *b, char *out, int outl)
-
- if (out != NULL) {
- clear_socket_error();
-- ret = readsocket(b->num, out, outl);
-+# ifndef OPENSSL_NO_KTLS
-+ if (BIO_get_ktls_recv(b))
-+ ret = ktls_read_record(b->num, out, outl);
-+ else
-+# endif
-+ ret = readsocket(b->num, out, outl);
- BIO_clear_retry_flags(b);
- if (ret <= 0) {
- if (BIO_sock_should_retry(ret))
-@@ -345,7 +354,16 @@ static int conn_write(BIO *b, const char *in, int inl)
- }
-
- clear_socket_error();
-- ret = writesocket(b->num, in, inl);
-+# ifndef OPENSSL_NO_KTLS
-+ if (BIO_should_ktls_ctrl_msg_flag(b)) {
-+ ret = ktls_send_ctrl_message(b->num, data->record_type, in, inl);
-+ if (ret >= 0) {
-+ ret = inl;
-+ BIO_clear_ktls_ctrl_msg_flag(b);
-+ }
-+ } else
-+# endif
-+ ret = writesocket(b->num, in, inl);
- BIO_clear_retry_flags(b);
- if (ret <= 0) {
- if (BIO_sock_should_retry(ret))
-@@ -361,6 +379,9 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
- const char **pptr = NULL;
- long ret = 1;
- BIO_CONNECT *data;
-+# ifndef OPENSSL_NO_KTLS
-+ ktls_crypto_info_t *crypto_info;
-+# endif
-
- data = (BIO_CONNECT *)b->ptr;
-
-@@ -518,8 +539,29 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
- }
- break;
- case BIO_CTRL_EOF:
-- ret = (b->flags & BIO_FLAGS_IN_EOF) != 0 ? 1 : 0;
-+ ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
- break;
-+# ifndef OPENSSL_NO_KTLS
-+ case BIO_CTRL_SET_KTLS:
-+ crypto_info = (ktls_crypto_info_t *)ptr;
-+ ret = ktls_start(b->num, crypto_info, num);
-+ if (ret)
-+ BIO_set_ktls_flag(b, num);
-+ break;
-+ case BIO_CTRL_GET_KTLS_SEND:
-+ return BIO_should_ktls_flag(b, 1) != 0;
-+ case BIO_CTRL_GET_KTLS_RECV:
-+ return BIO_should_ktls_flag(b, 0) != 0;
-+ case BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG:
-+ BIO_set_ktls_ctrl_msg_flag(b);
-+ data->record_type = num;
-+ ret = 0;
-+ break;
-+ case BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG:
-+ BIO_clear_ktls_ctrl_msg_flag(b);
-+ ret = 0;
-+ break;
-+# endif
- default:
- ret = 0;
- break;
-diff --git crypto/bio/bss_fd.c crypto/bio/bss_fd.c
-index ccbe1626ba..8d03e48ce9 100644
---- crypto/bio/bss_fd.c
-+++ crypto/bio/bss_fd.c
-@@ -189,7 +189,7 @@ static long fd_ctrl(BIO *b, int cmd, long num, void *ptr)
- ret = 1;
- break;
- case BIO_CTRL_EOF:
-- ret = (b->flags & BIO_FLAGS_IN_EOF) != 0 ? 1 : 0;
-+ ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
- break;
- default:
- ret = 0;
-diff --git crypto/bio/bss_sock.c crypto/bio/bss_sock.c
-index 6251f3d46a..8de1f58292 100644
---- crypto/bio/bss_sock.c
-+++ crypto/bio/bss_sock.c
-@@ -11,6 +11,7 @@
- #include <errno.h>
- #include "bio_local.h"
- #include "internal/cryptlib.h"
-+#include "internal/ktls.h"
-
- #ifndef OPENSSL_NO_SOCK
-
-@@ -64,6 +65,17 @@ BIO *BIO_new_socket(int fd, int close_flag)
- if (ret == NULL)
- return NULL;
- BIO_set_fd(ret, fd, close_flag);
-+# ifndef OPENSSL_NO_KTLS
-+ {
-+ /*
-+ * The new socket is created successfully regardless of ktls_enable.
-+ * ktls_enable doesn't change any functionality of the socket, except
-+ * changing the setsockopt to enable the processing of ktls_start.
-+ * Thus, it is not a problem to call it for non-TLS sockets.
-+ */
-+ ktls_enable(fd);
-+ }
-+# endif
- return ret;
- }
-
-@@ -96,7 +108,12 @@ static int sock_read(BIO *b, char *out, int outl)
-
- if (out != NULL) {
- clear_socket_error();
-- ret = readsocket(b->num, out, outl);
-+# ifndef OPENSSL_NO_KTLS
-+ if (BIO_get_ktls_recv(b))
-+ ret = ktls_read_record(b->num, out, outl);
-+ else
-+# endif
-+ ret = readsocket(b->num, out, outl);
- BIO_clear_retry_flags(b);
- if (ret <= 0) {
- if (BIO_sock_should_retry(ret))
-@@ -110,10 +127,20 @@ static int sock_read(BIO *b, char *out, int outl)
-
- static int sock_write(BIO *b, const char *in, int inl)
- {
-- int ret;
-+ int ret = 0;
-
- clear_socket_error();
-- ret = writesocket(b->num, in, inl);
-+# ifndef OPENSSL_NO_KTLS
-+ if (BIO_should_ktls_ctrl_msg_flag(b)) {
-+ unsigned char record_type = (intptr_t)b->ptr;
-+ ret = ktls_send_ctrl_message(b->num, record_type, in, inl);
-+ if (ret >= 0) {
-+ ret = inl;
-+ BIO_clear_ktls_ctrl_msg_flag(b);
-+ }
-+ } else
-+# endif
-+ ret = writesocket(b->num, in, inl);
- BIO_clear_retry_flags(b);
- if (ret <= 0) {
- if (BIO_sock_should_retry(ret))
-@@ -126,6 +153,9 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr)
- {
- long ret = 1;
- int *ip;
-+# ifndef OPENSSL_NO_KTLS
-+ ktls_crypto_info_t *crypto_info;
-+# endif
-
- switch (cmd) {
- case BIO_C_SET_FD:
-@@ -153,8 +183,29 @@ static long sock_ctrl(BIO *b, int cmd, long num, void *ptr)
- case BIO_CTRL_FLUSH:
- ret = 1;
- break;
-+# ifndef OPENSSL_NO_KTLS
-+ case BIO_CTRL_SET_KTLS:
-+ crypto_info = (ktls_crypto_info_t *)ptr;
-+ ret = ktls_start(b->num, crypto_info, num);
-+ if (ret)
-+ BIO_set_ktls_flag(b, num);
-+ break;
-+ case BIO_CTRL_GET_KTLS_SEND:
-+ return BIO_should_ktls_flag(b, 1) != 0;
-+ case BIO_CTRL_GET_KTLS_RECV:
-+ return BIO_should_ktls_flag(b, 0) != 0;
-+ case BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG:
-+ BIO_set_ktls_ctrl_msg_flag(b);
-+ b->ptr = (void *)num;
-+ ret = 0;
-+ break;
-+ case BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG:
-+ BIO_clear_ktls_ctrl_msg_flag(b);
-+ ret = 0;
-+ break;
-+# endif
- case BIO_CTRL_EOF:
-- ret = (b->flags & BIO_FLAGS_IN_EOF) != 0 ? 1 : 0;
-+ ret = (b->flags & BIO_FLAGS_IN_EOF) != 0;
- break;
- default:
- ret = 0;
-diff --git crypto/err/openssl.txt crypto/err/openssl.txt
-index 902e97b843..846c896359 100644
---- crypto/err/openssl.txt
-+++ crypto/err/openssl.txt
-@@ -1319,6 +1319,7 @@ SSL_F_SSL_RENEGOTIATE:516:SSL_renegotiate
- SSL_F_SSL_RENEGOTIATE_ABBREVIATED:546:SSL_renegotiate_abbreviated
- SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT:320:*
- SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT:321:*
-+SSL_F_SSL_SENDFILE:639:SSL_sendfile
- SSL_F_SSL_SESSION_DUP:348:ssl_session_dup
- SSL_F_SSL_SESSION_NEW:189:SSL_SESSION_new
- SSL_F_SSL_SESSION_PRINT_FP:190:SSL_SESSION_print_fp
-diff --git crypto/evp/e_aes.c crypto/evp/e_aes.c
-index a1d3ab90fa..715fac9f88 100644
---- crypto/evp/e_aes.c
-+++ crypto/evp/e_aes.c
-@@ -2889,6 +2889,14 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr)
- memcpy(ptr, c->buf, arg);
- return 1;
-
-+ case EVP_CTRL_GET_IV:
-+ if (gctx->iv_gen != 1)
-+ return 0;
-+ if (gctx->ivlen != arg)
-+ return 0;
-+ memcpy(ptr, gctx->iv, arg);
-+ return 1;
-+
- case EVP_CTRL_GCM_SET_IV_FIXED:
- /* Special case: -1 length restores whole IV */
- if (arg == -1) {
-diff --git doc/man3/BIO_ctrl.pod doc/man3/BIO_ctrl.pod
-index cf6ba135df..fc51173c8d 100644
---- doc/man3/BIO_ctrl.pod
-+++ doc/man3/BIO_ctrl.pod
-@@ -5,7 +5,8 @@
- BIO_ctrl, BIO_callback_ctrl, BIO_ptr_ctrl, BIO_int_ctrl, BIO_reset,
- BIO_seek, BIO_tell, BIO_flush, BIO_eof, BIO_set_close, BIO_get_close,
- BIO_pending, BIO_wpending, BIO_ctrl_pending, BIO_ctrl_wpending,
--BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb
-+BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb, BIO_get_ktls_send,
-+BIO_get_ktls_recv
- - BIO control operations
-
- =head1 SYNOPSIS
-@@ -34,6 +35,9 @@ BIO_get_info_callback, BIO_set_info_callback, BIO_info_cb
- int BIO_get_info_callback(BIO *b, BIO_info_cb **cbp);
- int BIO_set_info_callback(BIO *b, BIO_info_cb *cb);
-
-+ int BIO_get_ktls_send(BIO *b);
-+ int BIO_get_ktls_recv(BIO *b);
-+
- =head1 DESCRIPTION
-
- BIO_ctrl(), BIO_callback_ctrl(), BIO_ptr_ctrl() and BIO_int_ctrl()
-@@ -72,6 +76,11 @@ Not all BIOs support these calls. BIO_ctrl_pending() and BIO_ctrl_wpending()
- return a size_t type and are functions, BIO_pending() and BIO_wpending() are
- macros which call BIO_ctrl().
-
-+BIO_get_ktls_send() returns 1 if the BIO is using the Kernel TLS data-path for
-+sending. Otherwise, it returns zero.
-+BIO_get_ktls_recv() returns 1 if the BIO is using the Kernel TLS data-path for
-+receiving. Otherwise, it returns zero.
-+
- =head1 RETURN VALUES
-
- BIO_reset() normally returns 1 for success and 0 or -1 for failure. File
-@@ -92,6 +101,11 @@ BIO_get_close() returns the close flag value: BIO_CLOSE or BIO_NOCLOSE.
- BIO_pending(), BIO_ctrl_pending(), BIO_wpending() and BIO_ctrl_wpending()
- return the amount of pending data.
-
-+BIO_get_ktls_send() returns 1 if the BIO is using the Kernel TLS data-path for
-+sending. Otherwise, it returns zero.
-+BIO_get_ktls_recv() returns 1 if the BIO is using the Kernel TLS data-path for
-+receiving. Otherwise, it returns zero.
-+
- =head1 NOTES
-
- BIO_flush(), because it can write data may return 0 or -1 indicating
-@@ -124,6 +138,11 @@ particular a return value of 0 can be returned if an operation is not
- supported, if an error occurred, if EOF has not been reached and in
- the case of BIO_seek() on a file BIO for a successful operation.
-
-+=head1 HISTORY
-+
-+The BIO_get_ktls_send() and BIO_get_ktls_recv() functions were added in
-+OpenSSL 3.0.0.
-+
- =head1 COPYRIGHT
-
- Copyright 2000-2022 The OpenSSL Project Authors. All Rights Reserved.
-diff --git doc/man3/SSL_CONF_cmd.pod doc/man3/SSL_CONF_cmd.pod
-index 7f0e088687..c7cce5486b 100644
---- doc/man3/SSL_CONF_cmd.pod
-+++ doc/man3/SSL_CONF_cmd.pod
-@@ -495,6 +495,10 @@ specification. Some applications may be able to mitigate the replay risks in
- other ways and in such cases the built-in OpenSSL functionality is not required.
- Disabling anti-replay is equivalent to setting B<SSL_OP_NO_ANTI_REPLAY>.
-
-+B<KTLS>: Enables kernel TLS if support has been compiled in, and it is supported
-+by the negotiated ciphersuites and extensions. Equivalent to
-+B<SSL_OP_ENABLE_KTLS>.
-+
- =item B<VerifyMode>
-
- The B<value> argument is a comma separated list of flags to set.
-diff --git doc/man3/SSL_CTX_set_options.pod doc/man3/SSL_CTX_set_options.pod
-index 969e0366c4..231fe92d8e 100644
---- doc/man3/SSL_CTX_set_options.pod
-+++ doc/man3/SSL_CTX_set_options.pod
-@@ -237,6 +237,29 @@ functionality is not required. Those applications can turn this feature off by
- setting this option. This is a server-side opton only. It is ignored by
- clients.
-
-+=item SSL_OP_ENABLE_KTLS
-+
-+Enable the use of kernel TLS. In order to benefit from kernel TLS OpenSSL must
-+have been compiled with support for it, and it must be supported by the
-+negotiated ciphersuites and extensions. The specific ciphersuites and extensions
-+that are supported may vary by platform and kernel version.
-+
-+The kernel TLS data-path implements the record layer, and the encryption
-+algorithm. The kernel will utilize the best hardware
-+available for encryption. Using the kernel data-path should reduce the memory
-+footprint of OpenSSL because no buffering is required. Also, the throughput
-+should improve because data copy is avoided when user data is encrypted into
-+kernel memory instead of the usual encrypt then copy to kernel.
-+
-+Kernel TLS might not support all the features of OpenSSL. For instance,
-+renegotiation, and setting the maximum fragment size is not possible as of
-+Linux 4.20.
-+
-+Note that with kernel TLS enabled some cryptographic operations are performed
-+by the kernel directly and not via any available OpenSSL Providers. This might
-+be undesirable if, for example, the application requires all cryptographic
-+operations to be performed by the FIPS provider.
-+
- =back
-
- The following options no longer have any effect but their identifiers are
-diff --git doc/man3/SSL_CTX_set_record_padding_callback.pod doc/man3/SSL_CTX_set_record_padding_callback.pod
-index 13e56f0c57..247a39fc03 100644
---- doc/man3/SSL_CTX_set_record_padding_callback.pod
-+++ doc/man3/SSL_CTX_set_record_padding_callback.pod
-@@ -16,7 +16,7 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
- #include <openssl/ssl.h>
-
- void SSL_CTX_set_record_padding_callback(SSL_CTX *ctx, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
-- void SSL_set_record_padding_callback(SSL *ssl, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
-+ int SSL_set_record_padding_callback(SSL *ssl, size_t (*cb)(SSL *s, int type, size_t len, void *arg));
-
- void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);
- void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx);
-@@ -32,6 +32,8 @@ SSL_set_block_padding - install callback to specify TLS 1.3 record padding
- SSL_CTX_set_record_padding_callback() or SSL_set_record_padding_callback()
- can be used to assign a callback function I<cb> to specify the padding
- for TLS 1.3 records. The value set in B<ctx> is copied to a new SSL by SSL_new().
-+Kernel TLS is not possible if the record padding callback is set, and the callback
-+function cannot be set if Kernel TLS is already configured for the current SSL object.
-
- SSL_CTX_set_record_padding_callback_arg() and SSL_set_record_padding_callback_arg()
- assign a value B<arg> that is passed to the callback when it is invoked. The value
-@@ -64,6 +66,9 @@ indicates no padding will be added. A return value that causes the record to
- exceed the maximum record size (SSL3_RT_MAX_PLAIN_LENGTH) will pad out to the
- maximum record size.
-
-+The SSL_CTX_get_record_padding_callback_arg() function returns 1 on success or 0 if
-+the callback function is not set because Kernel TLS is configured for the SSL object.
-+
- =head1 NOTES
-
- The default behavior is to add no padding to the record.
-@@ -84,6 +89,9 @@ L<ssl(7)>, L<SSL_new(3)>
-
- The record padding API was added for TLS 1.3 support in OpenSSL 1.1.1.
-
-+The return type of SSL_CTX_set_record_padding_callback() function was
-+changed to int in OpenSSL 3.0.
-+
- =head1 COPYRIGHT
-
- Copyright 2017-2019 The OpenSSL Project Authors. All Rights Reserved.
-diff --git doc/man3/SSL_write.pod doc/man3/SSL_write.pod
-index 5e3ce1e7e4..9b271d8e65 100644
---- doc/man3/SSL_write.pod
-+++ doc/man3/SSL_write.pod
-@@ -2,12 +2,13 @@
-
- =head1 NAME
-
--SSL_write_ex, SSL_write - write bytes to a TLS/SSL connection
-+SSL_write_ex, SSL_write, SSL_sendfile - write bytes to a TLS/SSL connection
-
- =head1 SYNOPSIS
-
- #include <openssl/ssl.h>
-
-+ ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags);
- int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written);
- int SSL_write(SSL *ssl, const void *buf, int num);
-
-@@ -17,6 +18,14 @@ SSL_write_ex() and SSL_write() write B<num> bytes from the buffer B<buf> into
- the specified B<ssl> connection. On success SSL_write_ex() will store the number
- of bytes written in B<*written>.
-
-+SSL_sendfile() writes B<size> bytes from offset B<offset> in the file
-+descriptor B<fd> to the specified SSL connection B<s>. This function provides
-+efficient zero-copy semantics. SSL_sendfile() is available only when
-+Kernel TLS is enabled, which can be checked by calling BIO_get_ktls_send().
-+It is provided here to allow users to maintain the same interface.
-+The meaning of B<flags> is platform dependent.
-+Currently, under Linux it is ignored.
-+
- =head1 NOTES
-
- In the paragraphs below a "write function" is defined as one of either
-@@ -104,17 +113,36 @@ You should instead call SSL_get_error() to find out if it's retryable.
-
- =back
-
-+For SSL_sendfile(), the following return values can occur:
-+
-+=over 4
-+
-+=item Z<>>= 0
-+
-+The write operation was successful, the return value is the number
-+of bytes of the file written to the TLS/SSL connection. The return
-+value can be less than B<size> for a partial write.
-+
-+=item E<lt> 0
-+
-+The write operation was not successful, because either the connection was
-+closed, an error occured or action must be taken by the calling process.
-+Call SSL_get_error() with the return value to find out the reason.
-+
-+=back
-+
- =head1 SEE ALSO
-
- L<SSL_get_error(3)>, L<SSL_read_ex(3)>, L<SSL_read(3)>
- L<SSL_CTX_set_mode(3)>, L<SSL_CTX_new(3)>,
- L<SSL_connect(3)>, L<SSL_accept(3)>
--L<SSL_set_connect_state(3)>,
-+L<SSL_set_connect_state(3)>, L<BIO_ctrl(3)>,
- L<ssl(7)>, L<bio(7)>
-
- =head1 HISTORY
-
- The SSL_write_ex() function was added in OpenSSL 1.1.1.
-+The SSL_sendfile() function was added in OpenSSL 3.0.0.
-
- =head1 COPYRIGHT
-
-diff --git engines/e_afalg.c engines/e_afalg.c
-index 2d16c13834..748969204e 100644
---- engines/e_afalg.c
-+++ engines/e_afalg.c
-@@ -407,7 +407,7 @@ static int afalg_start_cipher_sk(afalg_ctx *actx, const unsigned char *in,
- size_t inl, const unsigned char *iv,
- unsigned int enc)
- {
-- struct msghdr msg = { 0 };
-+ struct msghdr msg;
- struct cmsghdr *cmsg;
- struct iovec iov;
- ssize_t sbytes;
-@@ -416,6 +416,7 @@ static int afalg_start_cipher_sk(afalg_ctx *actx, const unsigned char *in,
- # endif
- char cbuf[CMSG_SPACE(ALG_IV_LEN(ALG_AES_IV_LEN)) + CMSG_SPACE(ALG_OP_LEN)];
-
-+ memset(&msg, 0, sizeof(msg));
- memset(cbuf, 0, sizeof(cbuf));
- msg.msg_control = cbuf;
- msg.msg_controllen = sizeof(cbuf);
-diff --git include/internal/bio.h include/internal/bio.h
-index c343b27629..365d41dabb 100644
---- include/internal/bio.h
-+++ include/internal/bio.h
-@@ -7,6 +7,9 @@
- * https://www.openssl.org/source/license.html
- */
-
-+#ifndef HEADER_INTERNAL_BIO_H
-+# define HEADER_INTERNAL_BIO_H
-+
- #include <openssl/bio.h>
-
- struct bio_method_st {
-@@ -31,3 +34,39 @@ void bio_cleanup(void);
- /* Old style to new style BIO_METHOD conversion functions */
- int bwrite_conv(BIO *bio, const char *data, size_t datal, size_t *written);
- int bread_conv(BIO *bio, char *data, size_t datal, size_t *read);
-+
-+/* Changes to these internal BIOs must also update include/openssl/bio.h */
-+# define BIO_CTRL_SET_KTLS 72
-+# define BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG 74
-+# define BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG 75
-+
-+/*
-+ * This is used with socket BIOs:
-+ * BIO_FLAGS_KTLS_TX means we are using ktls with this BIO for sending.
-+ * BIO_FLAGS_KTLS_TX_CTRL_MSG means we are about to send a ctrl message next.
-+ * BIO_FLAGS_KTLS_RX means we are using ktls with this BIO for receiving.
-+ */
-+# define BIO_FLAGS_KTLS_TX_CTRL_MSG 0x1000
-+# define BIO_FLAGS_KTLS_RX 0x2000
-+# define BIO_FLAGS_KTLS_TX 0x4000
-+
-+/* KTLS related controls and flags */
-+# define BIO_set_ktls_flag(b, is_tx) \
-+ BIO_set_flags(b, (is_tx) ? BIO_FLAGS_KTLS_TX : BIO_FLAGS_KTLS_RX)
-+# define BIO_should_ktls_flag(b, is_tx) \
-+ BIO_test_flags(b, (is_tx) ? BIO_FLAGS_KTLS_TX : BIO_FLAGS_KTLS_RX)
-+# define BIO_set_ktls_ctrl_msg_flag(b) \
-+ BIO_set_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG)
-+# define BIO_should_ktls_ctrl_msg_flag(b) \
-+ BIO_test_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG)
-+# define BIO_clear_ktls_ctrl_msg_flag(b) \
-+ BIO_clear_flags(b, BIO_FLAGS_KTLS_TX_CTRL_MSG)
-+
-+# define BIO_set_ktls(b, keyblob, is_tx) \
-+ BIO_ctrl(b, BIO_CTRL_SET_KTLS, is_tx, keyblob)
-+# define BIO_set_ktls_ctrl_msg(b, record_type) \
-+ BIO_ctrl(b, BIO_CTRL_SET_KTLS_TX_SEND_CTRL_MSG, record_type, NULL)
-+# define BIO_clear_ktls_ctrl_msg(b) \
-+ BIO_ctrl(b, BIO_CTRL_CLEAR_KTLS_TX_CTRL_MSG, 0, NULL)
-+
-+#endif
-diff --git include/internal/ktls.h include/internal/ktls.h
-new file mode 100644
-index 0000000000..5f9e3f91ed
---- /dev/null
-+++ include/internal/ktls.h
-@@ -0,0 +1,407 @@
-+/*
-+ * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
-+ *
-+ * Licensed under the Apache License 2.0 (the "License"). You may not use
-+ * this file except in compliance with the License. You can obtain a copy
-+ * in the file LICENSE in the source distribution or at
-+ * https://www.openssl.org/source/license.html
-+ */
-+
-+#if defined(OPENSSL_SYS_LINUX)
-+# ifndef OPENSSL_NO_KTLS
-+# include <linux/version.h>
-+# if LINUX_VERSION_CODE < KERNEL_VERSION(4, 13, 0)
-+# define OPENSSL_NO_KTLS
-+# ifndef PEDANTIC
-+# warning "KTLS requires Kernel Headers >= 4.13.0"
-+# warning "Skipping Compilation of KTLS"
-+# endif
-+# endif
-+# endif
-+#endif
-+
-+#ifndef HEADER_INTERNAL_KTLS
-+# define HEADER_INTERNAL_KTLS
-+# ifndef OPENSSL_NO_KTLS
-+
-+# if defined(__FreeBSD__)
-+# include <sys/types.h>
-+# include <sys/socket.h>
-+# include <sys/ktls.h>
-+# include <netinet/in.h>
-+# include <netinet/tcp.h>
-+# include "openssl/ssl3.h"
-+
-+# ifndef TCP_RXTLS_ENABLE
-+# define OPENSSL_NO_KTLS_RX
-+# endif
-+# define OPENSSL_KTLS_AES_GCM_128
-+# define OPENSSL_KTLS_AES_GCM_256
-+# define OPENSSL_KTLS_TLS13
-+# ifdef TLS_CHACHA20_IV_LEN
-+# ifndef OPENSSL_NO_CHACHA
-+# define OPENSSL_KTLS_CHACHA20_POLY1305
-+# endif
-+# endif
-+
-+typedef struct tls_enable ktls_crypto_info_t;
-+
-+/*
-+ * FreeBSD does not require any additional steps to enable KTLS before
-+ * setting keys.
-+ */
-+static ossl_inline int ktls_enable(int fd)
-+{
-+ return 1;
-+}
-+
-+/*
-+ * The TCP_TXTLS_ENABLE socket option marks the outgoing socket buffer
-+ * as using TLS. If successful, then data sent using this socket will
-+ * be encrypted and encapsulated in TLS records using the tls_en
-+ * provided here.
-+ *
-+ * The TCP_RXTLS_ENABLE socket option marks the incoming socket buffer
-+ * as using TLS. If successful, then data received for this socket will
-+ * be authenticated and decrypted using the tls_en provided here.
-+ */
-+static ossl_inline int ktls_start(int fd, ktls_crypto_info_t *tls_en, int is_tx)
-+{
-+ if (is_tx)
-+ return setsockopt(fd, IPPROTO_TCP, TCP_TXTLS_ENABLE,
-+ tls_en, sizeof(*tls_en)) ? 0 : 1;
-+# ifndef OPENSSL_NO_KTLS_RX
-+ return setsockopt(fd, IPPROTO_TCP, TCP_RXTLS_ENABLE, tls_en,
-+ sizeof(*tls_en)) ? 0 : 1;
-+# else
-+ return 0;
-+# endif
-+}
-+
-+/*
-+ * Send a TLS record using the tls_en provided in ktls_start and use
-+ * record_type instead of the default SSL3_RT_APPLICATION_DATA.
-+ * When the socket is non-blocking, then this call either returns EAGAIN or
-+ * the entire record is pushed to TCP. It is impossible to send a partial
-+ * record using this control message.
-+ */
-+static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type,
-+ const void *data, size_t length)
-+{
-+ struct msghdr msg = { 0 };
-+ int cmsg_len = sizeof(record_type);
-+ struct cmsghdr *cmsg;
-+ char buf[CMSG_SPACE(cmsg_len)];
-+ struct iovec msg_iov; /* Vector of data to send/receive into */
-+
-+ msg.msg_control = buf;
-+ msg.msg_controllen = sizeof(buf);
-+ cmsg = CMSG_FIRSTHDR(&msg);
-+ cmsg->cmsg_level = IPPROTO_TCP;
-+ cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
-+ cmsg->cmsg_len = CMSG_LEN(cmsg_len);
-+ *((unsigned char *)CMSG_DATA(cmsg)) = record_type;
-+ msg.msg_controllen = cmsg->cmsg_len;
-+
-+ msg_iov.iov_base = (void *)data;
-+ msg_iov.iov_len = length;
-+ msg.msg_iov = &msg_iov;
-+ msg.msg_iovlen = 1;
-+
-+ return sendmsg(fd, &msg, 0);
-+}
-+
-+# ifdef OPENSSL_NO_KTLS_RX
-+
-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
-+{
-+ return -1;
-+}
-+
-+# else /* !defined(OPENSSL_NO_KTLS_RX) */
-+
-+/*
-+ * Receive a TLS record using the tls_en provided in ktls_start. The
-+ * kernel strips any explicit IV and authentication tag, but provides
-+ * the TLS record header via a control message. If there is an error
-+ * with the TLS record such as an invalid header, invalid padding, or
-+ * authentication failure recvmsg() will fail with an error.
-+ */
-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
-+{
-+ struct msghdr msg = { 0 };
-+ int cmsg_len = sizeof(struct tls_get_record);
-+ struct tls_get_record *tgr;
-+ struct cmsghdr *cmsg;
-+ char buf[CMSG_SPACE(cmsg_len)];
-+ struct iovec msg_iov; /* Vector of data to send/receive into */
-+ int ret;
-+ unsigned char *p = data;
-+ const size_t prepend_length = SSL3_RT_HEADER_LENGTH;
-+
-+ if (length <= prepend_length) {
-+ errno = EINVAL;
-+ return -1;
-+ }
-+
-+ msg.msg_control = buf;
-+ msg.msg_controllen = sizeof(buf);
-+
-+ msg_iov.iov_base = p + prepend_length;
-+ msg_iov.iov_len = length - prepend_length;
-+ msg.msg_iov = &msg_iov;
-+ msg.msg_iovlen = 1;
-+
-+ ret = recvmsg(fd, &msg, 0);
-+ if (ret <= 0)
-+ return ret;
-+
-+ if ((msg.msg_flags & (MSG_EOR | MSG_CTRUNC)) != MSG_EOR) {
-+ errno = EMSGSIZE;
-+ return -1;
-+ }
-+
-+ if (msg.msg_controllen == 0) {
-+ errno = EBADMSG;
-+ return -1;
-+ }
-+
-+ cmsg = CMSG_FIRSTHDR(&msg);
-+ if (cmsg->cmsg_level != IPPROTO_TCP || cmsg->cmsg_type != TLS_GET_RECORD
-+ || cmsg->cmsg_len != CMSG_LEN(cmsg_len)) {
-+ errno = EBADMSG;
-+ return -1;
-+ }
-+
-+ tgr = (struct tls_get_record *)CMSG_DATA(cmsg);
-+ p[0] = tgr->tls_type;
-+ p[1] = tgr->tls_vmajor;
-+ p[2] = tgr->tls_vminor;
-+ *(uint16_t *)(p + 3) = htons(ret);
-+
-+ return ret + prepend_length;
-+}
-+
-+# endif /* OPENSSL_NO_KTLS_RX */
-+
-+/*
-+ * KTLS enables the sendfile system call to send data from a file over
-+ * TLS.
-+ */
-+static ossl_inline ossl_ssize_t ktls_sendfile(int s, int fd, off_t off,
-+ size_t size, int flags)
-+{
-+ off_t sbytes = 0;
-+ int ret;
-+
-+ ret = sendfile(fd, s, off, size, NULL, &sbytes, flags);
-+ if (ret == -1 && sbytes == 0)
-+ return -1;
-+ return sbytes;
-+}
-+
-+# endif /* __FreeBSD__ */
-+
-+# if defined(OPENSSL_SYS_LINUX)
-+
-+# include <linux/tls.h>
-+# if LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0)
-+# define OPENSSL_NO_KTLS_RX
-+# ifndef PEDANTIC
-+# warning "KTLS requires Kernel Headers >= 4.17.0 for receiving"
-+# warning "Skipping Compilation of KTLS receive data path"
-+# endif
-+# endif
-+# define OPENSSL_KTLS_AES_GCM_128
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0)
-+# define OPENSSL_KTLS_AES_GCM_256
-+# define OPENSSL_KTLS_TLS13
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 2, 0)
-+# define OPENSSL_KTLS_AES_CCM_128
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
-+# ifndef OPENSSL_NO_CHACHA
-+# define OPENSSL_KTLS_CHACHA20_POLY1305
-+# endif
-+# endif
-+# endif
-+# endif
-+
-+# include <sys/sendfile.h>
-+# include <netinet/tcp.h>
-+# include <linux/socket.h>
-+# include "openssl/ssl3.h"
-+# include "openssl/tls1.h"
-+# include "openssl/evp.h"
-+
-+# ifndef SOL_TLS
-+# define SOL_TLS 282
-+# endif
-+
-+# ifndef TCP_ULP
-+# define TCP_ULP 31
-+# endif
-+
-+# ifndef TLS_RX
-+# define TLS_RX 2
-+# endif
-+
-+struct tls_crypto_info_all {
-+ union {
-+# ifdef OPENSSL_KTLS_AES_GCM_128
-+ struct tls12_crypto_info_aes_gcm_128 gcm128;
-+# endif
-+# ifdef OPENSSL_KTLS_AES_GCM_256
-+ struct tls12_crypto_info_aes_gcm_256 gcm256;
-+# endif
-+# ifdef OPENSSL_KTLS_AES_CCM_128
-+ struct tls12_crypto_info_aes_ccm_128 ccm128;
-+# endif
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ struct tls12_crypto_info_chacha20_poly1305 chacha20poly1305;
-+# endif
-+ };
-+ size_t tls_crypto_info_len;
-+};
-+
-+typedef struct tls_crypto_info_all ktls_crypto_info_t;
-+
-+/*
-+ * When successful, this socket option doesn't change the behaviour of the
-+ * TCP socket, except changing the TCP setsockopt handler to enable the
-+ * processing of SOL_TLS socket options. All other functionality remains the
-+ * same.
-+ */
-+static ossl_inline int ktls_enable(int fd)
-+{
-+ return setsockopt(fd, SOL_TCP, TCP_ULP, "tls", sizeof("tls")) ? 0 : 1;
-+}
-+
-+/*
-+ * The TLS_TX socket option changes the send/sendmsg handlers of the TCP socket.
-+ * If successful, then data sent using this socket will be encrypted and
-+ * encapsulated in TLS records using the crypto_info provided here.
-+ * The TLS_RX socket option changes the recv/recvmsg handlers of the TCP socket.
-+ * If successful, then data received using this socket will be decrypted,
-+ * authenticated and decapsulated using the crypto_info provided here.
-+ */
-+static ossl_inline int ktls_start(int fd, ktls_crypto_info_t *crypto_info,
-+ int is_tx)
-+{
-+ return setsockopt(fd, SOL_TLS, is_tx ? TLS_TX : TLS_RX,
-+ crypto_info, crypto_info->tls_crypto_info_len) ? 0 : 1;
-+}
-+
-+/*
-+ * Send a TLS record using the crypto_info provided in ktls_start and use
-+ * record_type instead of the default SSL3_RT_APPLICATION_DATA.
-+ * When the socket is non-blocking, then this call either returns EAGAIN or
-+ * the entire record is pushed to TCP. It is impossible to send a partial
-+ * record using this control message.
-+ */
-+static ossl_inline int ktls_send_ctrl_message(int fd, unsigned char record_type,
-+ const void *data, size_t length)
-+{
-+ struct msghdr msg;
-+ int cmsg_len = sizeof(record_type);
-+ struct cmsghdr *cmsg;
-+ union {
-+ struct cmsghdr hdr;
-+ char buf[CMSG_SPACE(sizeof(unsigned char))];
-+ } cmsgbuf;
-+ struct iovec msg_iov; /* Vector of data to send/receive into */
-+
-+ memset(&msg, 0, sizeof(msg));
-+ msg.msg_control = cmsgbuf.buf;
-+ msg.msg_controllen = sizeof(cmsgbuf.buf);
-+ cmsg = CMSG_FIRSTHDR(&msg);
-+ cmsg->cmsg_level = SOL_TLS;
-+ cmsg->cmsg_type = TLS_SET_RECORD_TYPE;
-+ cmsg->cmsg_len = CMSG_LEN(cmsg_len);
-+ *((unsigned char *)CMSG_DATA(cmsg)) = record_type;
-+ msg.msg_controllen = cmsg->cmsg_len;
-+
-+ msg_iov.iov_base = (void *)data;
-+ msg_iov.iov_len = length;
-+ msg.msg_iov = &msg_iov;
-+ msg.msg_iovlen = 1;
-+
-+ return sendmsg(fd, &msg, 0);
-+}
-+
-+/*
-+ * KTLS enables the sendfile system call to send data from a file over TLS.
-+ * @flags are ignored on Linux. (placeholder for FreeBSD sendfile)
-+ * */
-+static ossl_inline ossl_ssize_t ktls_sendfile(int s, int fd, off_t off, size_t size, int flags)
-+{
-+ return sendfile(s, fd, &off, size);
-+}
-+
-+# ifdef OPENSSL_NO_KTLS_RX
-+
-+
-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
-+{
-+ return -1;
-+}
-+
-+# else /* !defined(OPENSSL_NO_KTLS_RX) */
-+
-+/*
-+ * Receive a TLS record using the crypto_info provided in ktls_start.
-+ * The kernel strips the TLS record header, IV and authentication tag,
-+ * returning only the plaintext data or an error on failure.
-+ * We add the TLS record header here to satisfy routines in rec_layer_s3.c
-+ */
-+static ossl_inline int ktls_read_record(int fd, void *data, size_t length)
-+{
-+ struct msghdr msg;
-+ struct cmsghdr *cmsg;
-+ union {
-+ struct cmsghdr hdr;
-+ char buf[CMSG_SPACE(sizeof(unsigned char))];
-+ } cmsgbuf;
-+ struct iovec msg_iov;
-+ int ret;
-+ unsigned char *p = data;
-+ const size_t prepend_length = SSL3_RT_HEADER_LENGTH;
-+
-+ if (length < prepend_length + EVP_GCM_TLS_TAG_LEN) {
-+ errno = EINVAL;
-+ return -1;
-+ }
-+
-+ memset(&msg, 0, sizeof(msg));
-+ msg.msg_control = cmsgbuf.buf;
-+ msg.msg_controllen = sizeof(cmsgbuf.buf);
-+
-+ msg_iov.iov_base = p + prepend_length;
-+ msg_iov.iov_len = length - prepend_length - EVP_GCM_TLS_TAG_LEN;
-+ msg.msg_iov = &msg_iov;
-+ msg.msg_iovlen = 1;
-+
-+ ret = recvmsg(fd, &msg, 0);
-+ if (ret < 0)
-+ return ret;
-+
-+ if (msg.msg_controllen > 0) {
-+ cmsg = CMSG_FIRSTHDR(&msg);
-+ if (cmsg->cmsg_type == TLS_GET_RECORD_TYPE) {
-+ p[0] = *((unsigned char *)CMSG_DATA(cmsg));
-+ p[1] = TLS1_2_VERSION_MAJOR;
-+ p[2] = TLS1_2_VERSION_MINOR;
-+ /* returned length is limited to msg_iov.iov_len above */
-+ p[3] = (ret >> 8) & 0xff;
-+ p[4] = ret & 0xff;
-+ ret += prepend_length;
-+ }
-+ }
-+
-+ return ret;
-+}
-+
-+# endif /* OPENSSL_NO_KTLS_RX */
-+
-+# endif /* OPENSSL_SYS_LINUX */
-+# endif /* OPENSSL_NO_KTLS */
-+#endif /* HEADER_INTERNAL_KTLS */
-diff --git include/openssl/bio.h include/openssl/bio.h
-index ae559a5105..66fc0d7c4a 100644
---- include/openssl/bio.h
-+++ include/openssl/bio.h
-@@ -141,6 +141,26 @@ extern "C" {
-
- # define BIO_CTRL_DGRAM_SET_PEEK_MODE 71
-
-+/*
-+ * internal BIO see include/internal/bio.h:
-+ * # define BIO_CTRL_SET_KTLS_SEND 72
-+ * # define BIO_CTRL_SET_KTLS_SEND_CTRL_MSG 74
-+ * # define BIO_CTRL_CLEAR_KTLS_CTRL_MSG 75
-+ */
-+
-+# define BIO_CTRL_GET_KTLS_SEND 73
-+# define BIO_CTRL_GET_KTLS_RECV 76
-+
-+# ifndef OPENSSL_NO_KTLS
-+# define BIO_get_ktls_send(b) \
-+ BIO_ctrl(b, BIO_CTRL_GET_KTLS_SEND, 0, NULL)
-+# define BIO_get_ktls_recv(b) \
-+ BIO_ctrl(b, BIO_CTRL_GET_KTLS_RECV, 0, NULL)
-+# else
-+# define BIO_get_ktls_send(b) (0)
-+# define BIO_get_ktls_recv(b) (0)
-+# endif
-+
- /* modifiers */
- # define BIO_FP_READ 0x02
- # define BIO_FP_WRITE 0x04
-@@ -171,6 +191,8 @@ extern "C" {
- # define BIO_FLAGS_NONCLEAR_RST 0x400
- # define BIO_FLAGS_IN_EOF 0x800
-
-+/* the BIO FLAGS values 0x1000 to 0x4000 are reserved for internal KTLS flags */
-+
- typedef union bio_addr_st BIO_ADDR;
- typedef struct bio_addrinfo_st BIO_ADDRINFO;
-
-diff --git include/openssl/err.h include/openssl/err.h
-index b49f88129e..dce9885d3f 100644
---- include/openssl/err.h
-+++ include/openssl/err.h
-@@ -169,6 +169,7 @@ typedef struct err_state_st {
- # define SYS_F_STAT 22
- # define SYS_F_FCNTL 23
- # define SYS_F_FSTAT 24
-+# define SYS_F_SENDFILE 25
-
- /* reasons */
- # define ERR_R_SYS_LIB ERR_LIB_SYS/* 2 */
-diff --git include/openssl/evp.h include/openssl/evp.h
-index a411f3f2f9..60103707d2 100644
---- include/openssl/evp.h
-+++ include/openssl/evp.h
-@@ -352,6 +352,8 @@ int (*EVP_CIPHER_meth_get_ctrl(const EVP_CIPHER *cipher))(EVP_CIPHER_CTX *,
- # define EVP_CTRL_SET_PIPELINE_INPUT_LENS 0x24
-
- # define EVP_CTRL_GET_IVLEN 0x25
-+/* Get the IV used by the cipher */
-+# define EVP_CTRL_GET_IV 0x26
-
- /* Padding modes */
- #define EVP_PADDING_PKCS7 1
-diff --git include/openssl/ssl.h include/openssl/ssl.h
-index fd0c5a9996..cfb87e6322 100644
---- include/openssl/ssl.h
-+++ include/openssl/ssl.h
-@@ -303,7 +303,9 @@ typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx);
- /* Allow initial connection to servers that don't support RI */
- # define SSL_OP_LEGACY_SERVER_CONNECT 0x00000004U
-
--/* Reserved value (until OpenSSL 1.2.0) 0x00000008U */
-+/* Enable support for Kernel TLS */
-+# define SSL_OP_ENABLE_KTLS 0x00000008U
-+
- # define SSL_OP_TLSEXT_PADDING 0x00000010U
- /* Reserved value (until OpenSSL 1.2.0) 0x00000020U */
- # define SSL_OP_SAFARI_ECDHE_ECDSA_BUG 0x00000040U
-@@ -1837,6 +1839,8 @@ __owur int SSL_read_early_data(SSL *s, void *buf, size_t num,
- size_t *readbytes);
- __owur int SSL_peek(SSL *ssl, void *buf, int num);
- __owur int SSL_peek_ex(SSL *ssl, void *buf, size_t num, size_t *readbytes);
-+__owur ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size,
-+ int flags);
- __owur int SSL_write(SSL *ssl, const void *buf, int num);
- __owur int SSL_write_ex(SSL *s, const void *buf, size_t num, size_t *written);
- __owur int SSL_write_early_data(SSL *s, const void *buf, size_t num,
-@@ -2123,7 +2127,7 @@ void SSL_CTX_set_record_padding_callback_arg(SSL_CTX *ctx, void *arg);
- void *SSL_CTX_get_record_padding_callback_arg(const SSL_CTX *ctx);
- int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size);
-
--void SSL_set_record_padding_callback(SSL *ssl,
-+int SSL_set_record_padding_callback(SSL *ssl,
- size_t (*cb) (SSL *ssl, int type,
- size_t len, void *arg));
- void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg);
-diff --git include/openssl/sslerr.h include/openssl/sslerr.h
-index 701d61c6e9..c0310941c4 100644
---- include/openssl/sslerr.h
-+++ include/openssl/sslerr.h
-@@ -220,6 +220,7 @@ int ERR_load_SSL_strings(void);
- # define SSL_F_SSL_RENEGOTIATE_ABBREVIATED 546
- # define SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT 320
- # define SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT 321
-+# define SSL_F_SSL_SENDFILE 639
- # define SSL_F_SSL_SESSION_DUP 348
- # define SSL_F_SSL_SESSION_NEW 189
- # define SSL_F_SSL_SESSION_PRINT_FP 190
-diff --git ssl/build.info ssl/build.info
-index bb2f1deb53..1c49ac9aee 100644
---- ssl/build.info
-+++ ssl/build.info
-@@ -1,4 +1,5 @@
- LIBS=../libssl
-+
- SOURCE[../libssl]=\
- pqueue.c packet.c \
- statem/statem_srvr.c statem/statem_clnt.c s3_lib.c s3_enc.c record/rec_layer_s3.c \
-@@ -13,3 +14,7 @@ SOURCE[../libssl]=\
- bio_ssl.c ssl_err.c tls_srp.c t1_trce.c ssl_utst.c \
- record/ssl3_buffer.c record/ssl3_record.c record/dtls1_bitmap.c \
- statem/statem.c record/ssl3_record_tls13.c
-+
-+IF[{- !$disabled{ktls} -}]
-+ SOURCE[../libssl]=ktls.c
-+ENDIF
-diff --git ssl/ktls.c ssl/ktls.c
-new file mode 100644
-index 0000000000..68482ac480
---- /dev/null
-+++ ssl/ktls.c
-@@ -0,0 +1,321 @@
-+/*
-+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
-+ *
-+ * Licensed under the Apache License 2.0 (the "License"). You may not use
-+ * this file except in compliance with the License. You can obtain a copy
-+ * in the file LICENSE in the source distribution or at
-+ * https://www.openssl.org/source/license.html
-+ */
-+
-+#include "ssl_local.h"
-+#include "internal/ktls.h"
-+
-+#ifndef OPENSSL_NO_KTLS_RX
-+ /*
-+ * Count the number of records that were not processed yet from record boundary.
-+ *
-+ * This function assumes that there are only fully formed records read in the
-+ * record layer. If read_ahead is enabled, then this might be false and this
-+ * function will fail.
-+ */
-+static int count_unprocessed_records(SSL *s)
-+{
-+ SSL3_BUFFER *rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
-+ PACKET pkt, subpkt;
-+ int count = 0;
-+
-+ if (!PACKET_buf_init(&pkt, rbuf->buf + rbuf->offset, rbuf->left))
-+ return -1;
-+
-+ while (PACKET_remaining(&pkt) > 0) {
-+ /* Skip record type and version */
-+ if (!PACKET_forward(&pkt, 3))
-+ return -1;
-+
-+ /* Read until next record */
-+ if (!PACKET_get_length_prefixed_2(&pkt, &subpkt))
-+ return -1;
-+
-+ count += 1;
-+ }
-+
-+ return count;
-+}
-+
-+/*
-+ * The kernel cannot offload receive if a partial TLS record has been read.
-+ * Check the read buffer for unprocessed records. If the buffer contains a
-+ * partial record, fail and return 0. Otherwise, update the sequence
-+ * number at *rec_seq for the count of unprocessed records and return 1.
-+ */
-+static int check_rx_read_ahead(SSL *s, unsigned char *rec_seq)
-+{
-+ int bit, count_unprocessed;
-+
-+ count_unprocessed = count_unprocessed_records(s);
-+ if (count_unprocessed < 0)
-+ return 0;
-+
-+ /* increment the crypto_info record sequence */
-+ while (count_unprocessed) {
-+ for (bit = 7; bit >= 0; bit--) { /* increment */
-+ ++rec_seq[bit];
-+ if (rec_seq[bit] != 0)
-+ break;
-+ }
-+ count_unprocessed--;
-+
-+ }
-+
-+ return 1;
-+}
-+#endif
-+
-+#if defined(__FreeBSD__)
-+# include <crypto/cryptodev.h>
-+
-+/*-
-+ * Check if a given cipher is supported by the KTLS interface.
-+ * The kernel might still fail the setsockopt() if no suitable
-+ * provider is found, but this checks if the socket option
-+ * supports the cipher suite used at all.
-+ */
-+int ktls_check_supported_cipher(const SSL *s, const EVP_CIPHER *c,
-+ const EVP_CIPHER_CTX *dd)
-+{
-+
-+ switch (s->version) {
-+ case TLS1_VERSION:
-+ case TLS1_1_VERSION:
-+ case TLS1_2_VERSION:
-+ case TLS1_3_VERSION:
-+ break;
-+ default:
-+ return 0;
-+ }
-+
-+ switch (s->s3->tmp.new_cipher->algorithm_enc) {
-+ case SSL_AES128GCM:
-+ case SSL_AES256GCM:
-+ return 1;
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ case SSL_CHACHA20POLY1305:
-+ return 1;
-+# endif
-+ case SSL_AES128:
-+ case SSL_AES256:
-+ if (s->ext.use_etm)
-+ return 0;
-+ switch (s->s3->tmp.new_cipher->algorithm_mac) {
-+ case SSL_SHA1:
-+ case SSL_SHA256:
-+ case SSL_SHA384:
-+ return 1;
-+ default:
-+ return 0;
-+ }
-+ default:
-+ return 0;
-+ }
-+}
-+
-+/* Function to configure kernel TLS structure */
-+int ktls_configure_crypto(SSL *s, const EVP_CIPHER *c, EVP_CIPHER_CTX *dd,
-+ void *rl_sequence, ktls_crypto_info_t *crypto_info,
-+ int is_tx, unsigned char *iv,
-+ unsigned char *key, unsigned char *mac_key,
-+ size_t mac_secret_size)
-+{
-+ memset(crypto_info, 0, sizeof(*crypto_info));
-+ switch (s->s3->tmp.new_cipher->algorithm_enc) {
-+ case SSL_AES128GCM:
-+ case SSL_AES256GCM:
-+ crypto_info->cipher_algorithm = CRYPTO_AES_NIST_GCM_16;
-+ if (s->version == TLS1_3_VERSION)
-+ crypto_info->iv_len = EVP_CIPHER_CTX_iv_length(dd);
-+ else
-+ crypto_info->iv_len = EVP_GCM_TLS_FIXED_IV_LEN;
-+ break;
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ case SSL_CHACHA20POLY1305:
-+ crypto_info->cipher_algorithm = CRYPTO_CHACHA20_POLY1305;
-+ crypto_info->iv_len = EVP_CIPHER_CTX_iv_length(dd);
-+ break;
-+# endif
-+ case SSL_AES128:
-+ case SSL_AES256:
-+ switch (s->s3->tmp.new_cipher->algorithm_mac) {
-+ case SSL_SHA1:
-+ crypto_info->auth_algorithm = CRYPTO_SHA1_HMAC;
-+ break;
-+ case SSL_SHA256:
-+ crypto_info->auth_algorithm = CRYPTO_SHA2_256_HMAC;
-+ break;
-+ case SSL_SHA384:
-+ crypto_info->auth_algorithm = CRYPTO_SHA2_384_HMAC;
-+ break;
-+ default:
-+ return 0;
-+ }
-+ crypto_info->cipher_algorithm = CRYPTO_AES_CBC;
-+ crypto_info->iv_len = EVP_CIPHER_iv_length(c);
-+ crypto_info->auth_key = mac_key;
-+ crypto_info->auth_key_len = mac_secret_size;
-+ break;
-+ default:
-+ return 0;
-+ }
-+ crypto_info->cipher_key = key;
-+ crypto_info->cipher_key_len = EVP_CIPHER_key_length(c);
-+ crypto_info->iv = iv;
-+ crypto_info->tls_vmajor = (s->version >> 8) & 0x000000ff;
-+ crypto_info->tls_vminor = (s->version & 0x000000ff);
-+# ifdef TCP_RXTLS_ENABLE
-+ memcpy(crypto_info->rec_seq, rl_sequence, sizeof(crypto_info->rec_seq));
-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->rec_seq))
-+ return 0;
-+# else
-+ if (!is_tx)
-+ return 0;
-+# endif
-+ return 1;
-+};
-+
-+#endif /* __FreeBSD__ */
-+
-+#if defined(OPENSSL_SYS_LINUX)
-+
-+/* Function to check supported ciphers in Linux */
-+int ktls_check_supported_cipher(const SSL *s, const EVP_CIPHER *c,
-+ const EVP_CIPHER_CTX *dd)
-+{
-+ switch (s->version) {
-+ case TLS1_2_VERSION:
-+ case TLS1_3_VERSION:
-+ break;
-+ default:
-+ return 0;
-+ }
-+
-+ /* check that cipher is AES_GCM_128, AES_GCM_256, AES_CCM_128
-+ * or Chacha20-Poly1305
-+ */
-+# ifdef OPENSSL_KTLS_AES_CCM_128
-+ if (EVP_CIPHER_is_a(c, "AES-128-CCM")) {
-+ if (s->version == TLS_1_3_VERSION /* broken on 5.x kernels */
-+ || EVP_CIPHER_CTX_get_tag_length(dd) != EVP_CCM_TLS_TAG_LEN)
-+ return 0;
-+ return 1;
-+ } else
-+# endif
-+ if (0
-+# ifdef OPENSSL_KTLS_AES_GCM_128
-+ || EVP_CIPHER_is_a(c, "AES-128-GCM")
-+# endif
-+# ifdef OPENSSL_KTLS_AES_GCM_256
-+ || EVP_CIPHER_is_a(c, "AES-256-GCM")
-+# endif
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ || EVP_CIPHER_is_a(c, "ChaCha20-Poly1305")
-+# endif
-+ ) {
-+ return 1;
-+ }
-+ return 0;
-+}
-+
-+/* Function to configure kernel TLS structure */
-+int ktls_configure_crypto(SSL *s, const EVP_CIPHER *c, EVP_CIPHER_CTX *dd,
-+ void *rl_sequence, ktls_crypto_info_t *crypto_info,
-+ int is_tx, unsigned char *iv,
-+ unsigned char *key, unsigned char *mac_key,
-+ size_t mac_secret_size)
-+{
-+ unsigned char geniv[12];
-+ unsigned char *iiv = iv;
-+
-+# ifdef OPENSSL_NO_KTLS_RX
-+ if (!is_tx)
-+ return 0;
-+# endif
-+
-+ if (s->version == TLS1_2_VERSION &&
-+ EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE) {
-+ EVP_CIPHER_CTX_ctrl(dd, EVP_CTRL_GET_IV,
-+ EVP_GCM_TLS_FIXED_IV_LEN + EVP_GCM_TLS_EXPLICIT_IV_LEN,
-+ geniv);
-+ iiv = geniv;
-+ }
-+
-+ memset(crypto_info, 0, sizeof(*crypto_info));
-+ switch (EVP_CIPHER_nid(c))
-+ {
-+# ifdef OPENSSL_KTLS_AES_GCM_128
-+ case NID_aes_128_gcm:
-+ crypto_info->gcm128.info.cipher_type = TLS_CIPHER_AES_GCM_128;
-+ crypto_info->gcm128.info.version = s->version;
-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->gcm128);
-+ memcpy(crypto_info->gcm128.iv, iiv + EVP_GCM_TLS_FIXED_IV_LEN,
-+ TLS_CIPHER_AES_GCM_128_IV_SIZE);
-+ memcpy(crypto_info->gcm128.salt, iiv, TLS_CIPHER_AES_GCM_128_SALT_SIZE);
-+ memcpy(crypto_info->gcm128.key, key, EVP_CIPHER_key_length(c));
-+ memcpy(crypto_info->gcm128.rec_seq, rl_sequence,
-+ TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->gcm128.rec_seq))
-+ return 0;
-+ return 1;
-+# endif
-+# ifdef OPENSSL_KTLS_AES_GCM_256
-+ case NID_aes_256_gcm:
-+ crypto_info->gcm256.info.cipher_type = TLS_CIPHER_AES_GCM_256;
-+ crypto_info->gcm256.info.version = s->version;
-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->gcm256);
-+ memcpy(crypto_info->gcm256.iv, iiv + EVP_GCM_TLS_FIXED_IV_LEN,
-+ TLS_CIPHER_AES_GCM_256_IV_SIZE);
-+ memcpy(crypto_info->gcm256.salt, iiv, TLS_CIPHER_AES_GCM_256_SALT_SIZE);
-+ memcpy(crypto_info->gcm256.key, key, EVP_CIPHER_key_length(c));
-+ memcpy(crypto_info->gcm256.rec_seq, rl_sequence,
-+ TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->gcm256.rec_seq))
-+ return 0;
-+ return 1;
-+# endif
-+# ifdef OPENSSL_KTLS_AES_CCM_128
-+ case NID_aes_128_ccm:
-+ crypto_info->ccm128.info.cipher_type = TLS_CIPHER_AES_CCM_128;
-+ crypto_info->ccm128.info.version = s->version;
-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->ccm128);
-+ memcpy(crypto_info->ccm128.iv, iiv + EVP_CCM_TLS_FIXED_IV_LEN,
-+ TLS_CIPHER_AES_CCM_128_IV_SIZE);
-+ memcpy(crypto_info->ccm128.salt, iiv, TLS_CIPHER_AES_CCM_128_SALT_SIZE);
-+ memcpy(crypto_info->ccm128.key, key, EVP_CIPHER_key_length(c));
-+ memcpy(crypto_info->ccm128.rec_seq, rl_sequence,
-+ TLS_CIPHER_AES_CCM_128_REC_SEQ_SIZE);
-+ if (!is_tx && !check_rx_read_ahead(s, crypto_info->ccm128.rec_seq))
-+ return 0;
-+ return 1;
-+# endif
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ case NID_chacha20_poly1305:
-+ crypto_info->chacha20poly1305.info.cipher_type = TLS_CIPHER_CHACHA20_POLY1305;
-+ crypto_info->chacha20poly1305.info.version = s->version;
-+ crypto_info->tls_crypto_info_len = sizeof(crypto_info->chacha20poly1305);
-+ memcpy(crypto_info->chacha20poly1305.iv, iiv,
-+ TLS_CIPHER_CHACHA20_POLY1305_IV_SIZE);
-+ memcpy(crypto_info->chacha20poly1305.key, key,
-+ EVP_CIPHER_get_key_length(c));
-+ memcpy(crypto_info->chacha20poly1305.rec_seq, rl_sequence,
-+ TLS_CIPHER_CHACHA20_POLY1305_REC_SEQ_SIZE);
-+ if (!is_tx
-+ && !check_rx_read_ahead(s,
-+ crypto_info->chacha20poly1305.rec_seq))
-+ return 0;
-+ return 1;
-+# endif
-+ default:
-+ return 0;
-+ }
-+
-+}
-+
-+#endif /* OPENSSL_SYS_LINUX */
-diff --git ssl/record/rec_layer_s3.c ssl/record/rec_layer_s3.c
-index 8249b4ace9..1356bd7b7b 100644
---- ssl/record/rec_layer_s3.c
-+++ ssl/record/rec_layer_s3.c
-@@ -281,11 +281,15 @@
- return -1;
- }
-
-- /* We always act like read_ahead is set for DTLS */
-- if (!s->rlayer.read_ahead && !SSL_IS_DTLS(s))
-+ /*
-+ * Ktls always reads full records.
-+ * Also, we always act like read_ahead is set for DTLS.
-+ */
-+ if (!BIO_get_ktls_recv(s->rbio) && !s->rlayer.read_ahead
-+ && !SSL_IS_DTLS(s)) {
- /* ignore max parameter */
- max = n;
-- else {
-+ } else {
- if (max < n)
- max = n;
- if (max > rb->len - rb->offset)
-@@ -435,6 +439,7 @@
- len >= 4 * (max_send_fragment = ssl_get_max_send_fragment(s)) &&
- s->compress == NULL && s->msg_callback == NULL &&
- !SSL_WRITE_ETM(s) && SSL_USE_EXPLICIT_IV(s) &&
-+ (BIO_get_ktls_send(s->wbio) == 0) &&
- EVP_CIPHER_flags(EVP_CIPHER_CTX_cipher(s->enc_write_ctx)) &
- EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK) {
- unsigned char aad[13];
-@@ -764,6 +769,19 @@
- s->s3->empty_fragment_done = 1;
- }
-
-+ if (BIO_get_ktls_send(s->wbio)) {
-+ /*
-+ * ktls doesn't modify the buffer, but to avoid a warning we need to
-+ * discard the const qualifier.
-+ * This doesn't leak memory because the buffers have been released when
-+ * switching to ktls.
-+ */
-+ SSL3_BUFFER_set_buf(&s->rlayer.wbuf[0], (unsigned char *)buf);
-+ SSL3_BUFFER_set_offset(&s->rlayer.wbuf[0], 0);
-+ SSL3_BUFFER_set_app_buffer(&s->rlayer.wbuf[0], 1);
-+ goto wpacket_init_complete;
-+ }
-+
- if (create_empty_fragment) {
- wb = &s->rlayer.wbuf[0];
- #if defined(SSL3_ALIGN_PAYLOAD) && SSL3_ALIGN_PAYLOAD!=0
-@@ -833,6 +851,8 @@
- }
- }
-
-+ wpacket_init_complete:
-+
- totlen = 0;
- /* Clear our SSL3_RECORD structures */
- memset(wr, 0, sizeof(wr));
-@@ -874,15 +894,19 @@
- if (s->compress != NULL)
- maxcomplen += SSL3_RT_MAX_COMPRESSED_OVERHEAD;
-
-- /* write the header */
-- if (!WPACKET_put_bytes_u8(thispkt, rectype)
-+ /*
-+ * When using offload kernel will write the header.
-+ * Otherwise write the header now
-+ */
-+ if (!BIO_get_ktls_send(s->wbio)
-+ && (!WPACKET_put_bytes_u8(thispkt, rectype)
- || !WPACKET_put_bytes_u16(thispkt, version)
- || !WPACKET_start_sub_packet_u16(thispkt)
- || (eivlen > 0
- && !WPACKET_allocate_bytes(thispkt, eivlen, NULL))
- || (maxcomplen > 0
- && !WPACKET_reserve_bytes(thispkt, maxcomplen,
-- &compressdata))) {
-+ &compressdata)))) {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
- ERR_R_INTERNAL_ERROR);
- goto err;
-@@ -908,15 +932,20 @@
- goto err;
- }
- } else {
-- if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {
-- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
-- ERR_R_INTERNAL_ERROR);
-- goto err;
-+ if (BIO_get_ktls_send(s->wbio)) {
-+ SSL3_RECORD_reset_data(&wr[j]);
-+ } else {
-+ if (!WPACKET_memcpy(thispkt, thiswr->input, thiswr->length)) {
-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
-+ ERR_R_INTERNAL_ERROR);
-+ goto err;
-+ }
-+ SSL3_RECORD_reset_input(&wr[j]);
- }
-- SSL3_RECORD_reset_input(&wr[j]);
- }
-
- if (SSL_TREAT_AS_TLS13(s)
-+ && !BIO_get_ktls_send(s->wbio)
- && s->enc_write_ctx != NULL
- && (s->statem.enc_write_state != ENC_WRITE_STATE_WRITE_PLAIN_ALERTS
- || type != SSL3_RT_ALERT)) {
-@@ -972,7 +1001,7 @@
- * in the wb->buf
- */
-
-- if (!SSL_WRITE_ETM(s) && mac_size != 0) {
-+ if (!BIO_get_ktls_send(s->wbio) && !SSL_WRITE_ETM(s) && mac_size != 0) {
- unsigned char *mac;
-
- if (!WPACKET_allocate_bytes(thispkt, mac_size, &mac)
-@@ -989,26 +1018,27 @@
- * max encrypted overhead does not need to include an allocation for that
- * MAC
- */
-- if (!WPACKET_reserve_bytes(thispkt,
-- SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
-- - mac_size,
-- NULL)
-- /*
-- * We also need next the amount of bytes written to this
-- * sub-packet
-- */
-+ if (!BIO_get_ktls_send(s->wbio)) {
-+ if (!WPACKET_reserve_bytes(thispkt,
-+ SSL3_RT_SEND_MAX_ENCRYPTED_OVERHEAD
-+ - mac_size,
-+ NULL)
-+ /*
-+ * We also need next the amount of bytes written to this
-+ * sub-packet
-+ */
- || !WPACKET_get_length(thispkt, &len)) {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
- ERR_R_INTERNAL_ERROR);
- goto err;
-- }
-+ }
-
-- /* Get a pointer to the start of this record excluding header */
-- recordstart = WPACKET_get_curr(thispkt) - len;
--
-- SSL3_RECORD_set_data(thiswr, recordstart);
-- SSL3_RECORD_reset_input(thiswr);
-- SSL3_RECORD_set_length(thiswr, len);
-+ /* Get a pointer to the start of this record excluding header */
-+ recordstart = WPACKET_get_curr(thispkt) - len;
-+ SSL3_RECORD_set_data(thiswr, recordstart);
-+ SSL3_RECORD_reset_input(thiswr);
-+ SSL3_RECORD_set_length(thiswr, len);
-+ }
- }
-
- if (s->statem.enc_write_state == ENC_WRITE_STATE_WRITE_PLAIN_ALERTS) {
-@@ -1024,12 +1054,14 @@
- goto err;
- }
- } else {
-- if (s->method->ssl3_enc->enc(s, wr, numpipes, 1) < 1) {
-- if (!ossl_statem_in_error(s)) {
-- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
-- ERR_R_INTERNAL_ERROR);
-+ if (!BIO_get_ktls_send(s->wbio)) {
-+ if (s->method->ssl3_enc->enc(s, wr, numpipes, 1) < 1) {
-+ if (!ossl_statem_in_error(s)) {
-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
-+ ERR_R_INTERNAL_ERROR);
-+ }
-+ goto err;
- }
-- goto err;
- }
- }
-
-@@ -1039,6 +1071,9 @@
- thispkt = &pkt[j];
- thiswr = &wr[j];
-
-+ if (BIO_get_ktls_send(s->wbio))
-+ goto mac_done;
-+
- /* Allocate bytes for the encryption overhead */
- if (!WPACKET_get_length(thispkt, &origlen)
- /* Check we allowed enough room for the encryption growth */
-@@ -1048,7 +1083,8 @@
- || origlen > thiswr->length
- || (thiswr->length > origlen
- && !WPACKET_allocate_bytes(thispkt,
-- thiswr->length - origlen, NULL))) {
-+ thiswr->length - origlen,
-+ NULL))) {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DO_SSL3_WRITE,
- ERR_R_INTERNAL_ERROR);
- goto err;
-@@ -1093,13 +1129,8 @@
- goto err;
- }
-
-- /*
-- * we should now have thiswr->data pointing to the encrypted data, which
-- * is thiswr->length long
-- */
-- SSL3_RECORD_set_type(thiswr, type); /* not needed but helps for
-- * debugging */
-- SSL3_RECORD_add_length(thiswr, SSL3_RT_HEADER_LENGTH);
-+ /* header is added by the kernel when using offload */
-+ SSL3_RECORD_add_length(&wr[j], SSL3_RT_HEADER_LENGTH);
-
- if (create_empty_fragment) {
- /*
-@@ -1116,6 +1147,14 @@
- return 1;
- }
-
-+ mac_done:
-+ /*
-+ * we should now have thiswr->data pointing to the encrypted data, which
-+ * is thiswr->length long
-+ */
-+ SSL3_RECORD_set_type(thiswr, type); /* not needed but helps for
-+ * debugging */
-+
- /* now let's set up wb */
- SSL3_BUFFER_set_left(&s->rlayer.wbuf[j],
- prefix_len + SSL3_RECORD_get_length(thiswr));
-@@ -1169,6 +1208,17 @@
- clear_sys_error();
- if (s->wbio != NULL) {
- s->rwstate = SSL_WRITING;
-+
-+ /*
-+ * To prevent coalescing of control and data messages,
-+ * such as in buffer_write, we flush the BIO
-+ */
-+ if (BIO_get_ktls_send(s->wbio) && type != SSL3_RT_APPLICATION_DATA) {
-+ i = BIO_flush(s->wbio);
-+ if (i <= 0)
-+ return i;
-+ BIO_set_ktls_ctrl_msg(s->wbio, type);
-+ }
- /* TODO(size_t): Convert this call */
- i = BIO_write(s->wbio, (char *)
- &(SSL3_BUFFER_get_buf(&wb[currbuf])
-@@ -1181,7 +1231,15 @@
- SSL_R_BIO_NOT_SET);
- i = -1;
- }
-- if (i > 0 && tmpwrit == SSL3_BUFFER_get_left(&wb[currbuf])) {
-+
-+ /*
-+ * When an empty fragment is sent on a connection using KTLS,
-+ * it is sent as a write of zero bytes. If this zero byte
-+ * write succeeds, i will be 0 rather than a non-zero value.
-+ * Treat i == 0 as success rather than an error for zero byte
-+ * writes to permit this case.
-+ */
-+ if (i >= 0 && tmpwrit == SSL3_BUFFER_get_left(&wb[currbuf])) {
- SSL3_BUFFER_set_left(&wb[currbuf], 0);
- SSL3_BUFFER_add_offset(&wb[currbuf], tmpwrit);
- if (currbuf + 1 < s->rlayer.numwpipes)
-diff --git ssl/record/record.h ssl/record/record.h
-index af56206e07..10fdde71a8 100644
---- ssl/record/record.h
-+++ ssl/record/record.h
-@@ -25,6 +25,8 @@ typedef struct ssl3_buffer_st {
- size_t offset;
- /* how many bytes left */
- size_t left;
-+ /* 'buf' is from application for KTLS */
-+ int app_buffer;
- } SSL3_BUFFER;
-
- #define SEQ_NUM_SIZE 8
-diff --git ssl/record/record_local.h ssl/record/record_local.h
-index 5e8dd7f704..4760eeb7d8 100644
---- ssl/record/record_local.h
-+++ ssl/record/record_local.h
-@@ -65,6 +65,8 @@ void dtls1_record_bitmap_update(SSL *s, DTLS1_BITMAP *bitmap);
- #define SSL3_BUFFER_add_offset(b, o) ((b)->offset += (o))
- #define SSL3_BUFFER_is_initialised(b) ((b)->buf != NULL)
- #define SSL3_BUFFER_set_default_len(b, l) ((b)->default_len = (l))
-+#define SSL3_BUFFER_set_app_buffer(b, l) ((b)->app_buffer = (l))
-+#define SSL3_BUFFER_is_app_buffer(b) ((b)->app_buffer)
-
- void SSL3_BUFFER_clear(SSL3_BUFFER *b);
- void SSL3_BUFFER_set_data(SSL3_BUFFER *b, const unsigned char *d, size_t n);
-@@ -88,6 +90,7 @@ int ssl3_release_write_buffer(SSL *s);
- #define SSL3_RECORD_get_input(r) ((r)->input)
- #define SSL3_RECORD_set_input(r, i) ((r)->input = (i))
- #define SSL3_RECORD_reset_input(r) ((r)->input = (r)->data)
-+#define SSL3_RECORD_reset_data(r) ((r)->data = (r)->input)
- #define SSL3_RECORD_get_seq_num(r) ((r)->seq_num)
- #define SSL3_RECORD_get_off(r) ((r)->off)
- #define SSL3_RECORD_set_off(r, o) ((r)->off = (o))
-diff --git ssl/record/ssl3_buffer.c ssl/record/ssl3_buffer.c
-index b9ba25e0c3..10d11ab76c 100644
---- ssl/record/ssl3_buffer.c
-+++ ssl/record/ssl3_buffer.c
-@@ -110,23 +110,27 @@ int ssl3_setup_write_buffer(SSL *s, size_t numwpipes, size_t len)
- for (currpipe = 0; currpipe < numwpipes; currpipe++) {
- SSL3_BUFFER *thiswb = &wb[currpipe];
-
-- if (thiswb->buf != NULL && thiswb->len != len) {
-+ if (thiswb->len != len) {
- OPENSSL_free(thiswb->buf);
- thiswb->buf = NULL; /* force reallocation */
- }
-
- if (thiswb->buf == NULL) {
-- p = OPENSSL_malloc(len);
-- if (p == NULL) {
-- s->rlayer.numwpipes = currpipe;
-- /*
-- * We've got a malloc failure, and we're still initialising
-- * buffers. We assume we're so doomed that we won't even be able
-- * to send an alert.
-- */
-- SSLfatal(s, SSL_AD_NO_ALERT,
-- SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
-- return 0;
-+ if (s->wbio == NULL || !BIO_get_ktls_send(s->wbio)) {
-+ p = OPENSSL_malloc(len);
-+ if (p == NULL) {
-+ s->rlayer.numwpipes = currpipe;
-+ /*
-+ * We've got a malloc failure, and we're still initialising
-+ * buffers. We assume we're so doomed that we won't even be able
-+ * to send an alert.
-+ */
-+ SSLfatal(s, SSL_AD_NO_ALERT,
-+ SSL_F_SSL3_SETUP_WRITE_BUFFER, ERR_R_MALLOC_FAILURE);
-+ return 0;
-+ }
-+ } else {
-+ p = NULL;
- }
- memset(thiswb, 0, sizeof(SSL3_BUFFER));
- thiswb->buf = p;
-@@ -159,7 +163,10 @@ int ssl3_release_write_buffer(SSL *s)
- while (pipes > 0) {
- wb = &RECORD_LAYER_get_wbuf(&s->rlayer)[pipes - 1];
-
-- OPENSSL_free(wb->buf);
-+ if (SSL3_BUFFER_is_app_buffer(wb))
-+ SSL3_BUFFER_set_app_buffer(wb, 0);
-+ else
-+ OPENSSL_free(wb->buf);
- wb->buf = NULL;
- pipes--;
- }
-diff --git ssl/record/ssl3_record.c ssl/record/ssl3_record.c
-index f158544789..da549995e0 100644
---- ssl/record/ssl3_record.c
-+++ ssl/record/ssl3_record.c
-@@ -186,6 +186,7 @@ int ssl3_get_record(SSL *s)
- size_t num_recs = 0, max_recs, j;
- PACKET pkt, sslv2pkt;
- size_t first_rec_len;
-+ int using_ktls;
-
- rr = RECORD_LAYER_get_rrec(&s->rlayer);
- rbuf = RECORD_LAYER_get_rbuf(&s->rlayer);
-@@ -194,6 +195,12 @@ int ssl3_get_record(SSL *s)
- max_recs = 1;
- sess = s->session;
-
-+ /*
-+ * KTLS reads full records. If there is any data left,
-+ * then it is from before enabling ktls.
-+ */
-+ using_ktls = BIO_get_ktls_recv(s->rbio) && SSL3_BUFFER_get_left(rbuf) == 0;
-+
- do {
- thisrr = &rr[num_recs];
-
-@@ -207,8 +214,32 @@ int ssl3_get_record(SSL *s)
- rret = ssl3_read_n(s, SSL3_RT_HEADER_LENGTH,
- SSL3_BUFFER_get_len(rbuf), 0,
- num_recs == 0 ? 1 : 0, &n);
-- if (rret <= 0)
-- return rret; /* error or non-blocking */
-+ if (rret <= 0) {
-+#ifndef OPENSSL_NO_KTLS
-+ if (!BIO_get_ktls_recv(s->rbio) || rret == 0)
-+ return rret; /* error or non-blocking */
-+ switch (errno) {
-+ case EBADMSG:
-+ SSLfatal(s, SSL_AD_BAD_RECORD_MAC,
-+ SSL_F_SSL3_GET_RECORD,
-+ SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC);
-+ break;
-+ case EMSGSIZE:
-+ SSLfatal(s, SSL_AD_RECORD_OVERFLOW,
-+ SSL_F_SSL3_GET_RECORD,
-+ SSL_R_PACKET_LENGTH_TOO_LONG);
-+ break;
-+ case EINVAL:
-+ SSLfatal(s, SSL_AD_PROTOCOL_VERSION,
-+ SSL_F_SSL3_GET_RECORD,
-+ SSL_R_WRONG_VERSION_NUMBER);
-+ break;
-+ default:
-+ break;
-+ }
-+#endif
-+ return rret;
-+ }
- RECORD_LAYER_set_rstate(&s->rlayer, SSL_ST_READ_BODY);
-
- p = RECORD_LAYER_get_packet(&s->rlayer);
-@@ -339,7 +370,9 @@ int ssl3_get_record(SSL *s)
- }
- }
-
-- if (SSL_IS_TLS13(s) && s->enc_read_ctx != NULL) {
-+ if (SSL_IS_TLS13(s)
-+ && s->enc_read_ctx != NULL
-+ && !using_ktls) {
- if (thisrr->type != SSL3_RT_APPLICATION_DATA
- && (thisrr->type != SSL3_RT_CHANGE_CIPHER_SPEC
- || !SSL_IS_FIRST_HANDSHAKE(s))
-@@ -369,7 +402,13 @@ int ssl3_get_record(SSL *s)
- }
-
- if (SSL_IS_TLS13(s)) {
-- if (thisrr->length > SSL3_RT_MAX_TLS13_ENCRYPTED_LENGTH) {
-+ size_t len = SSL3_RT_MAX_TLS13_ENCRYPTED_LENGTH;
-+
-+ /* KTLS strips the inner record type. */
-+ if (using_ktls)
-+ len = SSL3_RT_MAX_ENCRYPTED_LENGTH;
-+
-+ if (thisrr->length > len) {
- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
- SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
- return -1;
-@@ -386,6 +425,10 @@ int ssl3_get_record(SSL *s)
- len -= SSL3_RT_MAX_COMPRESSED_OVERHEAD;
- #endif
-
-+ /* KTLS may use all of the buffer */
-+ if (using_ktls)
-+ len = SSL3_BUFFER_get_left(rbuf);
-+
- if (thisrr->length > len) {
- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
- SSL_R_ENCRYPTED_LENGTH_TOO_LONG);
-@@ -404,6 +447,7 @@ int ssl3_get_record(SSL *s)
- } else {
- more = thisrr->length;
- }
-+
- if (more > 0) {
- /* now s->rlayer.packet_length == SSL3_RT_HEADER_LENGTH */
-
-@@ -491,6 +535,9 @@ int ssl3_get_record(SSL *s)
- return 1;
- }
-
-+ if (using_ktls)
-+ goto skip_decryption;
-+
- /*
- * If in encrypt-then-mac mode calculate mac from encrypted record. All
- * the details below are public so no timing details can leak.
-@@ -678,6 +725,8 @@ int ssl3_get_record(SSL *s)
- return -1;
- }
-
-+ skip_decryption:
-+
- for (j = 0; j < num_recs; j++) {
- thisrr = &rr[j];
-
-@@ -698,22 +747,30 @@ int ssl3_get_record(SSL *s)
- if (SSL_IS_TLS13(s)
- && s->enc_read_ctx != NULL
- && thisrr->type != SSL3_RT_ALERT) {
-- size_t end;
-+ /*
-+ * The following logic are irrelevant in KTLS: the kernel provides
-+ * unprotected record and thus record type represent the actual
-+ * content type, and padding is already removed and thisrr->type and
-+ * thisrr->length should have the correct values.
-+ */
-+ if (!using_ktls) {
-+ size_t end;
-
-- if (thisrr->length == 0
-- || thisrr->type != SSL3_RT_APPLICATION_DATA) {
-- SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_F_SSL3_GET_RECORD,
-- SSL_R_BAD_RECORD_TYPE);
-- return -1;
-+ if (thisrr->length == 0
-+ || thisrr->type != SSL3_RT_APPLICATION_DATA) {
-+ SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE,
-+ SSL_F_SSL3_GET_RECORD, SSL_R_BAD_RECORD_TYPE);
-+ return -1;
-+ }
-+
-+ /* Strip trailing padding */
-+ for (end = thisrr->length - 1; end > 0 && thisrr->data[end] == 0;
-+ end--)
-+ continue;
-+
-+ thisrr->length = end;
-+ thisrr->type = thisrr->data[end];
- }
--
-- /* Strip trailing padding */
-- for (end = thisrr->length - 1; end > 0 && thisrr->data[end] == 0;
-- end--)
-- continue;
--
-- thisrr->length = end;
-- thisrr->type = thisrr->data[end];
- if (thisrr->type != SSL3_RT_APPLICATION_DATA
- && thisrr->type != SSL3_RT_ALERT
- && thisrr->type != SSL3_RT_HANDSHAKE) {
-@@ -723,7 +780,7 @@ int ssl3_get_record(SSL *s)
- }
- if (s->msg_callback)
- s->msg_callback(0, s->version, SSL3_RT_INNER_CONTENT_TYPE,
-- &thisrr->data[end], 1, s, s->msg_callback_arg);
-+ &thisrr->type, 1, s, s->msg_callback_arg);
- }
-
- /*
-@@ -739,13 +796,25 @@ int ssl3_get_record(SSL *s)
- return -1;
- }
-
-- if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH) {
-+ /*
-+ * Usually thisrr->length is the length of a single record, but when
-+ * KTLS handles the decryption, thisrr->length may be larger than
-+ * SSL3_RT_MAX_PLAIN_LENGTH because the kernel may have coalesced
-+ * multiple records.
-+ * Therefore we have to rely on KTLS to check the plaintext length
-+ * limit in the kernel.
-+ */
-+ if (thisrr->length > SSL3_RT_MAX_PLAIN_LENGTH && !using_ktls) {
- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
- SSL_R_DATA_LENGTH_TOO_LONG);
- return -1;
- }
-
-- /* If received packet overflows current Max Fragment Length setting */
-+ /*
-+ * Check if the received packet overflows the current
-+ * Max Fragment Length setting.
-+ * Note: USE_MAX_FRAGMENT_LENGTH_EXT and KTLS are mutually exclusive.
-+ */
- if (s->session != NULL && USE_MAX_FRAGMENT_LENGTH_EXT(s->session)
- && thisrr->length > GET_MAX_FRAGMENT_LENGTH(s->session)) {
- SSLfatal(s, SSL_AD_RECORD_OVERFLOW, SSL_F_SSL3_GET_RECORD,
-diff --git ssl/ssl_conf.c ssl/ssl_conf.c
-index 0a3fef7c8c..8013c62f07 100644
---- ssl/ssl_conf.c
-+++ ssl/ssl_conf.c
-@@ -391,7 +391,8 @@ static int cmd_Options(SSL_CONF_CTX *cctx, const char *value)
- SSL_FLAG_TBL("AllowNoDHEKEX", SSL_OP_ALLOW_NO_DHE_KEX),
- SSL_FLAG_TBL("PrioritizeChaCha", SSL_OP_PRIORITIZE_CHACHA),
- SSL_FLAG_TBL("MiddleboxCompat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT),
-- SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY)
-+ SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY),
-+ SSL_FLAG_TBL("KTLS", SSL_OP_ENABLE_KTLS)
- };
- if (value == NULL)
- return -3;
-diff --git ssl/ssl_err.c ssl/ssl_err.c
-index 324f2ccbb0..03273204ee 100644
---- ssl/ssl_err.c
-+++ ssl/ssl_err.c
-@@ -313,6 +313,7 @@ static const ERR_STRING_DATA SSL_str_functs[] = {
- "SSL_renegotiate_abbreviated"},
- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SCAN_CLIENTHELLO_TLSEXT, 0), ""},
- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SCAN_SERVERHELLO_TLSEXT, 0), ""},
-+ {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SENDFILE, 0), "SSL_sendfile"},
- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_DUP, 0), "ssl_session_dup"},
- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_NEW, 0), "SSL_SESSION_new"},
- {ERR_PACK(ERR_LIB_SSL, SSL_F_SSL_SESSION_PRINT_FP, 0),
-diff --git ssl/ssl_lib.c ssl/ssl_lib.c
-index 25a1a44785..1fbad29b23 100644
---- ssl/ssl_lib.c
-+++ ssl/ssl_lib.c
-@@ -11,6 +11,7 @@
-
- #include <stdio.h>
- #include "ssl_local.h"
-+#include "e_os.h"
- #include <openssl/objects.h>
- #include <openssl/x509v3.h>
- #include <openssl/rand.h>
-@@ -22,6 +23,7 @@
- #include <openssl/ct.h>
- #include "internal/cryptlib.h"
- #include "internal/refcount.h"
-+#include "internal/ktls.h"
-
- const char SSL_version_str[] = OPENSSL_VERSION_TEXT;
-
-@@ -1159,11 +1161,15 @@ void SSL_free(SSL *s)
- dane_final(&s->dane);
- CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL, s, &s->ex_data);
-
-+ RECORD_LAYER_release(&s->rlayer);
-+
- /* Ignore return value */
- ssl_free_wbio_buffer(s);
-
- BIO_free_all(s->wbio);
-+ s->wbio = NULL;
- BIO_free_all(s->rbio);
-+ s->rbio = NULL;
-
- BUF_MEM_free(s->init_buf);
-
-@@ -1220,8 +1226,6 @@ void SSL_free(SSL *s)
- if (s->method != NULL)
- s->method->ssl_free(s);
-
-- RECORD_LAYER_release(&s->rlayer);
--
- SSL_CTX_free(s->ctx);
-
- ASYNC_WAIT_CTX_free(s->waitctx);
-@@ -1361,6 +1365,15 @@ int SSL_set_fd(SSL *s, int fd)
- }
- BIO_set_fd(bio, fd, BIO_NOCLOSE);
- SSL_set_bio(s, bio, bio);
-+#ifndef OPENSSL_NO_KTLS
-+ /*
-+ * The new socket is created successfully regardless of ktls_enable.
-+ * ktls_enable doesn't change any functionality of the socket, except
-+ * changing the setsockopt to enable the processing of ktls_start.
-+ * Thus, it is not a problem to call it for non-TLS sockets.
-+ */
-+ ktls_enable(fd);
-+#endif /* OPENSSL_NO_KTLS */
- ret = 1;
- err:
- return ret;
-@@ -1380,6 +1393,15 @@ int SSL_set_wfd(SSL *s, int fd)
- }
- BIO_set_fd(bio, fd, BIO_NOCLOSE);
- SSL_set0_wbio(s, bio);
-+#ifndef OPENSSL_NO_KTLS
-+ /*
-+ * The new socket is created successfully regardless of ktls_enable.
-+ * ktls_enable doesn't change any functionality of the socket, except
-+ * changing the setsockopt to enable the processing of ktls_start.
-+ * Thus, it is not a problem to call it for non-TLS sockets.
-+ */
-+ ktls_enable(fd);
-+#endif /* OPENSSL_NO_KTLS */
- } else {
- BIO_up_ref(rbio);
- SSL_set0_wbio(s, rbio);
-@@ -1963,6 +1985,70 @@ int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
- }
- }
-
-+ossl_ssize_t SSL_sendfile(SSL *s, int fd, off_t offset, size_t size, int flags)
-+{
-+ ossl_ssize_t ret;
-+
-+ if (s->handshake_func == NULL) {
-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
-+ return -1;
-+ }
-+
-+ if (s->shutdown & SSL_SENT_SHUTDOWN) {
-+ s->rwstate = SSL_NOTHING;
-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_PROTOCOL_IS_SHUTDOWN);
-+ return -1;
-+ }
-+
-+ if (!BIO_get_ktls_send(s->wbio)) {
-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
-+ return -1;
-+ }
-+
-+ /* If we have an alert to send, lets send it */
-+ if (s->s3->alert_dispatch) {
-+ ret = (ossl_ssize_t)s->method->ssl_dispatch_alert(s);
-+ if (ret <= 0) {
-+ /* SSLfatal() already called if appropriate */
-+ return ret;
-+ }
-+ /* if it went, fall through and send more stuff */
-+ }
-+
-+ s->rwstate = SSL_WRITING;
-+ if (BIO_flush(s->wbio) <= 0) {
-+ if (!BIO_should_retry(s->wbio)) {
-+ s->rwstate = SSL_NOTHING;
-+ } else {
-+#ifdef EAGAIN
-+ set_sys_error(EAGAIN);
-+#endif
-+ }
-+ return -1;
-+ }
-+
-+#ifdef OPENSSL_NO_KTLS
-+ SYSerr(SSL_F_SSL_SENDFILE, ERR_R_INTERNAL_ERROR);
-+ ERR_add_error_data(1, "calling sendfile()");
-+ return -1;
-+#else
-+ ret = ktls_sendfile(SSL_get_wfd(s), fd, offset, size, flags);
-+ if (ret < 0) {
-+#if defined(EAGAIN) && defined(EINTR) && defined(EBUSY)
-+ if ((get_last_sys_error() == EAGAIN) ||
-+ (get_last_sys_error() == EINTR) ||
-+ (get_last_sys_error() == EBUSY))
-+ BIO_set_retry_write(s->wbio);
-+ else
-+#endif
-+ SSLerr(SSL_F_SSL_SENDFILE, SSL_R_UNINITIALIZED);
-+ return ret;
-+ }
-+ s->rwstate = SSL_NOTHING;
-+ return ret;
-+#endif
-+}
-+
- int SSL_write(SSL *s, const void *buf, int num)
- {
- int ret;
-@@ -2213,6 +2299,10 @@ long SSL_ctrl(SSL *s, int cmd, long larg, void *parg)
- case SSL_CTRL_SET_MAX_SEND_FRAGMENT:
- if (larg < 512 || larg > SSL3_RT_MAX_PLAIN_LENGTH)
- return 0;
-+#ifndef OPENSSL_NO_KTLS
-+ if (s->wbio != NULL && BIO_get_ktls_send(s->wbio))
-+ return 0;
-+#endif /* OPENSSL_NO_KTLS */
- s->max_send_fragment = larg;
- if (s->max_send_fragment < s->split_send_fragment)
- s->split_send_fragment = s->max_send_fragment;
-@@ -4471,11 +4561,18 @@ int SSL_CTX_set_block_padding(SSL_CTX *ctx, size_t block_size)
- return 1;
- }
-
--void SSL_set_record_padding_callback(SSL *ssl,
-+int SSL_set_record_padding_callback(SSL *ssl,
- size_t (*cb) (SSL *ssl, int type,
- size_t len, void *arg))
- {
-- ssl->record_padding_cb = cb;
-+ BIO *b;
-+
-+ b = SSL_get_wbio(ssl);
-+ if (b == NULL || !BIO_get_ktls_send(b)) {
-+ ssl->record_padding_cb = cb;
-+ return 1;
-+ }
-+ return 0;
- }
-
- void SSL_set_record_padding_callback_arg(SSL *ssl, void *arg)
-diff --git ssl/ssl_local.h ssl/ssl_local.h
-index 9f346e30e8..587064cc18 100644
---- ssl/ssl_local.h
-+++ ssl/ssl_local.h
-@@ -34,6 +34,8 @@
- # include "internal/dane.h"
- # include "internal/refcount.h"
- # include "internal/tsan_assist.h"
-+# include "internal/bio.h"
-+# include "internal/ktls.h"
-
- # ifdef OPENSSL_BUILD_SHLIBSSL
- # undef OPENSSL_EXTERN
-@@ -2617,6 +2619,17 @@ __owur int ssl_log_secret(SSL *ssl, const char *label,
- #define EARLY_EXPORTER_SECRET_LABEL "EARLY_EXPORTER_SECRET"
- #define EXPORTER_SECRET_LABEL "EXPORTER_SECRET"
-
-+# ifndef OPENSSL_NO_KTLS
-+/* ktls.c */
-+int ktls_check_supported_cipher(const SSL *s, const EVP_CIPHER *c,
-+ const EVP_CIPHER_CTX *dd);
-+int ktls_configure_crypto(SSL *s, const EVP_CIPHER *c, EVP_CIPHER_CTX *dd,
-+ void *rl_sequence, ktls_crypto_info_t *crypto_info,
-+ int is_tx, unsigned char *iv,
-+ unsigned char *key, unsigned char *mac_key,
-+ size_t mac_secret_size);
-+# endif
-+
- /* s3_cbc.c */
- __owur char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx);
- __owur int ssl3_cbc_digest_record(const EVP_MD_CTX *ctx,
-diff --git ssl/t1_enc.c ssl/t1_enc.c
-index f8e53d4efc..46191908ab 100644
---- ssl/t1_enc.c
-+++ ssl/t1_enc.c
-@@ -10,10 +10,14 @@
-
- #include <stdio.h>
- #include "ssl_local.h"
-+#include "record/record_local.h"
-+#include "internal/ktls.h"
-+#include "internal/cryptlib.h"
- #include <openssl/comp.h>
- #include <openssl/evp.h>
- #include <openssl/kdf.h>
- #include <openssl/rand.h>
-+#include <openssl/obj_mac.h>
-
- /* seed1 through seed5 are concatenated */
- static int tls1_PRF(SSL *s,
-@@ -94,6 +98,11 @@ int tls1_change_cipher_state(SSL *s, int which)
- EVP_PKEY *mac_key;
- size_t n, i, j, k, cl;
- int reuse_dd = 0;
-+#ifndef OPENSSL_NO_KTLS
-+ ktls_crypto_info_t crypto_info;
-+ void *rl_sequence;
-+ BIO *bio;
-+#endif
-
- c = s->s3->tmp.new_sym_enc;
- m = s->s3->tmp.new_hash;
-@@ -312,6 +321,62 @@ int tls1_change_cipher_state(SSL *s, int which)
- ERR_R_INTERNAL_ERROR);
- goto err;
- }
-+#ifndef OPENSSL_NO_KTLS
-+ if (s->compress || (s->options & SSL_OP_ENABLE_KTLS) == 0)
-+ goto skip_ktls;
-+
-+ /* ktls supports only the maximum fragment size */
-+ if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH)
-+ goto skip_ktls;
-+
-+ /* check that cipher is supported */
-+ if (!ktls_check_supported_cipher(s, c, dd))
-+ goto skip_ktls;
-+
-+ if (which & SSL3_CC_WRITE)
-+ bio = s->wbio;
-+ else
-+ bio = s->rbio;
-+
-+ if (!ossl_assert(bio != NULL)) {
-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS1_CHANGE_CIPHER_STATE,
-+ ERR_R_INTERNAL_ERROR);
-+ goto err;
-+ }
-+
-+ /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
-+ if (which & SSL3_CC_WRITE) {
-+ if (BIO_flush(bio) <= 0)
-+ goto skip_ktls;
-+ }
-+
-+ /* ktls doesn't support renegotiation */
-+ if ((BIO_get_ktls_send(s->wbio) && (which & SSL3_CC_WRITE)) ||
-+ (BIO_get_ktls_recv(s->rbio) && (which & SSL3_CC_READ))) {
-+ SSLfatal(s, SSL_AD_NO_RENEGOTIATION, SSL_F_TLS1_CHANGE_CIPHER_STATE,
-+ ERR_R_INTERNAL_ERROR);
-+ goto err;
-+ }
-+
-+ if (which & SSL3_CC_WRITE)
-+ rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
-+ else
-+ rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
-+
-+ if (!ktls_configure_crypto(s, c, dd, rl_sequence, &crypto_info,
-+ which & SSL3_CC_WRITE, iv, key, ms,
-+ *mac_secret_size))
-+ goto skip_ktls;
-+
-+ /* ktls works with user provided buffers directly */
-+ if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
-+ if (which & SSL3_CC_WRITE)
-+ ssl3_release_write_buffer(s);
-+ SSL_set_options(s, SSL_OP_NO_RENEGOTIATION);
-+ }
-+
-+ skip_ktls:
-+#endif /* OPENSSL_NO_KTLS */
- s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
-
- #ifdef SSL_DEBUG
-diff --git ssl/tls13_enc.c ssl/tls13_enc.c
-index b8fb07f210..109227e556 100644
---- ssl/tls13_enc.c
-+++ ssl/tls13_enc.c
-@@ -9,6 +9,8 @@
-
- #include <stdlib.h>
- #include "ssl_local.h"
-+#include "internal/ktls.h"
-+#include "record/record_local.h"
- #include "internal/cryptlib.h"
- #include <openssl/evp.h>
- #include <openssl/kdf.h>
-@@ -363,9 +365,9 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
- const unsigned char *hash,
- const unsigned char *label,
- size_t labellen, unsigned char *secret,
-- unsigned char *iv, EVP_CIPHER_CTX *ciph_ctx)
-+ unsigned char *key, unsigned char *iv,
-+ EVP_CIPHER_CTX *ciph_ctx)
- {
-- unsigned char key[EVP_MAX_KEY_LENGTH];
- size_t ivlen, keylen, taglen;
- int hashleni = EVP_MD_size(md);
- size_t hashlen;
-@@ -374,14 +376,14 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
- if (!ossl_assert(hashleni >= 0)) {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
- ERR_R_EVP_LIB);
-- goto err;
-+ return 0;
- }
- hashlen = (size_t)hashleni;
-
- if (!tls13_hkdf_expand(s, md, insecret, label, labellen, hash, hashlen,
- secret, hashlen, 1)) {
- /* SSLfatal() already called */
-- goto err;
-+ return 0;
- }
-
- /* TODO(size_t): convert me */
-@@ -401,7 +403,7 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
- } else {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
- ERR_R_EVP_LIB);
-- goto err;
-+ return 0;
- }
- if (algenc & (SSL_AES128CCM8 | SSL_AES256CCM8))
- taglen = EVP_CCM8_TLS_TAG_LEN;
-@@ -415,7 +417,7 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
- if (!tls13_derive_key(s, md, secret, key, keylen)
- || !tls13_derive_iv(s, md, secret, iv, ivlen)) {
- /* SSLfatal() already called */
-- goto err;
-+ return 0;
- }
-
- if (EVP_CipherInit_ex(ciph_ctx, ciph, NULL, NULL, NULL, sending) <= 0
-@@ -425,13 +427,10 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
- || EVP_CipherInit_ex(ciph_ctx, NULL, NULL, key, NULL, -1) <= 0) {
- SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_DERIVE_SECRET_KEY_AND_IV,
- ERR_R_EVP_LIB);
-- goto err;
-+ return 0;
- }
-
- return 1;
-- err:
-- OPENSSL_cleanse(key, sizeof(key));
-- return 0;
- }
-
- int tls13_change_cipher_state(SSL *s, int which)
-@@ -456,6 +455,7 @@ int tls13_change_cipher_state(SSL *s, int which)
- static const unsigned char early_exporter_master_secret[] = "e exp master";
- #endif
- unsigned char *iv;
-+ unsigned char key[EVP_MAX_KEY_LENGTH];
- unsigned char secret[EVP_MAX_MD_SIZE];
- unsigned char hashval[EVP_MAX_MD_SIZE];
- unsigned char *hash = hashval;
-@@ -469,6 +469,11 @@ int tls13_change_cipher_state(SSL *s, int which)
- int ret = 0;
- const EVP_MD *md = NULL;
- const EVP_CIPHER *cipher = NULL;
-+#if !defined(OPENSSL_NO_KTLS) && defined(OPENSSL_KTLS_TLS13)
-+ ktls_crypto_info_t crypto_info;
-+ void *rl_sequence;
-+ BIO *bio;
-+#endif
-
- if (which & SSL3_CC_READ) {
- if (s->enc_read_ctx != NULL) {
-@@ -671,9 +676,13 @@ int tls13_change_cipher_state(SSL *s, int which)
- }
- }
-
-+ /* check whether cipher is known */
-+ if(!ossl_assert(cipher != NULL))
-+ goto err;
-+
- if (!derive_secret_key_and_iv(s, which & SSL3_CC_WRITE, md, cipher,
-- insecret, hash, label, labellen, secret, iv,
-- ciph_ctx)) {
-+ insecret, hash, label, labellen, secret, key,
-+ iv, ciph_ctx)) {
- /* SSLfatal() already called */
- goto err;
- }
-@@ -714,8 +723,62 @@ int tls13_change_cipher_state(SSL *s, int which)
- s->statem.enc_write_state = ENC_WRITE_STATE_WRITE_PLAIN_ALERTS;
- else
- s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
-+#ifndef OPENSSL_NO_KTLS
-+# if defined(OPENSSL_KTLS_TLS13)
-+ if (!(which & SSL3_CC_APPLICATION)
-+ || (s->options & SSL_OP_ENABLE_KTLS) == 0)
-+ goto skip_ktls;
-+
-+ /* ktls supports only the maximum fragment size */
-+ if (ssl_get_max_send_fragment(s) != SSL3_RT_MAX_PLAIN_LENGTH)
-+ goto skip_ktls;
-+
-+ /* ktls does not support record padding */
-+ if (s->record_padding_cb != NULL)
-+ goto skip_ktls;
-+
-+ /* check that cipher is supported */
-+ if (!ktls_check_supported_cipher(s, cipher, ciph_ctx))
-+ goto skip_ktls;
-+
-+ if (which & SSL3_CC_WRITE)
-+ bio = s->wbio;
-+ else
-+ bio = s->rbio;
-+
-+ if (!ossl_assert(bio != NULL)) {
-+ SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS13_CHANGE_CIPHER_STATE,
-+ ERR_R_INTERNAL_ERROR);
-+ goto err;
-+ }
-+
-+ /* All future data will get encrypted by ktls. Flush the BIO or skip ktls */
-+ if (which & SSL3_CC_WRITE) {
-+ if (BIO_flush(bio) <= 0)
-+ goto skip_ktls;
-+ }
-+
-+ /* configure kernel crypto structure */
-+ if (which & SSL3_CC_WRITE)
-+ rl_sequence = RECORD_LAYER_get_write_sequence(&s->rlayer);
-+ else
-+ rl_sequence = RECORD_LAYER_get_read_sequence(&s->rlayer);
-+
-+ if (!ktls_configure_crypto(s, cipher, ciph_ctx, rl_sequence, &crypto_info,
-+ which & SSL3_CC_WRITE, iv, key, NULL, 0))
-+ goto skip_ktls;
-+
-+ /* ktls works with user provided buffers directly */
-+ if (BIO_set_ktls(bio, &crypto_info, which & SSL3_CC_WRITE)) {
-+ if (which & SSL3_CC_WRITE)
-+ ssl3_release_write_buffer(s);
-+ }
-+skip_ktls:
-+# endif
-+#endif
- ret = 1;
- err:
-+ OPENSSL_cleanse(key, sizeof(key));
- OPENSSL_cleanse(secret, sizeof(secret));
- return ret;
- }
-@@ -729,6 +792,7 @@ int tls13_update_key(SSL *s, int sending)
- #endif
- const EVP_MD *md = ssl_handshake_md(s);
- size_t hashlen = EVP_MD_size(md);
-+ unsigned char key[EVP_MAX_KEY_LENGTH];
- unsigned char *insecret, *iv;
- unsigned char secret[EVP_MAX_MD_SIZE];
- EVP_CIPHER_CTX *ciph_ctx;
-@@ -753,8 +817,8 @@ int tls13_update_key(SSL *s, int sending)
- if (!derive_secret_key_and_iv(s, sending, ssl_handshake_md(s),
- s->s3->tmp.new_sym_enc, insecret, NULL,
- application_traffic,
-- sizeof(application_traffic) - 1, secret, iv,
-- ciph_ctx)) {
-+ sizeof(application_traffic) - 1, secret, key,
-+ iv, ciph_ctx)) {
- /* SSLfatal() already called */
- goto err;
- }
-@@ -764,6 +828,7 @@ int tls13_update_key(SSL *s, int sending)
- s->statem.enc_write_state = ENC_WRITE_STATE_VALID;
- ret = 1;
- err:
-+ OPENSSL_cleanse(key, sizeof(key));
- OPENSSL_cleanse(secret, sizeof(secret));
- return ret;
- }
-diff --git test/build.info test/build.info
-index 6357a7f2fe..3b8d5ee765 100644
---- test/build.info
-+++ test/build.info
-@@ -546,7 +546,7 @@ INCLUDE_MAIN___test_libtestutil_OLB = /INCLUDE=MAIN
- # We disable this test completely in a shared build because it deliberately
- # redefines some internal libssl symbols. This doesn't work in a non-shared
- # build
-- IF[{- !$disabled{shared} -}]
-+ IF[{- !$disabled{shared} && $disabled{ktls} -}]
- PROGRAMS_NO_INST=tls13secretstest
- SOURCE[tls13secretstest]=tls13secretstest.c
- SOURCE[tls13secretstest]= ../ssl/tls13_enc.c ../ssl/packet.c
-diff --git test/recipes/80-test_ssl_old.t test/recipes/80-test_ssl_old.t
-index 19772f61ef..f3cfda0507 100644
---- test/recipes/80-test_ssl_old.t
-+++ test/recipes/80-test_ssl_old.t
-@@ -327,11 +327,9 @@ sub testssl {
- }
-
-
-- # plan tests => 11;
--
- subtest 'standard SSL tests' => sub {
-- ######################################################################
-- plan tests => 13;
-+ ######################################################################
-+ plan tests => 19;
-
- SKIP: {
- skip "SSLv3 is not supported by this OpenSSL build", 4
-@@ -356,8 +354,8 @@ sub testssl {
- }
-
- SKIP: {
-- skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 8
-- if $no_anytls;
-+ skip "Neither SSLv3 nor any TLS version are supported by this OpenSSL build", 14
-+ if $no_anytls;
-
- SKIP: {
- skip "skipping test of sslv2/sslv3 w/o (EC)DHE test", 1 if $dsa_cert;
-@@ -378,17 +376,29 @@ sub testssl {
- 'test sslv2/sslv3 with both client and server authentication via BIO pair and app verify');
-
- SKIP: {
-- skip "No IPv4 available on this machine", 1
-+ skip "No IPv4 available on this machine", 4
- unless !disabled("sock") && have_IPv4();
- ok(run(test([@ssltest, "-ipv4"])),
- 'test TLS via IPv4');
-+ ok(run(test([@ssltest, "-ipv4", "-client_ktls"])),
-+ 'test TLS via IPv4 + ktls(client)');
-+ ok(run(test([@ssltest, "-ipv4", "-server_ktls"])),
-+ 'test TLS via IPv4 + ktls(server)');
-+ ok(run(test([@ssltest, "-ipv4", "-client_ktls", "-server_ktls"])),
-+ 'test TLS via IPv4 + ktls');
- }
-
- SKIP: {
-- skip "No IPv6 available on this machine", 1
-+ skip "No IPv6 available on this machine", 4
- unless !disabled("sock") && have_IPv6();
- ok(run(test([@ssltest, "-ipv6"])),
- 'test TLS via IPv6');
-+ ok(run(test([@ssltest, "-ipv6", "-client_ktls"])),
-+ 'test TLS via IPv6 + ktls(client)');
-+ ok(run(test([@ssltest, "-ipv6", "-server_ktls"])),
-+ 'test TLS via IPv6 + ktls(client)');
-+ ok(run(test([@ssltest, "-ipv6", "-client_ktls", "-server_ktls"])),
-+ 'test TLS via IPv6 + ktls');
- }
- }
- };
-diff --git test/recipes/90-test_tls13secrets.t test/recipes/90-test_tls13secrets.t
-index 5490885309..3478e540ed 100644
---- test/recipes/90-test_tls13secrets.t
-+++ test/recipes/90-test_tls13secrets.t
-@@ -13,7 +13,7 @@ my $test_name = "tls13secrets";
- setup($test_name);
-
- plan skip_all => "$test_name is not supported in this build"
-- if disabled("tls1_3") || disabled("shared");
-+ if disabled("tls1_3") || disabled("shared") || !disabled("ktls");
-
- plan tests => 1;
-
-diff --git test/sslapitest.c test/sslapitest.c
-index 6b5d9449a0..47ba76f0a5 100644
---- test/sslapitest.c
-+++ test/sslapitest.c
-@@ -7,6 +7,7 @@
- * https://www.openssl.org/source/license.html
- */
-
-+#include <stdio.h>
- #include <string.h>
-
- #include <openssl/opensslconf.h>
-@@ -17,12 +18,14 @@
- #include <openssl/srp.h>
- #include <openssl/txt_db.h>
- #include <openssl/aes.h>
-+#include <openssl/rand.h>
- #include <openssl/x509v3.h>
-
- #include "ssltestlib.h"
- #include "testutil.h"
- #include "testutil/output.h"
- #include "internal/nelem.h"
-+#include "internal/ktls.h"
- #include "../ssl/ssl_local.h"
-
- #ifndef OPENSSL_NO_TLS1_3
-@@ -780,6 +783,433 @@ static int execute_test_large_message(const SSL_METHOD *smeth,
- return testresult;
- }
-
-+#if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_KTLS) && \
-+ !(defined(OPENSSL_NO_TLS1_3) && defined(OPENSSL_NO_TLS1_2))
-+/* sock must be connected */
-+static int ktls_chk_platform(int sock)
-+{
-+ if (!ktls_enable(sock))
-+ return 0;
-+ return 1;
-+}
-+
-+static int ping_pong_query(SSL *clientssl, SSL *serverssl)
-+{
-+ static char count = 1;
-+ unsigned char cbuf[16000] = {0};
-+ unsigned char sbuf[16000];
-+ size_t err = 0;
-+ char crec_wseq_before[SEQ_NUM_SIZE];
-+ char crec_wseq_after[SEQ_NUM_SIZE];
-+ char crec_rseq_before[SEQ_NUM_SIZE];
-+ char crec_rseq_after[SEQ_NUM_SIZE];
-+ char srec_wseq_before[SEQ_NUM_SIZE];
-+ char srec_wseq_after[SEQ_NUM_SIZE];
-+ char srec_rseq_before[SEQ_NUM_SIZE];
-+ char srec_rseq_after[SEQ_NUM_SIZE];
-+
-+ cbuf[0] = count++;
-+ memcpy(crec_wseq_before, &clientssl->rlayer.write_sequence, SEQ_NUM_SIZE);
-+ memcpy(crec_rseq_before, &clientssl->rlayer.read_sequence, SEQ_NUM_SIZE);
-+ memcpy(srec_wseq_before, &serverssl->rlayer.write_sequence, SEQ_NUM_SIZE);
-+ memcpy(srec_rseq_before, &serverssl->rlayer.read_sequence, SEQ_NUM_SIZE);
-+
-+ if (!TEST_true(SSL_write(clientssl, cbuf, sizeof(cbuf)) == sizeof(cbuf)))
-+ goto end;
-+
-+ while ((err = SSL_read(serverssl, &sbuf, sizeof(sbuf))) != sizeof(sbuf)) {
-+ if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_READ) {
-+ goto end;
-+ }
-+ }
-+
-+ if (!TEST_true(SSL_write(serverssl, sbuf, sizeof(sbuf)) == sizeof(sbuf)))
-+ goto end;
-+
-+ while ((err = SSL_read(clientssl, &cbuf, sizeof(cbuf))) != sizeof(cbuf)) {
-+ if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ) {
-+ goto end;
-+ }
-+ }
-+
-+ memcpy(crec_wseq_after, &clientssl->rlayer.write_sequence, SEQ_NUM_SIZE);
-+ memcpy(crec_rseq_after, &clientssl->rlayer.read_sequence, SEQ_NUM_SIZE);
-+ memcpy(srec_wseq_after, &serverssl->rlayer.write_sequence, SEQ_NUM_SIZE);
-+ memcpy(srec_rseq_after, &serverssl->rlayer.read_sequence, SEQ_NUM_SIZE);
-+
-+ /* verify the payload */
-+ if (!TEST_mem_eq(cbuf, sizeof(cbuf), sbuf, sizeof(sbuf)))
-+ goto end;
-+
-+ /*
-+ * If ktls is used then kernel sequences are used instead of
-+ * OpenSSL sequences
-+ */
-+ if (!BIO_get_ktls_send(clientssl->wbio)) {
-+ if (!TEST_mem_ne(crec_wseq_before, SEQ_NUM_SIZE,
-+ crec_wseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ } else {
-+ if (!TEST_mem_eq(crec_wseq_before, SEQ_NUM_SIZE,
-+ crec_wseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ }
-+
-+ if (!BIO_get_ktls_send(serverssl->wbio)) {
-+ if (!TEST_mem_ne(srec_wseq_before, SEQ_NUM_SIZE,
-+ srec_wseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ } else {
-+ if (!TEST_mem_eq(srec_wseq_before, SEQ_NUM_SIZE,
-+ srec_wseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ }
-+
-+ if (!BIO_get_ktls_recv(clientssl->wbio)) {
-+ if (!TEST_mem_ne(crec_rseq_before, SEQ_NUM_SIZE,
-+ crec_rseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ } else {
-+ if (!TEST_mem_eq(crec_rseq_before, SEQ_NUM_SIZE,
-+ crec_rseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ }
-+
-+ if (!BIO_get_ktls_recv(serverssl->wbio)) {
-+ if (!TEST_mem_ne(srec_rseq_before, SEQ_NUM_SIZE,
-+ srec_rseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ } else {
-+ if (!TEST_mem_eq(srec_rseq_before, SEQ_NUM_SIZE,
-+ srec_rseq_after, SEQ_NUM_SIZE))
-+ goto end;
-+ }
-+
-+ return 1;
-+end:
-+ return 0;
-+}
-+
-+static int execute_test_ktls(int cis_ktls, int sis_ktls,
-+ int tls_version, const char *cipher)
-+{
-+ SSL_CTX *cctx = NULL, *sctx = NULL;
-+ SSL *clientssl = NULL, *serverssl = NULL;
-+ int ktls_used = 0, testresult = 0;
-+ int cfd = -1, sfd = -1;
-+ int rx_supported;
-+
-+ if (!TEST_true(create_test_sockets(&cfd, &sfd)))
-+ goto end;
-+
-+ /* Skip this test if the platform does not support ktls */
-+ if (!ktls_chk_platform(cfd)) {
-+ TEST_info("Kernel does not support KTLS");
-+ testresult = 1;
-+ goto end;
-+ }
-+
-+ /* Create a session based on SHA-256 */
-+ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
-+ TLS_client_method(),
-+ tls_version, tls_version,
-+ &sctx, &cctx, cert, privkey)))
-+ goto end;
-+
-+ if (tls_version == TLS1_3_VERSION) {
-+ if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, cipher))
-+ || !TEST_true(SSL_CTX_set_ciphersuites(sctx, cipher)))
-+ goto end;
-+ } else {
-+ if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
-+ || !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher)))
-+ goto end;
-+ }
-+
-+ if (!TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
-+ &clientssl, sfd, cfd)))
-+ goto end;
-+
-+ if (cis_ktls) {
-+ if (!TEST_true(SSL_set_options(clientssl, SSL_OP_ENABLE_KTLS)))
-+ goto end;
-+ }
-+
-+ if (sis_ktls) {
-+ if (!TEST_true(SSL_set_options(serverssl, SSL_OP_ENABLE_KTLS)))
-+ goto end;
-+ }
-+
-+ if (!TEST_true(create_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE)))
-+ goto end;
-+
-+ /*
-+ * The running kernel may not support a given cipher suite
-+ * or direction, so just check that KTLS isn't used when it
-+ * isn't enabled.
-+ */
-+ if (!cis_ktls) {
-+ if (!TEST_false(BIO_get_ktls_send(clientssl->wbio)))
-+ goto end;
-+ } else {
-+ if (BIO_get_ktls_send(clientssl->wbio))
-+ ktls_used = 1;
-+ }
-+
-+ if (!sis_ktls) {
-+ if (!TEST_false(BIO_get_ktls_send(serverssl->wbio)))
-+ goto end;
-+ } else {
-+ if (BIO_get_ktls_send(serverssl->wbio))
-+ ktls_used = 1;
-+ }
-+
-+#if defined(OPENSSL_NO_KTLS_RX)
-+ rx_supported = 0;
-+#else
-+ rx_supported = 1;
-+#endif
-+ if (!cis_ktls || !rx_supported) {
-+ if (!TEST_false(BIO_get_ktls_recv(clientssl->rbio)))
-+ goto end;
-+ } else {
-+ if (BIO_get_ktls_send(clientssl->rbio))
-+ ktls_used = 1;
-+ }
-+
-+ if (!sis_ktls || !rx_supported) {
-+ if (!TEST_false(BIO_get_ktls_recv(serverssl->rbio)))
-+ goto end;
-+ } else {
-+ if (BIO_get_ktls_send(serverssl->rbio))
-+ ktls_used = 1;
-+ }
-+
-+ if ((cis_ktls || sis_ktls) && !ktls_used) {
-+ TEST_info("KTLS not supported for %s cipher %s",
-+ tls_version == TLS1_3_VERSION ? "TLS 1.3" :
-+ "TLS 1.2", cipher);
-+ testresult = 1;
-+ goto end;
-+ }
-+
-+ if (!TEST_true(ping_pong_query(clientssl, serverssl)))
-+ goto end;
-+
-+ testresult = 1;
-+end:
-+ if (clientssl) {
-+ SSL_shutdown(clientssl);
-+ SSL_free(clientssl);
-+ }
-+ if (serverssl) {
-+ SSL_shutdown(serverssl);
-+ SSL_free(serverssl);
-+ }
-+ SSL_CTX_free(sctx);
-+ SSL_CTX_free(cctx);
-+ serverssl = clientssl = NULL;
-+ if (cfd != -1)
-+ close(cfd);
-+ if (sfd != -1)
-+ close(sfd);
-+ return testresult;
-+}
-+
-+#define SENDFILE_SZ (16 * 4096)
-+#define SENDFILE_CHUNK (4 * 4096)
-+#define min(a,b) ((a) > (b) ? (b) : (a))
-+
-+static int execute_test_ktls_sendfile(int tls_version, const char *cipher)
-+{
-+ SSL_CTX *cctx = NULL, *sctx = NULL;
-+ SSL *clientssl = NULL, *serverssl = NULL;
-+ unsigned char *buf, *buf_dst;
-+ BIO *out = NULL, *in = NULL;
-+ int cfd = -1, sfd = -1, ffd, err;
-+ ssize_t chunk_size = 0;
-+ off_t chunk_off = 0;
-+ int testresult = 0;
-+ FILE *ffdp;
-+
-+ buf = OPENSSL_zalloc(SENDFILE_SZ);
-+ buf_dst = OPENSSL_zalloc(SENDFILE_SZ);
-+ if (!TEST_ptr(buf) || !TEST_ptr(buf_dst)
-+ || !TEST_true(create_test_sockets(&cfd, &sfd)))
-+ goto end;
-+
-+ /* Skip this test if the platform does not support ktls */
-+ if (!ktls_chk_platform(sfd)) {
-+ TEST_info("Kernel does not support KTLS");
-+ testresult = 1;
-+ goto end;
-+ }
-+
-+ /* Create a session based on SHA-256 */
-+ if (!TEST_true(create_ssl_ctx_pair(TLS_server_method(),
-+ TLS_client_method(),
-+ tls_version, tls_version,
-+ &sctx, &cctx, cert, privkey)))
-+ goto end;
-+
-+ if (tls_version == TLS1_3_VERSION) {
-+ if (!TEST_true(SSL_CTX_set_ciphersuites(cctx, cipher))
-+ || !TEST_true(SSL_CTX_set_ciphersuites(sctx, cipher)))
-+ goto end;
-+ } else {
-+ if (!TEST_true(SSL_CTX_set_cipher_list(cctx, cipher))
-+ || !TEST_true(SSL_CTX_set_cipher_list(sctx, cipher)))
-+ goto end;
-+ }
-+
-+ if (!TEST_true(create_ssl_objects2(sctx, cctx, &serverssl,
-+ &clientssl, sfd, cfd)))
-+ goto end;
-+
-+ if (!TEST_true(SSL_set_options(serverssl, SSL_OP_ENABLE_KTLS)))
-+ goto end;
-+
-+ if (!TEST_true(create_ssl_connection(serverssl, clientssl,
-+ SSL_ERROR_NONE)))
-+ goto end;
-+
-+ if (!BIO_get_ktls_send(serverssl->wbio)) {
-+ TEST_info("Failed to enable KTLS for %s cipher %s",
-+ tls_version == TLS1_3_VERSION ? "TLS 1.3" :
-+ "TLS 1.2", cipher);
-+ testresult = 1;
-+ goto end;
-+ }
-+
-+ RAND_bytes(buf, SENDFILE_SZ);
-+
-+ out = BIO_new_file(tmpfilename, "wb");
-+ if (!TEST_ptr(out))
-+ goto end;
-+
-+ if (BIO_write(out, buf, SENDFILE_SZ) != SENDFILE_SZ)
-+ goto end;
-+
-+ BIO_free(out);
-+ out = NULL;
-+ in = BIO_new_file(tmpfilename, "rb");
-+ BIO_get_fp(in, &ffdp);
-+ ffd = fileno(ffdp);
-+
-+ while (chunk_off < SENDFILE_SZ) {
-+ chunk_size = min(SENDFILE_CHUNK, SENDFILE_SZ - chunk_off);
-+ while ((err = SSL_sendfile(serverssl,
-+ ffd,
-+ chunk_off,
-+ chunk_size,
-+ 0)) != chunk_size) {
-+ if (SSL_get_error(serverssl, err) != SSL_ERROR_WANT_WRITE)
-+ goto end;
-+ }
-+ while ((err = SSL_read(clientssl,
-+ buf_dst + chunk_off,
-+ chunk_size)) != chunk_size) {
-+ if (SSL_get_error(clientssl, err) != SSL_ERROR_WANT_READ)
-+ goto end;
-+ }
-+
-+ /* verify the payload */
-+ if (!TEST_mem_eq(buf_dst + chunk_off,
-+ chunk_size,
-+ buf + chunk_off,
-+ chunk_size))
-+ goto end;
-+
-+ chunk_off += chunk_size;
-+ }
-+
-+ testresult = 1;
-+end:
-+ if (clientssl) {
-+ SSL_shutdown(clientssl);
-+ SSL_free(clientssl);
-+ }
-+ if (serverssl) {
-+ SSL_shutdown(serverssl);
-+ SSL_free(serverssl);
-+ }
-+ SSL_CTX_free(sctx);
-+ SSL_CTX_free(cctx);
-+ serverssl = clientssl = NULL;
-+ BIO_free(out);
-+ BIO_free(in);
-+ if (cfd != -1)
-+ close(cfd);
-+ if (sfd != -1)
-+ close(sfd);
-+ OPENSSL_free(buf);
-+ OPENSSL_free(buf_dst);
-+ return testresult;
-+}
-+
-+static struct ktls_test_cipher {
-+ int tls_version;
-+ const char *cipher;
-+} ktls_test_ciphers[] = {
-+# if !defined(OPENSSL_NO_TLS1_2)
-+# ifdef OPENSSL_KTLS_AES_GCM_128
-+ { TLS1_2_VERSION, "AES128-GCM-SHA256" },
-+# endif
-+# ifdef OPENSSL_KTLS_AES_CCM_128
-+ { TLS1_2_VERSION, "AES128-CCM"},
-+# endif
-+# ifdef OPENSSL_KTLS_AES_GCM_256
-+ { TLS1_2_VERSION, "AES256-GCM-SHA384"},
-+# endif
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ { TLS1_2_VERSION, "ECDHE-RSA-CHACHA20-POLY1305"},
-+# endif
-+# endif
-+# if !defined(OPENSSL_NO_TLS1_3)
-+# ifdef OPENSSL_KTLS_AES_GCM_128
-+ { TLS1_3_VERSION, "TLS_AES_128_GCM_SHA256" },
-+# endif
-+# ifdef OPENSSL_KTLS_AES_CCM_128
-+ { TLS1_3_VERSION, "TLS_AES_128_CCM_SHA256" },
-+# endif
-+# ifdef OPENSSL_KTLS_AES_GCM_256
-+ { TLS1_3_VERSION, "TLS_AES_256_GCM_SHA384" },
-+# endif
-+# ifdef OPENSSL_KTLS_CHACHA20_POLY1305
-+ { TLS1_3_VERSION, "TLS_CHACHA20_POLY1305_SHA256" },
-+# endif
-+# endif
-+};
-+
-+#define NUM_KTLS_TEST_CIPHERS \
-+ (sizeof(ktls_test_ciphers) / sizeof(ktls_test_ciphers[0]))
-+
-+static int test_ktls(int test)
-+{
-+ struct ktls_test_cipher *cipher;
-+ int cis_ktls, sis_ktls;
-+
-+ OPENSSL_assert(test / 4 < NUM_KTLS_TEST_CIPHERS);
-+ cipher = &ktls_test_ciphers[test / 4];
-+
-+ cis_ktls = (test & 1) != 0;
-+ sis_ktls = (test & 2) != 0;
-+
-+ return execute_test_ktls(cis_ktls, sis_ktls, cipher->tls_version,
-+ cipher->cipher);
-+}
-+
-+static int test_ktls_sendfile(int tst)
-+{
-+ struct ktls_test_cipher *cipher;
-+
-+ OPENSSL_assert(tst < NUM_KTLS_TEST_CIPHERS);
-+ cipher = &ktls_test_ciphers[tst];
-+
-+ return execute_test_ktls_sendfile(cipher->tls_version, cipher->cipher);
-+}
-+#endif
-+
- static int test_large_message_tls(void)
- {
- return execute_test_large_message(TLS_server_method(), TLS_client_method(),
-@@ -6944,6 +7374,12 @@ int setup_tests(void)
- return 0;
- }
-
-+#if !defined(OPENSSL_NO_KTLS) && !defined(OPENSSL_NO_SOCK)
-+# if !defined(OPENSSL_NO_TLS1_2) || !defined(OPENSSL_NO_TLS1_3)
-+ ADD_ALL_TESTS(test_ktls, NUM_KTLS_TEST_CIPHERS * 4);
-+ ADD_ALL_TESTS(test_ktls_sendfile, NUM_KTLS_TEST_CIPHERS);
-+# endif
-+#endif
- ADD_TEST(test_large_message_tls);
- ADD_TEST(test_large_message_tls_read_ahead);
- #ifndef OPENSSL_NO_DTLS
-diff --git test/ssltest_old.c test/ssltest_old.c
-index 3601066b50..96b38a4636 100644
---- test/ssltest_old.c
-+++ test/ssltest_old.c
-@@ -731,6 +731,8 @@ static void sv_usage(void)
- fprintf(stderr, " -client_sess_in <file> - Read the client session from a file\n");
- fprintf(stderr, " -should_reuse <number> - The expected state of reusing the session\n");
- fprintf(stderr, " -no_ticket - do not issue TLS session ticket\n");
-+ fprintf(stderr, " -client_ktls - try to enable client KTLS\n");
-+ fprintf(stderr, " -server_ktls - try to enable server KTLS\n");
- }
-
- static void print_key_details(BIO *out, EVP_PKEY *key)
-@@ -905,6 +907,7 @@ int main(int argc, char *argv[])
- int number = 1, reuse = 0;
- int should_reuse = -1;
- int no_ticket = 0;
-+ int client_ktls = 0, server_ktls = 0;
- long bytes = 256L;
- #ifndef OPENSSL_NO_DH
- DH *dh;
-@@ -1215,6 +1218,10 @@ int main(int argc, char *argv[])
- should_reuse = !!atoi(*(++argv));
- } else if (strcmp(*argv, "-no_ticket") == 0) {
- no_ticket = 1;
-+ } else if (strcmp(*argv, "-client_ktls") == 0) {
-+ client_ktls = 1;
-+ } else if (strcmp(*argv, "-server_ktls") == 0) {
-+ server_ktls = 1;
- } else {
- int rv;
- arg = argv[0];
-@@ -1760,6 +1767,10 @@ int main(int argc, char *argv[])
-
- if (sn_client)
- SSL_set_tlsext_host_name(c_ssl, sn_client);
-+ if (client_ktls)
-+ SSL_set_options(c_ssl, SSL_OP_ENABLE_KTLS);
-+ if (server_ktls)
-+ SSL_set_options(s_ssl, SSL_OP_ENABLE_KTLS);
-
- if (!set_protocol_version(server_min_proto, s_ssl, SSL_CTRL_SET_MIN_PROTO_VERSION))
- goto end;
-diff --git test/ssltestlib.c test/ssltestlib.c
-index 456afdf471..a13fdbc4cc 100644
---- test/ssltestlib.c
-+++ test/ssltestlib.c
-@@ -16,6 +16,14 @@
-
- #ifdef OPENSSL_SYS_UNIX
- # include <unistd.h>
-+#ifndef OPENSSL_NO_KTLS
-+# include <netinet/in.h>
-+# include <netinet/in.h>
-+# include <arpa/inet.h>
-+# include <sys/socket.h>
-+# include <unistd.h>
-+# include <fcntl.h>
-+#endif
-
- static ossl_inline void ossl_sleep(unsigned int millis)
- {
-@@ -763,6 +771,113 @@ int create_ssl_ctx_pair(const SSL_METHOD *sm, const SSL_METHOD *cm,
-
- #define MAXLOOPS 1000000
-
-+#if !defined(OPENSSL_NO_KTLS) && !defined(OPENSSL_NO_SOCK)
-+static int set_nb(int fd)
-+{
-+ int flags;
-+
-+ flags = fcntl(fd,F_GETFL,0);
-+ if (flags == -1)
-+ return flags;
-+ flags = fcntl(fd, F_SETFL, flags | O_NONBLOCK);
-+ return flags;
-+}
-+
-+int create_test_sockets(int *cfdp, int *sfdp)
-+{
-+ struct sockaddr_in sin;
-+ const char *host = "127.0.0.1";
-+ int cfd_connected = 0, ret = 0;
-+ socklen_t slen = sizeof(sin);
-+ int afd = -1, cfd = -1, sfd = -1;
-+
-+ memset ((char *) &sin, 0, sizeof(sin));
-+ sin.sin_family = AF_INET;
-+ sin.sin_addr.s_addr = inet_addr(host);
-+
-+ afd = socket(AF_INET, SOCK_STREAM, 0);
-+ if (afd < 0)
-+ return 0;
-+
-+ if (bind(afd, (struct sockaddr*)&sin, sizeof(sin)) < 0)
-+ goto out;
-+
-+ if (getsockname(afd, (struct sockaddr*)&sin, &slen) < 0)
-+ goto out;
-+
-+ if (listen(afd, 1) < 0)
-+ goto out;
-+
-+ cfd = socket(AF_INET, SOCK_STREAM, 0);
-+ if (cfd < 0)
-+ goto out;
-+
-+ if (set_nb(afd) == -1)
-+ goto out;
-+
-+ while (sfd == -1 || !cfd_connected ) {
-+ sfd = accept(afd, NULL, 0);
-+ if (sfd == -1 && errno != EAGAIN)
-+ goto out;
-+
-+ if (!cfd_connected && connect(cfd, (struct sockaddr*)&sin, sizeof(sin)) < 0)
-+ goto out;
-+ else
-+ cfd_connected = 1;
-+ }
-+
-+ if (set_nb(cfd) == -1 || set_nb(sfd) == -1)
-+ goto out;
-+ ret = 1;
-+ *cfdp = cfd;
-+ *sfdp = sfd;
-+ goto success;
-+
-+out:
-+ if (cfd != -1)
-+ close(cfd);
-+ if (sfd != -1)
-+ close(sfd);
-+success:
-+ if (afd != -1)
-+ close(afd);
-+ return ret;
-+}
-+
-+int create_ssl_objects2(SSL_CTX *serverctx, SSL_CTX *clientctx, SSL **sssl,
-+ SSL **cssl, int sfd, int cfd)
-+{
-+ SSL *serverssl = NULL, *clientssl = NULL;
-+ BIO *s_to_c_bio = NULL, *c_to_s_bio = NULL;
-+
-+ if (*sssl != NULL)
-+ serverssl = *sssl;
-+ else if (!TEST_ptr(serverssl = SSL_new(serverctx)))
-+ goto error;
-+ if (*cssl != NULL)
-+ clientssl = *cssl;
-+ else if (!TEST_ptr(clientssl = SSL_new(clientctx)))
-+ goto error;
-+
-+ if (!TEST_ptr(s_to_c_bio = BIO_new_socket(sfd, BIO_NOCLOSE))
-+ || !TEST_ptr(c_to_s_bio = BIO_new_socket(cfd, BIO_NOCLOSE)))
-+ goto error;
-+
-+ SSL_set_bio(clientssl, c_to_s_bio, c_to_s_bio);
-+ SSL_set_bio(serverssl, s_to_c_bio, s_to_c_bio);
-+ *sssl = serverssl;
-+ *cssl = clientssl;
-+ return 1;
-+
-+ error:
-+ SSL_free(serverssl);
-+ SSL_free(clientssl);
-+ BIO_free(s_to_c_bio);
-+ BIO_free(c_to_s_bio);
-+ return 0;
-+}
-+#endif
-+
- /*
- * NOTE: Transfers control of the BIOs - this function will free them on error
- */
-diff --git test/ssltestlib.h test/ssltestlib.h
-index 17b278219a..756975435d 100644
---- test/ssltestlib.h
-+++ test/ssltestlib.h
-@@ -20,6 +20,9 @@ int create_ssl_objects(SSL_CTX *serverctx, SSL_CTX *clientctx, SSL **sssl,
- SSL **cssl, BIO *s_to_c_fbio, BIO *c_to_s_fbio);
- int create_bare_ssl_connection(SSL *serverssl, SSL *clientssl, int want,
- int read);
-+int create_ssl_objects2(SSL_CTX *serverctx, SSL_CTX *clientctx, SSL **sssl,
-+ SSL **cssl, int sfd, int cfd);
-+int create_test_sockets(int *cfd, int *sfd);
- int create_ssl_connection(SSL *serverssl, SSL *clientssl, int want);
- void shutdown_ssl_connection(SSL *serverssl, SSL *clientssl);
-
-diff --git util/libssl.num util/libssl.num
-index 297522c363..5b3c048871 100644
---- util/libssl.num
-+++ util/libssl.num
-@@ -498,3 +498,4 @@ SSL_CTX_get_recv_max_early_data 498 1_1_1 EXIST::FUNCTION:
- SSL_CTX_set_recv_max_early_data 499 1_1_1 EXIST::FUNCTION:
- SSL_CTX_set_post_handshake_auth 500 1_1_1 EXIST::FUNCTION:
- SSL_get_signature_type_nid 501 1_1_1a EXIST::FUNCTION:
-+SSL_sendfile 502 1_1_1e EXIST::FUNCTION:
-diff --git util/private.num util/private.num
-index bc7d967b5d..5bfbfc9fa4 100644
---- util/private.num
-+++ util/private.num
-@@ -109,6 +109,8 @@ BIO_get_buffer_num_lines define
- BIO_get_cipher_ctx define
- BIO_get_cipher_status define
- BIO_get_close define
-+BIO_get_ktls_send define
-+BIO_get_ktls_recv define
- BIO_get_conn_address define
- BIO_get_conn_hostname define
- BIO_get_conn_port define
diff --git a/security/openssl111/files/extra-patch-util_process__docs.pl b/security/openssl111/files/extra-patch-util_process__docs.pl
deleted file mode 100644
--- a/security/openssl111/files/extra-patch-util_process__docs.pl
+++ /dev/null
@@ -1,20 +0,0 @@
---- util/process_docs.pl.orig 2018-09-11 12:48:25 UTC
-+++ util/process_docs.pl
-@@ -43,7 +43,7 @@ GetOptions(\%options,
- );
-
- unless ($options{section}) {
-- $options{section} = [ 1, 3, 5, 7 ];
-+ $options{section} = [ 1, 5 ];
- }
- unless ($options{sourcedir}) {
- $options{sourcedir} = catdir($config{sourcedir}, "doc");
-@@ -98,7 +98,7 @@ foreach my $section (sort @{$options{sec
- my $suffix = { man => ".$podinfo{section}".($options{suffix} // ""),
- html => ".html" } -> {$options{type}};
- my $generate = { man => "pod2man --name=$name --section=$podinfo{section} --center=OpenSSL --release=$config{version} \"$podpath\"",
-- html => "pod2html \"--podroot=$options{sourcedir}\" --htmldir=$updir --podpath=man1:man3:man5:man7 \"--infile=$podpath\" \"--title=$podname\" --quiet"
-+ html => "pod2html \"--podroot=$options{sourcedir}\" --htmldir=$updir --podpath=man1:man5 \"--infile=$podpath\" \"--title=$podname\" --quiet"
- } -> {$options{type}};
- my $output_dir = catdir($options{destdir}, "man$podinfo{section}");
- my $output_file = $podname . $suffix;
diff --git a/security/openssl111/files/patch-crypto_async_arch_async__posix.h b/security/openssl111/files/patch-crypto_async_arch_async__posix.h
deleted file mode 100644
--- a/security/openssl111/files/patch-crypto_async_arch_async__posix.h
+++ /dev/null
@@ -1,32 +0,0 @@
-commit e883812f463c1623249e038698ccaddf2baa34d8
-Author: Warner Losh <imp@FreeBSD.org>
-Date: Mon Mar 18 19:48:22 2024 -0600
-
- posix_async: FreeBSD also defines {make|swap|get|set}context
-
- FreeBSD also defines {make|swap|get|set}context for backward
- compatibility, despite also exposing POSIX_VERSION 200809L
- in FreeBSD 15-current.
-
- Note: There's no fallback for POSIX_VERSION 200809 without these
- routines, so maybe that should be a #error? ... But that's a questionf
- or upstream.
-
- FreeBSD has defined these interfaces since FreeBSD 4.7, released over 20
- years ago, so no further nuance in FreeBSD version number is necessary.
-
- Pull Request: https://github.com/openssl/openssl/pull/23885
-
-diff --git a/crypto/async/arch/async_posix.h b/crypto/async/arch/async_posix.h
-index a17c6b8e68af..2d97ec3acc9b 100644
---- crypto/async/arch/async_posix.h
-+++ crypto/async/arch/async_posix.h
-@@ -18,7 +18,7 @@
- # include <unistd.h>
-
- # if _POSIX_VERSION >= 200112L \
-- && (_POSIX_VERSION < 200809L || defined(__GLIBC__))
-+ && (_POSIX_VERSION < 200809L || defined(__GLIBC__) || defined(__FreeBSD__))
-
- # include <pthread.h>
-
diff --git a/security/openssl111/files/pkg-message.in b/security/openssl111/files/pkg-message.in
deleted file mode 100644
--- a/security/openssl111/files/pkg-message.in
+++ /dev/null
@@ -1,8 +0,0 @@
-[
-{ type: install
- message: <<EOM
-Copy %%PREFIX%%/openssl/openssl.cnf.sample to %%PREFIX%%/openssl/openssl.cnf
-and edit it to fit your needs.
-EOM
-}
-]
diff --git a/security/openssl111/pkg-descr b/security/openssl111/pkg-descr
deleted file mode 100644
--- a/security/openssl111/pkg-descr
+++ /dev/null
@@ -1,13 +0,0 @@
-The OpenSSL Project is a collaborative effort to develop a robust,
-commercial-grade, full-featured, and Open Source toolkit implementing
-the Secure Sockets Layer (SSL v3) and Transport Layer Security (TLS v1,
-v1.1, v1.2, v1.3) protocols with full-strength cryptography world-wide.
-The project is managed by a worldwide community of volunteers that use
-the Internet to communicate, plan, and develop the OpenSSL tookit
-and its related documentation.
-
-OpenSSL is based on the excellent SSLeay library developed by Eric
-A. Young and Tim J. Hudson. The OpenSSL toolkit is licensed under
-an Apache-style licence, which basically means that you are free
-to get and use it for commercial and non-commercial purposes subject
-to some simple license conditions.
diff --git a/security/openssl111/pkg-plist b/security/openssl111/pkg-plist
deleted file mode 100644
--- a/security/openssl111/pkg-plist
+++ /dev/null
@@ -1,226 +0,0 @@
-bin/c_rehash
-bin/openssl
-include/openssl/aes.h
-include/openssl/asn1.h
-include/openssl/asn1_mac.h
-include/openssl/asn1err.h
-include/openssl/asn1t.h
-include/openssl/async.h
-include/openssl/asyncerr.h
-include/openssl/bio.h
-include/openssl/bioerr.h
-include/openssl/blowfish.h
-include/openssl/bn.h
-include/openssl/bnerr.h
-include/openssl/buffer.h
-include/openssl/buffererr.h
-include/openssl/camellia.h
-include/openssl/cast.h
-include/openssl/cmac.h
-include/openssl/cms.h
-include/openssl/cmserr.h
-include/openssl/comp.h
-include/openssl/comperr.h
-include/openssl/conf.h
-include/openssl/conf_api.h
-include/openssl/conferr.h
-include/openssl/crypto.h
-include/openssl/cryptoerr.h
-include/openssl/ct.h
-include/openssl/cterr.h
-include/openssl/des.h
-include/openssl/dh.h
-include/openssl/dherr.h
-include/openssl/dsa.h
-include/openssl/dsaerr.h
-include/openssl/dtls1.h
-include/openssl/e_os2.h
-include/openssl/ebcdic.h
-include/openssl/ec.h
-include/openssl/ecdh.h
-include/openssl/ecdsa.h
-include/openssl/ecerr.h
-include/openssl/engine.h
-include/openssl/engineerr.h
-include/openssl/err.h
-include/openssl/evp.h
-include/openssl/evperr.h
-include/openssl/hmac.h
-include/openssl/idea.h
-include/openssl/kdf.h
-include/openssl/kdferr.h
-include/openssl/lhash.h
-include/openssl/md2.h
-include/openssl/md4.h
-include/openssl/md5.h
-include/openssl/mdc2.h
-include/openssl/modes.h
-include/openssl/obj_mac.h
-include/openssl/objects.h
-include/openssl/objectserr.h
-include/openssl/ocsp.h
-include/openssl/ocsperr.h
-include/openssl/opensslconf.h
-include/openssl/opensslv.h
-include/openssl/ossl_typ.h
-include/openssl/pem.h
-include/openssl/pem2.h
-include/openssl/pemerr.h
-include/openssl/pkcs12.h
-include/openssl/pkcs12err.h
-include/openssl/pkcs7.h
-include/openssl/pkcs7err.h
-include/openssl/rand.h
-include/openssl/rand_drbg.h
-include/openssl/randerr.h
-include/openssl/rc2.h
-include/openssl/rc4.h
-include/openssl/rc5.h
-include/openssl/ripemd.h
-include/openssl/rsa.h
-include/openssl/rsaerr.h
-include/openssl/safestack.h
-include/openssl/seed.h
-include/openssl/sha.h
-include/openssl/srp.h
-include/openssl/srtp.h
-include/openssl/ssl.h
-include/openssl/ssl2.h
-include/openssl/ssl3.h
-include/openssl/sslerr.h
-include/openssl/stack.h
-include/openssl/store.h
-include/openssl/storeerr.h
-include/openssl/symhacks.h
-include/openssl/tls1.h
-include/openssl/ts.h
-include/openssl/tserr.h
-include/openssl/txt_db.h
-include/openssl/ui.h
-include/openssl/uierr.h
-include/openssl/whrlpool.h
-include/openssl/x509.h
-include/openssl/x509_vfy.h
-include/openssl/x509err.h
-include/openssl/x509v3.h
-include/openssl/x509v3err.h
-%%SHARED%%lib/engines-1.1/capi.so
-%%SHARED%%lib/engines-1.1/padlock.so
-lib/libcrypto.a
-%%SHARED%%lib/libcrypto.so
-%%SHARED%%lib/libcrypto.so.%%SHLIBVER%%
-lib/libssl.a
-%%SHARED%%lib/libssl.so
-%%SHARED%%lib/libssl.so.%%SHLIBVER%%
-libdata/pkgconfig/libcrypto.pc
-libdata/pkgconfig/libssl.pc
-libdata/pkgconfig/openssl.pc
-share/man/man1/CA.pl.1.gz
-share/man/man1/asn1parse.1.gz
-share/man/man1/c_rehash.1.gz
-share/man/man1/ca.1.gz
-share/man/man1/ciphers.1.gz
-share/man/man1/cms.1.gz
-share/man/man1/crl.1.gz
-share/man/man1/crl2pkcs7.1.gz
-share/man/man1/dgst.1.gz
-share/man/man1/dhparam.1.gz
-share/man/man1/dsa.1.gz
-share/man/man1/dsaparam.1.gz
-share/man/man1/ec.1.gz
-share/man/man1/ecparam.1.gz
-share/man/man1/enc.1.gz
-share/man/man1/engine.1.gz
-share/man/man1/errstr.1.gz
-share/man/man1/gendsa.1.gz
-share/man/man1/genpkey.1.gz
-share/man/man1/genrsa.1.gz
-share/man/man1/list.1.gz
-share/man/man1/nseq.1.gz
-share/man/man1/ocsp.1.gz
-share/man/man1/openssl-asn1parse.1.gz
-share/man/man1/openssl-c_rehash.1.gz
-share/man/man1/openssl-ca.1.gz
-share/man/man1/openssl-ciphers.1.gz
-share/man/man1/openssl-cms.1.gz
-share/man/man1/openssl-crl.1.gz
-share/man/man1/openssl-crl2pkcs7.1.gz
-share/man/man1/openssl-dgst.1.gz
-share/man/man1/openssl-dhparam.1.gz
-share/man/man1/openssl-dsa.1.gz
-share/man/man1/openssl-dsaparam.1.gz
-share/man/man1/openssl-ec.1.gz
-share/man/man1/openssl-ecparam.1.gz
-share/man/man1/openssl-enc.1.gz
-share/man/man1/openssl-engine.1.gz
-share/man/man1/openssl-errstr.1.gz
-share/man/man1/openssl-gendsa.1.gz
-share/man/man1/openssl-genpkey.1.gz
-share/man/man1/openssl-genrsa.1.gz
-share/man/man1/openssl-list.1.gz
-share/man/man1/openssl-nseq.1.gz
-share/man/man1/openssl-ocsp.1.gz
-share/man/man1/openssl-passwd.1.gz
-share/man/man1/openssl-pkcs12.1.gz
-share/man/man1/openssl-pkcs7.1.gz
-share/man/man1/openssl-pkcs8.1.gz
-share/man/man1/openssl-pkey.1.gz
-share/man/man1/openssl-pkeyparam.1.gz
-share/man/man1/openssl-pkeyutl.1.gz
-share/man/man1/openssl-prime.1.gz
-share/man/man1/openssl-rand.1.gz
-share/man/man1/openssl-rehash.1.gz
-share/man/man1/openssl-req.1.gz
-share/man/man1/openssl-rsa.1.gz
-share/man/man1/openssl-rsautl.1.gz
-share/man/man1/openssl-s_client.1.gz
-share/man/man1/openssl-s_server.1.gz
-share/man/man1/openssl-s_time.1.gz
-share/man/man1/openssl-sess_id.1.gz
-share/man/man1/openssl-smime.1.gz
-share/man/man1/openssl-speed.1.gz
-share/man/man1/openssl-spkac.1.gz
-share/man/man1/openssl-srp.1.gz
-share/man/man1/openssl-storeutl.1.gz
-share/man/man1/openssl-ts.1.gz
-share/man/man1/openssl-tsget.1.gz
-share/man/man1/openssl-verify.1.gz
-share/man/man1/openssl-version.1.gz
-share/man/man1/openssl-x509.1.gz
-share/man/man1/openssl.1.gz
-share/man/man1/passwd.1.gz
-share/man/man1/pkcs12.1.gz
-share/man/man1/pkcs7.1.gz
-share/man/man1/pkcs8.1.gz
-share/man/man1/pkey.1.gz
-share/man/man1/pkeyparam.1.gz
-share/man/man1/pkeyutl.1.gz
-share/man/man1/prime.1.gz
-share/man/man1/rand.1.gz
-share/man/man1/rehash.1.gz
-share/man/man1/req.1.gz
-share/man/man1/rsa.1.gz
-share/man/man1/rsautl.1.gz
-share/man/man1/s_client.1.gz
-share/man/man1/s_server.1.gz
-share/man/man1/s_time.1.gz
-share/man/man1/sess_id.1.gz
-share/man/man1/smime.1.gz
-share/man/man1/speed.1.gz
-share/man/man1/spkac.1.gz
-share/man/man1/srp.1.gz
-share/man/man1/storeutl.1.gz
-share/man/man1/ts.1.gz
-share/man/man1/tsget.1.gz
-share/man/man1/verify.1.gz
-share/man/man1/version.1.gz
-share/man/man1/x509.1.gz
-share/man/man5/config.5.gz
-share/man/man5/x509v3_config.5.gz
-%%OPENSSLDIR%%/misc/CA.pl
-%%OPENSSLDIR%%/misc/tsget
-@comment %%OPENSSLDIR%%/misc/tsget.pl
-@sample %%OPENSSLDIR%%/openssl.cnf.dist %%OPENSSLDIR%%/openssl.cnf
-@sample %%OPENSSLDIR%%/ct_log_list.cnf.dist %%OPENSSLDIR%%/ct_log_list.cnf
-@dir %%OPENSSLDIR%%/private
-@dir %%OPENSSLDIR%%/certs
diff --git a/security/openssl111/version.mk b/security/openssl111/version.mk
deleted file mode 100644
--- a/security/openssl111/version.mk
+++ /dev/null
@@ -1 +0,0 @@
-OPENSSL_SHLIBVER?= 11
diff --git a/security/openssl33-quictls/Makefile b/security/openssl33-quictls/Makefile
--- a/security/openssl33-quictls/Makefile
+++ b/security/openssl33-quictls/Makefile
@@ -53,8 +53,6 @@
.if ${MACHINE_ARCH} == "amd64"
OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
.endif
OPTIONS_SUB= yes
diff --git a/security/openssl33/Makefile b/security/openssl33/Makefile
--- a/security/openssl33/Makefile
+++ b/security/openssl33/Makefile
@@ -53,8 +53,6 @@
.if ${MACHINE_ARCH} == "amd64"
OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
.endif
OPTIONS_SUB= yes
diff --git a/security/openssl34/Makefile b/security/openssl34/Makefile
--- a/security/openssl34/Makefile
+++ b/security/openssl34/Makefile
@@ -51,8 +51,6 @@
.if ${MACHINE_ARCH} == "amd64"
OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
.endif
OPTIONS_SUB= yes
diff --git a/security/openssl35/Makefile b/security/openssl35/Makefile
--- a/security/openssl35/Makefile
+++ b/security/openssl35/Makefile
@@ -50,8 +50,6 @@
.if ${MACHINE_ARCH} == "amd64"
OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
.endif
OPTIONS_SUB= yes
diff --git a/security/openssl36/Makefile b/security/openssl36/Makefile
--- a/security/openssl36/Makefile
+++ b/security/openssl36/Makefile
@@ -50,8 +50,6 @@
.if ${MACHINE_ARCH} == "amd64"
OPTIONS_GROUP_OPTIMIZE+= EC
-.elif ${MACHINE_ARCH} == "mips64el"
-OPTIONS_GROUP_OPTIMIZE+= EC
.endif
OPTIONS_SUB= yes
diff --git a/security/openvpn-devel/Makefile b/security/openvpn-devel/Makefile
--- a/security/openvpn-devel/Makefile
+++ b/security/openvpn-devel/Makefile
@@ -57,7 +57,6 @@
OPTIONS_DEFAULT= DCO EASYRSA LZ4 OPENSSL TEST
OPTIONS_SINGLE= SSL
OPTIONS_SINGLE_SSL= MBEDTLS OPENSSL
-OPTIONS_EXCLUDE_FreeBSD_13= DCO # FreeBSD 14 only
# option descriptions and interdependencies
diff --git a/security/openvpn/Makefile b/security/openvpn/Makefile
--- a/security/openvpn/Makefile
+++ b/security/openvpn/Makefile
@@ -45,7 +45,6 @@
OPTIONS_DEFINE= ASYNC_PUSH DCO DOCS EASYRSA EXAMPLES LZ4 LZO PKCS11 SMALL \
TEST UNITTESTS X509ALTUSERNAME
OPTIONS_DEFAULT= DCO EASYRSA LZ4 LZO PKCS11 TEST
-OPTIONS_EXCLUDE_FreeBSD_13= DCO # FreeBSD 14 only
ASYNC_PUSH_DESC= Enable async-push support
DCO_DESC= Data Channel Offload/ovpn(4) support->README.dco.md
diff --git a/security/opie/Makefile b/security/opie/Makefile
--- a/security/opie/Makefile
+++ b/security/opie/Makefile
@@ -23,6 +23,4 @@
LIBDIR=${PREFIX}/lib \
MANDIR=${PREFIX}/share/man/man
-IGNORE_FreeBSD_13= FreeBSD 13 has OPIE in base
-
.include <bsd.port.mk>
diff --git a/security/osv-scanner/Makefile b/security/osv-scanner/Makefile
--- a/security/osv-scanner/Makefile
+++ b/security/osv-scanner/Makefile
@@ -12,7 +12,7 @@
USES= go:1.25+,modules,run
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
_BUILD_VERSION= ${DISTVERSION}
_BUILD_COMMIT= b97d1de
diff --git a/security/p11-kit/Makefile b/security/p11-kit/Makefile
--- a/security/p11-kit/Makefile
+++ b/security/p11-kit/Makefile
@@ -49,10 +49,6 @@
${RMDIR} ${STAGEDIR}${PREFIX}/etc/pkcs11
${MKDIR} ${STAGEDIR}${DATADIR}/certs
${LN} -s /usr/share/certs/trusted ${STAGEDIR}${DATADIR}/certs/anchors
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400024
- ${LN} -s /usr/share/certs/blacklisted ${STAGEDIR}${DATADIR}/certs/blocklist
-.else
${LN} -s /usr/share/certs/untrusted ${STAGEDIR}${DATADIR}/certs/blocklist
-.endif
.include <bsd.port.mk>
diff --git a/security/p5-Crypt-Curve25519/Makefile b/security/p5-Crypt-Curve25519/Makefile
--- a/security/p5-Crypt-Curve25519/Makefile
+++ b/security/p5-Crypt-Curve25519/Makefile
@@ -11,9 +11,6 @@
LICENSE= ART10 GPLv1+
LICENSE_COMB= dual
-BROKEN_mips= fails to build: -m32 flag is not supported by this configuration
-BROKEN_mips64= fails to build: -m32 flag is not supported by this configuration
-
USES= perl5 ssl
USE_PERL5= configure
diff --git a/security/p5-Crypt-RHash/Makefile b/security/p5-Crypt-RHash/Makefile
--- a/security/p5-Crypt-RHash/Makefile
+++ b/security/p5-Crypt-RHash/Makefile
@@ -11,8 +11,6 @@
LICENSE= BSD0CLAUSE
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips64= Fails to build: error Cannot detect CPU architechture
-
USES= perl5
USE_PERL5= configure
diff --git a/security/p5-Digest-GOST/Makefile b/security/p5-Digest-GOST/Makefile
--- a/security/p5-Digest-GOST/Makefile
+++ b/security/p5-Digest-GOST/Makefile
@@ -11,7 +11,7 @@
LICENSE= ART10 GPLv1+
LICENSE_COMB= dual
-NOT_FOR_ARCHS= aarch64 armv6 armv7 mips64 riscv64
+NOT_FOR_ARCHS= aarch64 armv6 armv7 riscv64
NOT_FOR_ARCHS_REASON= fails to build: Cannot detect CPU architechture
USES= perl5
diff --git a/security/pam_ssh_agent_auth/Makefile b/security/pam_ssh_agent_auth/Makefile
--- a/security/pam_ssh_agent_auth/Makefile
+++ b/security/pam_ssh_agent_auth/Makefile
@@ -15,8 +15,6 @@
GH_TAGNAME= 099beb2
GH_TUPLE= floodyberry:ed25519-donna:8757bd4:floodyberry_ed25519_donna/ed25519-donna
-BROKEN_mips64= fails to compile: ed25519-donna-portable.h:85:4: Need a uint128_t implementation!
-
USES= perl5 ssl tar:bzip2
USE_PERL5= build
diff --git a/security/pgpin/Makefile b/security/pgpin/Makefile
--- a/security/pgpin/Makefile
+++ b/security/pgpin/Makefile
@@ -12,7 +12,6 @@
LICENSE= MIT
-BROKEN_mips64= Does not build
BROKEN_riscv64= Does not build: make: don't know how to make freebsd-riscv64
PORTSCOUT= ignore:1
diff --git a/security/picocrypt/Makefile b/security/picocrypt/Makefile
--- a/security/picocrypt/Makefile
+++ b/security/picocrypt/Makefile
@@ -10,7 +10,7 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/../LICENSE
-ONLY_FOR_ARCHS= aarch64 amd64 mips64 powerpc64 powerpc64le riscv64
+ONLY_FOR_ARCHS= aarch64 amd64 powerpc64 powerpc64le riscv64
ONLY_FOR_ARCHS_REASON= upstream only supports 64-bit
# https://github.com/HACKERALERT/Picocrypt/issues/127
diff --git a/security/rcracki_mt/Makefile b/security/rcracki_mt/Makefile
--- a/security/rcracki_mt/Makefile
+++ b/security/rcracki_mt/Makefile
@@ -10,7 +10,7 @@
LICENSE= GPLv2
-NOT_FOR_ARCHS= aarch64 armv6 armv7 mips mips64 riscv64
+NOT_FOR_ARCHS= aarch64 armv6 armv7 riscv64
NOT_FOR_ARCHS_REASON= cannot detect endianness
WRKSRC= ${WRKDIR}/${DISTNAME}/${PORTNAME}
diff --git a/security/samhain/Makefile b/security/samhain/Makefile
--- a/security/samhain/Makefile
+++ b/security/samhain/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv2
-BROKEN_mips= fails to configure: error: Could not find the libwrap library
-BROKEN_mips64= fails to configure: error: Could not find the libwrap library
-
USES= shebangfix
SHEBANG_FILES= scripts/samhainadmin-gpg.pl.in \
scripts/samhainadmin-sig.pl.in
diff --git a/security/softether5/Makefile b/security/softether5/Makefile
--- a/security/softether5/Makefile
+++ b/security/softether5/Makefile
@@ -64,8 +64,7 @@
.include <bsd.port.pre.mk>
# devel/cpu_features not available on these archs, see devel/cpu_features/Makefile
-.if (${ARCH} == aarch64 || ${ARCH} == armv6 || ${ARCH} == armv7 || \
- ${ARCH} == mips || ${ARCH} == mips64)
+.if (${ARCH} == aarch64 || ${ARCH} == armv6 || ${ARCH} == armv7)
# skip cpu_features when devel/cpu_features is not available
CMAKE_ARGS+= -DSKIP_CPU_FEATURES=1
.else
diff --git a/security/sudo/Makefile b/security/sudo/Makefile
--- a/security/sudo/Makefile
+++ b/security/sudo/Makefile
@@ -115,7 +115,7 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400072
+.if ${OPSYS} == FreeBSD
. if ${PORT_OPTIONS:MOPIE}
BUILD_DEPENDS+= opie>0:security/opie
RUN_DEPENDS+= opie>0:security/opie
diff --git a/security/tclsasl/Makefile b/security/tclsasl/Makefile
--- a/security/tclsasl/Makefile
+++ b/security/tclsasl/Makefile
@@ -23,7 +23,7 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400091
+.if ${OPSYS} == FreeBSD
CPPFLAGS+= -Wno-error=incompatible-function-pointer-types
.endif
diff --git a/security/tpm2-openssl/Makefile b/security/tpm2-openssl/Makefile
--- a/security/tpm2-openssl/Makefile
+++ b/security/tpm2-openssl/Makefile
@@ -10,8 +10,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/LICENSE
-IGNORE_FreeBSD_13= Requires OpenSSL 3+
-
LIB_DEPENDS= libtss2-esys.so:security/tpm2-tss
RUN_DEPENDS= tpm2-abrmd:security/tpm2-abrmd
diff --git a/security/vaultwarden/Makefile b/security/vaultwarden/Makefile
--- a/security/vaultwarden/Makefile
+++ b/security/vaultwarden/Makefile
@@ -11,7 +11,6 @@
LICENSE_FILE= ${WRKSRC}/LICENSE.txt
BROKEN_i386= doesn't buld on pkg builder
-BROKEN_FreeBSD_13= fails to compile : Needs OpenSSL v3.0.0 or later to compile
LIB_DEPENDS+= libcapnp.so:devel/capnproto \
libgmp.so:math/gmp \
diff --git a/security/wazuh-agent/Makefile b/security/wazuh-agent/Makefile
--- a/security/wazuh-agent/Makefile
+++ b/security/wazuh-agent/Makefile
@@ -102,9 +102,7 @@
.include <bsd.port.pre.mk>
-.if ${OSVERSION} >= 1300139 && ${OSVERSION} < 1400000
-FBSD_MAJOR_VERSION=13
-.elif ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
+.if ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
FBSD_MAJOR_VERSION=14
.elif ${OSVERSION} >= 1500000 && ${OSVERSION} < 1600000
FBSD_MAJOR_VERSION=15
diff --git a/security/wazuh-manager/Makefile b/security/wazuh-manager/Makefile
--- a/security/wazuh-manager/Makefile
+++ b/security/wazuh-manager/Makefile
@@ -165,10 +165,6 @@
.include <bsd.port.pre.mk>
-.if ${ARCH} == "aarch64" && ${OSVERSION} < 1400000
-IGNORE= FreeBSD ${OSVERSION} ${ARCH} is not supported
-.endif
-
.if ${ARCH} == "aarch64"
FBSD14_PATCH_LEVEL= _p5
.endif
@@ -178,12 +174,7 @@
FBSD14_PATCH_LEVEL= _p5
.endif
-.if ${OSVERSION} >= 1300139 && ${OSVERSION} < 1400000
-FBSD_VERSION_BASE=freebsd_13_5_release${FBSD13_PATCH_LEVEL}
-FBSD_MAJOR_VERSION=13
-WAZUH_CACHENAME=${PORTNAME}-cache-fbsd13-${ARCH}-${DISTVERSION}
-DISTFILES+= ${WAZUH_CACHENAME}${EXTRACT_SUFX}:wazuh_cache
-.elif ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
+.if ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
FBSD_VERSION_BASE=freebsd_14_3_release${FBSD14_PATCH_LEVEL}
FBSD_MAJOR_VERSION=14
WAZUH_CACHENAME=${PORTNAME}-cache-fbsd14-${ARCH}-${DISTVERSION}
diff --git a/sysutils/arc_summary/Makefile b/sysutils/arc_summary/Makefile
--- a/sysutils/arc_summary/Makefile
+++ b/sysutils/arc_summary/Makefile
@@ -27,9 +27,7 @@
.include <bsd.port.pre.mk>
do-extract:
-.if ${OSVERSION} < 1400000
- ${CP} ${DISTDIR}/${PORTNAME}3?h=releng/13.2 ${WRKSRC}/${PORTNAME}
-.elif ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
+.if ${OSVERSION} >= 1400000 && ${OSVERSION} < 1500000
${CP} ${DISTDIR}/${PORTNAME}?h=releng/14.0 ${WRKSRC}/${PORTNAME}
.else
${CP} ${DISTDIR}/${PORTNAME} ${WRKSRC}/${PORTNAME}
diff --git a/sysutils/barrier/Makefile b/sysutils/barrier/Makefile
--- a/sysutils/barrier/Makefile
+++ b/sysutils/barrier/Makefile
@@ -39,7 +39,7 @@
.include <bsd.port.options.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092
+.if ${OPSYS} == FreeBSD
EXTRA_PATCHES= ${PATCHDIR}/extra-patch-src_lib_net_SecureUtils.cpp
.endif
diff --git a/sysutils/bhyvemgr/Makefile b/sysutils/bhyvemgr/Makefile
--- a/sysutils/bhyvemgr/Makefile
+++ b/sysutils/bhyvemgr/Makefile
@@ -34,7 +34,7 @@
ONLY_FOR_ARCHS= aarch64 amd64
.endif
-.if ${OPSYS} == FreeBSD && (${OSVERSION} >= 1403000)
+.if ${OPSYS} == FreeBSD
RUN_DEPENDS+= swtpm>0:sysutils/swtpm
.endif
diff --git a/sysutils/cmogstored/Makefile b/sysutils/cmogstored/Makefile
--- a/sysutils/cmogstored/Makefile
+++ b/sysutils/cmogstored/Makefile
@@ -11,9 +11,6 @@
LICENSE= GPLv3+
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= failst to compile: fdmap.c:89: undefined reference to `__sync_add_and_fetch_4'
-BROKEN_mips64= failst to compile: fdmap.c:89: undefined reference to `__sync_add_and_fetch_4'
-
USES= compiler:c11
PLIST_FILES= sbin/cmogstored \
diff --git a/sysutils/deskflow/Makefile b/sysutils/deskflow/Makefile
--- a/sysutils/deskflow/Makefile
+++ b/sysutils/deskflow/Makefile
@@ -12,8 +12,6 @@
LICENSE= GPLv2
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= requires OpenSSL 3.0
-
BUILD_DEPENDS= googletest>0:devel/googletest \
help2man:misc/help2man
LIB_DEPENDS= libei.so:x11/libei \
diff --git a/sysutils/flashrom/Makefile b/sysutils/flashrom/Makefile
--- a/sysutils/flashrom/Makefile
+++ b/sysutils/flashrom/Makefile
@@ -12,7 +12,6 @@
LICENSE= GPLv2
LICENSE_FILE= ${WRKSRC}/COPYING
-IGNORE_FreeBSD_13= Requires OpenSSL 3+
NOT_FOR_ARCHS= riscv64
NOT_FOR_ARCHS_REASON= Unable to determine endianness.
diff --git a/sysutils/fluent-bit/Makefile b/sysutils/fluent-bit/Makefile
--- a/sysutils/fluent-bit/Makefile
+++ b/sysutils/fluent-bit/Makefile
@@ -9,9 +9,6 @@
LICENSE= APACHE20
-BROKEN_mips= fails to build: conflicting types for 'restrict'
-BROKEN_mips64= fails to build: conflicting types for 'restrict'
-
LIB_DEPENDS= libyaml.so:textproc/libyaml
USES= bison cmake:noninja compiler:c11 gmake localbase:ldflags
diff --git a/sysutils/fwupd/Makefile b/sysutils/fwupd/Makefile
--- a/sysutils/fwupd/Makefile
+++ b/sysutils/fwupd/Makefile
@@ -7,8 +7,6 @@
LICENSE= LGPL21
-BROKEN_FreeBSD_13= requires at least FreeBSD 14
-
BUILD_DEPENDS= blkid:filesystems/libblkid \
flashrom>0:sysutils/flashrom \
help2man:misc/help2man \
diff --git a/sysutils/mbgtools/Makefile b/sysutils/mbgtools/Makefile
--- a/sysutils/mbgtools/Makefile
+++ b/sysutils/mbgtools/Makefile
@@ -10,8 +10,6 @@
LICENSE= BSD2CLAUSE
-BROKEN_mips64= fails to compile: unused variables
-
USES= kmod uidfix
USE_RC_SUBR= mbgsvcd
diff --git a/sysutils/p5-Unix-Processors/Makefile b/sysutils/p5-Unix-Processors/Makefile
--- a/sysutils/p5-Unix-Processors/Makefile
+++ b/sysutils/p5-Unix-Processors/Makefile
@@ -11,9 +11,6 @@
LICENSE= ART10 GPLv1+
LICENSE_COMB= dual
-BROKEN_mips= fails to compile: sys/systeminfo.h: No such file or directory
-BROKEN_mips64= fails to compile: sys/systeminfo.h: No such file or directory
-
USES= perl5
USE_PERL5= configure
diff --git a/sysutils/py-pywatchman/Makefile b/sysutils/py-pywatchman/Makefile
--- a/sysutils/py-pywatchman/Makefile
+++ b/sysutils/py-pywatchman/Makefile
@@ -12,9 +12,6 @@
LICENSE= BSD3CLAUSE MIT
LICENSE_COMB= multi
-BROKEN_mips= depends on watchman, which needs c++11-libs
-BROKEN_mips64= depends on watchman, which needs c++11-libs
-
RUN_DEPENDS= watchman>=4:sysutils/watchman
USES= python
diff --git a/sysutils/radeontop/Makefile b/sysutils/radeontop/Makefile
--- a/sysutils/radeontop/Makefile
+++ b/sysutils/radeontop/Makefile
@@ -10,7 +10,7 @@
LICENSE= GPLv3
-NOT_FOR_ARCHS= aarch64 armv6 armv7 mips mips64 riscv64
+NOT_FOR_ARCHS= aarch64 armv6 armv7 riscv64
NOT_FOR_ARCHS_REASON= fails to compile: fatal error: amdgpu_drm.h file not found
LIB_DEPENDS= libpciaccess.so:devel/libpciaccess \
diff --git a/sysutils/runit/Makefile b/sysutils/runit/Makefile
--- a/sysutils/runit/Makefile
+++ b/sysutils/runit/Makefile
@@ -12,9 +12,6 @@
LICENSE= BSD3CLAUSE
LICENSE_FILE= ${WRKSRC}/package/COPYING
-BROKEN_mips= fails to install: runit-init failed
-BROKEN_mips64= fails to install: runit-init failed
-
USES= cpe
USE_RC_SUBR= runsvdir
diff --git a/sysutils/slurm-wlm/Makefile b/sysutils/slurm-wlm/Makefile
--- a/sysutils/slurm-wlm/Makefile
+++ b/sysutils/slurm-wlm/Makefile
@@ -12,7 +12,7 @@
LICENSE= GPLv2+
LICENSE_FILE= ${WRKSRC}/COPYING
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc powerpcspe
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc powerpcspe
NOT_FOR_ARCHS_REASON= 32-bit support is deprecated
LIB_DEPENDS= libhttp_parser.so:www/http-parser \
diff --git a/sysutils/tmux/Makefile b/sysutils/tmux/Makefile
--- a/sysutils/tmux/Makefile
+++ b/sysutils/tmux/Makefile
@@ -10,7 +10,7 @@
LICENSE= ISCL
LICENSE_FILE= ${WRKSRC}/COPYING
-USES= cpe pkgconfig
+USES= cpe ncurses pkgconfig
CPE_VENDOR= tmux_project
GNU_CONFIGURE= yes
@@ -37,14 +37,7 @@
UTF8PROC_USES= localbase
UTF8PROC_CONFIGURE_ENABLE= utf8proc
-.include <bsd.port.pre.mk>
-
-.if ${OPSYS} == FreeBSD && (${OSVERSION} < 1401502 || ${OSVERSION} >= 1500000 && \
- ${OSVERSION} < 1500020)
-USES+= ncurses:port
-.else
-USES+= ncurses
-.endif
+.include <bsd.port.options.mk>
post-patch:
@${REINPLACE_CMD} -e 's|/etc/tmux.conf|${PREFIX}/etc/tmux.conf|g' \
@@ -63,4 +56,4 @@
@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
${INSTALL_DATA} ${WRKSRC}/example* ${STAGEDIR}${EXAMPLESDIR}
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/sysutils/twa-kmod/Makefile b/sysutils/twa-kmod/Makefile
--- a/sysutils/twa-kmod/Makefile
+++ b/sysutils/twa-kmod/Makefile
@@ -10,7 +10,6 @@
ONLY_FOR_ARCHS= amd64
ONLY_FOR_ARCHS_REASON= not yet tested on non amd64
-IGNORE_FreeBSD_13= included in base system
IGNORE_FreeBSD_15= not supported on FreeBSD 15.x
USES= kmod uidfix
diff --git a/sysutils/watchman/Makefile b/sysutils/watchman/Makefile
--- a/sysutils/watchman/Makefile
+++ b/sysutils/watchman/Makefile
@@ -10,9 +10,6 @@
LICENSE= APACHE20
-BROKEN_mips= fails to build: watchman.h:169: undefined reference to '__sync_add_and_fetch_8'
-BROKEN_mips64= fails to build: watchman.h:169: undefined reference to '__sync_add_and_fetch_8'
-
BUILD_DEPENDS= ${LOCALBASE}/include/sys/inotify.h:devel/libinotify
USE_GITHUB= yes
diff --git a/sysutils/zidrav/Makefile b/sysutils/zidrav/Makefile
--- a/sysutils/zidrav/Makefile
+++ b/sysutils/zidrav/Makefile
@@ -28,7 +28,7 @@
CFLAGS+= -Dcrc32_type=int
.endif
-.if ${ARCH} == mips || ${ARCH} == mipshf || ${ARCH} == mipsn32 || ${ARCH} == mips64 || ${ARCH} == mips64hf || ${ARCH} == powerpc || ${ARCH} == powerpcspe || ${ARCH} == powerpc64
+.if ${ARCH} == powerpc || ${ARCH} == powerpcspe || ${ARCH} == powerpc64
CFLAGS+= -DCPU_BIGENDIAN
.endif
diff --git a/textproc/es-hunspell/Makefile b/textproc/es-hunspell/Makefile
--- a/textproc/es-hunspell/Makefile
+++ b/textproc/es-hunspell/Makefile
@@ -17,8 +17,6 @@
LICENSE_FILE_LGPL3= ${WRKSRC}/LGPLv3.txt
LICENSE_FILE_MPL11= ${WRKSRC}/MPL-1.1.txt
-BROKEN_mips= fails to package: tar: Pathname cannot be converted from UTF-8 to current locale
-
NO_ARCH= yes
NO_BUILD= yes
NO_WRKSUBDIR= yes
diff --git a/textproc/es-hyphen/Makefile b/textproc/es-hyphen/Makefile
--- a/textproc/es-hyphen/Makefile
+++ b/textproc/es-hyphen/Makefile
@@ -18,8 +18,6 @@
LICENSE_FILE_LGPL3= ${WRKSRC}/LGPLv3.txt
LICENSE_FILE_MPL11= ${WRKSRC}/MPL-1.1.txt
-BROKEN_mips= fails to package: tar: Pathname cannot be converted from UTF-8 to current locale
-
NO_ARCH= yes
NO_BUILD= yes
NO_WRKSUBDIR= yes
diff --git a/textproc/htmldoc/Makefile b/textproc/htmldoc/Makefile
--- a/textproc/htmldoc/Makefile
+++ b/textproc/htmldoc/Makefile
@@ -10,8 +10,6 @@
LICENSE= GPLv2
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= complains about expecting ) before png_ptr
-
LIB_DEPENDS= libcups.so:print/cups \
libpng16.so:graphics/png
diff --git a/textproc/kmfl-european-latin/Makefile b/textproc/kmfl-european-latin/Makefile
--- a/textproc/kmfl-european-latin/Makefile
+++ b/textproc/kmfl-european-latin/Makefile
@@ -31,7 +31,7 @@
.include <bsd.port.pre.mk>
-.if ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079
+.if ${OPSYS} == FreeBSD
BASE64= /usr/bin/base64
.else
BUILD_DEPENDS= base64:converters/base64
diff --git a/textproc/libucl/Makefile b/textproc/libucl/Makefile
--- a/textproc/libucl/Makefile
+++ b/textproc/libucl/Makefile
@@ -10,9 +10,6 @@
LICENSE= BSD2CLAUSE
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_mips= fails to link: undefined reference to '__sync_add_and_fetch_4'
-BROKEN_mips64= fails to link: undefined reference to '__sync_add_and_fetch_4'
-
USES= autoreconf gmake libtool pathfix pkgconfig
USE_GITHUB= yes
GH_ACCOUNT= vstakhov
diff --git a/textproc/nunnimcax/Makefile b/textproc/nunnimcax/Makefile
--- a/textproc/nunnimcax/Makefile
+++ b/textproc/nunnimcax/Makefile
@@ -22,7 +22,7 @@
.include <bsd.port.options.mk>
-.if defined(NOPROFILE) || defined(NO_PROFILE) || ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400079 )
+.if defined(NOPROFILE) || defined(NO_PROFILE) || ( ${OPSYS} == FreeBSD)
PLIST_SUB+= PROFILE="@comment "
.else
PLIST_SUB+= PROFILE=""
diff --git a/textproc/py-ufal.udpipe/Makefile b/textproc/py-ufal.udpipe/Makefile
--- a/textproc/py-ufal.udpipe/Makefile
+++ b/textproc/py-ufal.udpipe/Makefile
@@ -12,7 +12,7 @@
LICENSE= MPL20
LICENSE_FILE= ${WRKSRC}/LICENSE
-NOT_FOR_ARCHS= mips mips64 powerpc powerpc64 powerpcspe
+NOT_FOR_ARCHS= powerpc powerpc64 powerpcspe
NOT_FOR_ARCHS_REASON= Only little endian systems are supported!
USES= compiler:c++11-lang python
diff --git a/www/bozohttpd/Makefile b/www/bozohttpd/Makefile
--- a/www/bozohttpd/Makefile
+++ b/www/bozohttpd/Makefile
@@ -61,7 +61,7 @@
CFLAGS+= -Wno-error=unused-but-set-variable
.endif
-.if ( ${OPSYS} == FreeBSD && ${OSVERSION} >= 1400092 && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
+.if ( ${OPSYS} == FreeBSD && ${SSL_DEFAULT} == base ) || ${SSL_DEFAULT:Mopenssl3*}
CFLAGS+= -DOPENSSL_API_COMPAT=0x10100000L
.endif
diff --git a/www/cpp-httplib/Makefile b/www/cpp-httplib/Makefile
--- a/www/cpp-httplib/Makefile
+++ b/www/cpp-httplib/Makefile
@@ -10,8 +10,6 @@
LICENSE= MIT
LICENSE_FILE= ${WRKSRC}/LICENSE
-BROKEN_FreeBSD_13= configure fails: OpenSSL is too old: Found unsuitable version "1.1.1t", but required is at least "3.0.0"
-
TEST_DEPENDS= gmake:devel/gmake
USES= cmake localbase:ldflags python:test # localbase only for tests
diff --git a/www/gatling/Makefile b/www/gatling/Makefile
--- a/www/gatling/Makefile
+++ b/www/gatling/Makefile
@@ -10,9 +10,6 @@
LICENSE= GPLv2
-BROKEN_mips= fails to compile: dirfd.c: error: expected ';', ',' or ')' before 'key'
-BROKEN_mips64= fails to compile: dirfd.c: error: expected ';', ',' or ')' before 'key'
-
BUILD_DEPENDS= libowfat>=0.32:devel/libowfat
USES= compiler:c++11-lang gmake localbase:ldflags ssl tar:xz
diff --git a/www/mod_auth_gssapi/Makefile b/www/mod_auth_gssapi/Makefile
--- a/www/mod_auth_gssapi/Makefile
+++ b/www/mod_auth_gssapi/Makefile
@@ -27,13 +27,11 @@
PLIST_SUB= APMOD_FILE=${APMOD_FILE}
OPTIONS_DEFAULT= ${OPTIONS_DEFAULT_${OPSYS}_${OSREL:R}}
-OPTIONS_DEFAULT_FreeBSD_13= GSSAPI_MIT
OPTIONS_DEFAULT_FreeBSD_14= GSSAPI_MIT
OPTIONS_DEFAULT_FreeBSD_15= GSSAPI_BASE
OPTIONS_DEFAULT_FreeBSD_16= GSSAPI_BASE
OPTIONS_SINGLE= GSSAPI
OPTIONS_SINGLE_GSSAPI= GSSAPI_BASE GSSAPI_MIT
-OPTIONS_EXCLUDE_FreeBSD_13= GSSAPI_BASE
OPTIONS_EXCLUDE_FreeBSD_14= GSSAPI_BASE
GSSAPI_BASE_USES= gssapi:flags
@@ -41,10 +39,6 @@
.include <bsd.port.options.mk>
-.if ${PORT_OPTIONS:MGSSAPI_BASE} && ${OPSYS} == FreeBSD && ${OSVERSION} < 1500054
-IGNORE= the GSSAPI_BASE option needs MIT Kerberos in base
-.endif
-
do-install:
@${MKDIR} ${STAGEDIR}${PREFIX}/${APACHEMODDIR} \
${STAGEDIR}${PREFIX}/${APACHEETCDIR}/modules.d
diff --git a/www/py-adblock/Makefile b/www/py-adblock/Makefile
--- a/www/py-adblock/Makefile
+++ b/www/py-adblock/Makefile
@@ -17,7 +17,7 @@
# doesn't support creating 32-bit Python wheels for FreeBSD. Thus save build
# time and skip the port at a early stage.
# SEE devel/py-maturin/Makefile
-NOT_FOR_ARCHS= armv6 armv7 i386 mips powerpc
+NOT_FOR_ARCHS= armv6 armv7 i386 powerpc
NOT_FOR_ARCHS_REASON= the creation of 32-bit Python wheels is not supported for FreeBSD
BUILD_DEPENDS= ${PYTHON_PKGNAMEPREFIX}maturin>=0.8.3:devel/py-maturin@${PY_FLAVOR} \
diff --git a/www/qt5-webengine/Makefile b/www/qt5-webengine/Makefile
--- a/www/qt5-webengine/Makefile
+++ b/www/qt5-webengine/Makefile
@@ -125,7 +125,7 @@
USES+= nodejs:build,lts
.endif
-.if ${ARCH:Mmips*} || ${ARCH:Mpowerpc*}
+.if ${ARCH:Mpowerpc*}
PLIST_SUB+= BE="" LE="@comment "
.else
PLIST_SUB+= BE="@comment " LE=""
@@ -153,7 +153,7 @@
@${REINPLACE_CMD} -E -e 's|^(MODULE_VERSION = ).*|\1${QT5_VERSION}|' \
${WRKSRC}/.qmake.conf
-.if ${ARCH:Mmips*} || ${ARCH:Mpowerpc*}
+.if ${ARCH:Mpowerpc*}
@${REINPLACE_CMD} -e 's/icudtl.dat/icudtb.dat/' \
${WRKSRC}/src/core/core_module.pro
.endif
diff --git a/www/sogo2/Makefile b/www/sogo2/Makefile
--- a/www/sogo2/Makefile
+++ b/www/sogo2/Makefile
@@ -11,7 +11,6 @@
LICENSE= GPLv2
-BROKEN_FreeBSD_13= ld: error: duplicate symbol: SOGoMailCoreInfoKeys
BROKEN_FreeBSD_14= ld: error: duplicate symbol: SOGoMailCoreInfoKeys
LIB_DEPENDS= libmemcached.so:databases/libmemcached \
diff --git a/www/tomcat-native2/Makefile b/www/tomcat-native2/Makefile
--- a/www/tomcat-native2/Makefile
+++ b/www/tomcat-native2/Makefile
@@ -12,8 +12,6 @@
LICENSE= APACHE20
-IGNORE_FreeBSD_13= Does not build on FreeBSD 13.x due to OpenSSL 1.1.1
-
LIB_DEPENDS= libapr-1.so:devel/apr1
USES= java libtool ssl
diff --git a/www/w3m/Makefile b/www/w3m/Makefile
--- a/www/w3m/Makefile
+++ b/www/w3m/Makefile
@@ -13,8 +13,6 @@
LICENSE_FILE= ${WRKSRC}/doc/README
LICENSE_PERMS= dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
-BROKEN_mips64= fails to build: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
-
LIB_DEPENDS= libgc.so:devel/boehm-gc
USES= cpe iconv pkgconfig perl5 ssl
diff --git a/x11-toolkits/aquamarine/Makefile b/x11-toolkits/aquamarine/Makefile
--- a/x11-toolkits/aquamarine/Makefile
+++ b/x11-toolkits/aquamarine/Makefile
@@ -36,10 +36,4 @@
PLIST_SUB= SOVERSION_FULL=${DISTVERSION:C/-.*//} \
SOVERSION_MAJOR=9
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-.endif
-
.include <bsd.port.mk>
diff --git a/x11-toolkits/hyprtoolkit/Makefile b/x11-toolkits/hyprtoolkit/Makefile
--- a/x11-toolkits/hyprtoolkit/Makefile
+++ b/x11-toolkits/hyprtoolkit/Makefile
@@ -36,12 +36,6 @@
PLIST_SUB= SOVERSION_FULL=${DISTVERSION} \
SOVERSION_MAJOR=5
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-.endif
-
# XXX Drop after FreeBSD 14.* EOL around 2028-11-30
# https://cgit.freebsd.org/src/commit/?id=3965de642c29
.if !exists(/usr/include/sys/inotify.h)
diff --git a/x11-wm/hyprland/Makefile b/x11-wm/hyprland/Makefile
--- a/x11-wm/hyprland/Makefile
+++ b/x11-wm/hyprland/Makefile
@@ -48,12 +48,6 @@
WRKSRC= ${WRKDIR}/${PORTNAME}-source
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-.endif
-
# XXX Drop after FreeBSD 14.* EOL around 2028-11-30
# https://cgit.freebsd.org/src/commit/?id=3965de642c29
.if !exists(/usr/include/sys/inotify.h)
diff --git a/x11-wm/sway/Makefile b/x11-wm/sway/Makefile
--- a/x11-wm/sway/Makefile
+++ b/x11-wm/sway/Makefile
@@ -53,13 +53,6 @@
.include <bsd.port.options.mk>
-# https://github.com/freebsd/freebsd-src/pull/1675
-.if ${OPSYS} == FreeBSD && (${OSVERSION} < 1305503 \
- || ${OSVERSION} >= 1400000 && ${OSVERSION} < 1403505 \
- || ${OSVERSION} >= 1500000 && ${OSVERSION} < 1500052)
-EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-wordexp
-.endif
-
post-patch:
# Let @sample handle default files under etc/
@${REINPLACE_CMD} -e '/config\.in/{ N; s/@BASENAME@/&.sample/; }' \
diff --git a/x11-wm/sway/files/extra-patch-wordexp b/x11-wm/sway/files/extra-patch-wordexp
deleted file mode 100644
--- a/x11-wm/sway/files/extra-patch-wordexp
+++ /dev/null
@@ -1,49 +0,0 @@
-https://github.com/swaywm/sway/issues/8673#issuecomment-2818260191
-https://github.com/swaywm/sway/issues/8828#issuecomment-3290045852
-
---- common/stringop.c.orig 2025-04-20 11:31:10 UTC
-+++ common/stringop.c
-@@ -6,6 +6,8 @@
- #include <string.h>
- #include <strings.h>
- #include <wordexp.h>
-+#include <signal.h>
-+#include <sys/wait.h>
- #include "list.h"
- #include "log.h"
- #include "stringop.h"
-@@ -319,7 +321,33 @@ bool expand_path(char **path) {
- memmove(ptr + 1, ptr, strlen(ptr) + 1);
- *ptr = '\\';
- }
-- if (wordexp(*path, &p, 0) != 0 || p.we_wordv[0] == NULL) {
-+
-+ // FreeBSD wordexp bug workaround:
-+ // 1. Reset SIGCHLD handler
-+ // 2. Run wordexp
-+ // 3. Restore SIGCHLD handler and reap any processes that exited
-+ struct sigaction prev_action;
-+ struct sigaction new_action = {
-+ .sa_flags = SA_RESETHAND,
-+ };
-+ if (sigaction(SIGCHLD, &new_action, &prev_action) != 0) {
-+ sway_log(SWAY_ERROR, "Restoring sigchild before wordexp failed");
-+ return false;
-+ }
-+
-+ int res = wordexp(*path, &p, 0);
-+
-+ if (sigaction(SIGCHLD, &prev_action, NULL) != 0) {
-+ sway_log(SWAY_ERROR, "Restoring sigchild after wordexp failed");
-+ }
-+
-+ int status;
-+ int wres;
-+ do {
-+ wres = waitpid(-1, &status, WNOHANG);
-+ } while (wres > 0 || (wres == -1 && errno == EINTR));
-+
-+ if (res != 0 || p.we_wordv[0] == NULL) {
- wordfree(&p);
- return false;
- }
diff --git a/x11-wm/swayfx/Makefile b/x11-wm/swayfx/Makefile
--- a/x11-wm/swayfx/Makefile
+++ b/x11-wm/swayfx/Makefile
@@ -56,13 +56,6 @@
.include <bsd.port.options.mk>
-# https://github.com/freebsd/freebsd-src/pull/1675
-.if ${OPSYS} == FreeBSD && (${OSVERSION} < 1305503 \
- || ${OSVERSION} >= 1400000 && ${OSVERSION} < 1403505 \
- || ${OSVERSION} >= 1500000 && ${OSVERSION} < 1500052)
-EXTRA_PATCHES+= ${PATCHDIR}/extra-patch-wordexp
-.endif
-
post-patch:
# Let @sample handle default files under etc/
@${REINPLACE_CMD} -e '/config\.in/{ N; s/@BASENAME@/&.sample/; }' \
diff --git a/x11-wm/swayfx/files/extra-patch-wordexp b/x11-wm/swayfx/files/extra-patch-wordexp
deleted file mode 100644
--- a/x11-wm/swayfx/files/extra-patch-wordexp
+++ /dev/null
@@ -1,49 +0,0 @@
-https://github.com/swaywm/sway/issues/8673#issuecomment-2818260191
-https://github.com/swaywm/sway/issues/8828#issuecomment-3290045852
-
---- common/stringop.c.orig 2025-04-20 11:31:10 UTC
-+++ common/stringop.c
-@@ -6,6 +6,8 @@
- #include <string.h>
- #include <strings.h>
- #include <wordexp.h>
-+#include <signal.h>
-+#include <sys/wait.h>
- #include "list.h"
- #include "log.h"
- #include "stringop.h"
-@@ -319,7 +321,33 @@ bool expand_path(char **path) {
- memmove(ptr + 1, ptr, strlen(ptr) + 1);
- *ptr = '\\';
- }
-- if (wordexp(*path, &p, 0) != 0 || p.we_wordv[0] == NULL) {
-+
-+ // FreeBSD wordexp bug workaround:
-+ // 1. Reset SIGCHLD handler
-+ // 2. Run wordexp
-+ // 3. Restore SIGCHLD handler and reap any processes that exited
-+ struct sigaction prev_action;
-+ struct sigaction new_action = {
-+ .sa_flags = SA_RESETHAND,
-+ };
-+ if (sigaction(SIGCHLD, &new_action, &prev_action) != 0) {
-+ sway_log(SWAY_ERROR, "Restoring sigchild before wordexp failed");
-+ return false;
-+ }
-+
-+ int res = wordexp(*path, &p, 0);
-+
-+ if (sigaction(SIGCHLD, &prev_action, NULL) != 0) {
-+ sway_log(SWAY_ERROR, "Restoring sigchild after wordexp failed");
-+ }
-+
-+ int status;
-+ int wres;
-+ do {
-+ wres = waitpid(-1, &status, WNOHANG);
-+ } while (wres > 0 || (wres == -1 && errno == EINTR));
-+
-+ if (res != 0 || p.we_wordv[0] == NULL) {
- wordfree(&p);
- return false;
- }
diff --git a/x11/contour/Makefile b/x11/contour/Makefile
--- a/x11/contour/Makefile
+++ b/x11/contour/Makefile
@@ -50,11 +50,6 @@
EXTRA_PATCHES= ${PATCHDIR}/extra-patch-src_crispy_read__selector.h
.endif
-# FreeBSD 13 does not have tic in base, so we need one from ports
-.if ${OPSYS} == FreeBSD && ${OSREL:R} == 13
-BUILD_DEPENDS+= tic:devel/ncurses
-.endif
-
.if ${ARCH:Mpowerpc*}
USES+= compiler:gcc-c++11-lib
.endif
diff --git a/x11/kde-gear/Makefile b/x11/kde-gear/Makefile
--- a/x11/kde-gear/Makefile
+++ b/x11/kde-gear/Makefile
@@ -12,7 +12,6 @@
OPTIONS_DEFINE= KDEADMIN KDEEDU KDEGAMES KDEGRAPHICS KDEMULTIMEDIA KDENETWORK \
KDEPIM KDEUTILS
OPTIONS_DEFAULT=${OPTIONS_DEFINE}
-OPTIONS_EXCLUDE_FreeBSD_13= KDEPIM # OpenSSL 1.1.x is not supported
KDEADMIN_DESC= Administration utilities
KDEADMIN_RUN_DEPENDS= kdeadmin>=${KDE_APPLICATIONS_VERSION}:sysutils/kdeadmin
diff --git a/x11/kitty/Makefile b/x11/kitty/Makefile
--- a/x11/kitty/Makefile
+++ b/x11/kitty/Makefile
@@ -38,9 +38,10 @@
libxkbcommon.so:x11/libxkbcommon \
libxxhash.so:devel/xxhash
+# ncursesw and tinfo >= 6.1 seem to be needed
USES= compiler:c11 cpe desktop-file-utils gettext-runtime gl gmake \
- go:modules magick pkgconfig python shebangfix ssl tar:xz \
- terminfo xorg
+ go:modules magick ncurses pkgconfig python shebangfix ssl \
+ tar:xz terminfo xorg
CPE_VENDOR= kitty_project
USE_GL= gl
@@ -84,13 +85,6 @@
MAKE_ENV+= KITTY_NO_LTO=1
.endif
-# ncursesw and tinfo >= 6.1 seem to be neededd
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1400035
-USES+= ncurses:port
-.else
-USES+= ncurses
-.endif
-
# PR291485
# Temporarily disable build/installation of docs and man pages on FreeBSD >= 15.0
# See:
diff --git a/x11/nvidia-kmod/Makefile b/x11/nvidia-kmod/Makefile
--- a/x11/nvidia-kmod/Makefile
+++ b/x11/nvidia-kmod/Makefile
@@ -187,12 +187,10 @@
${WRKSRC}/src/${NVSRC}/nvidia_dev.c
.endif
# After src 2a99dd30dfaa, DRIVER_MODULE should not include nvidia_devclass
-.if ${OSVERSION} >= 1400058
${REINPLACE_CMD} -e '/^DRIVER_MODULE/s/, nvidia_devclass//' \
${WRKSRC}/src/${NVSRC}/nvidia_pci.c
-.endif
# Catch up with pmap_unmapdev() and kmem_*() changes in 14-CURRENT
-.if ${OSVERSION} >= 1400070 && (${NVVERSION} < 470.25602 || ${NVVERSION} >= 480.00000 && ${NVVERSION} < 530.03002)
+.if ${NVVERSION} < 470.25602 || ${NVVERSION} >= 480.00000 && ${NVVERSION} < 530.03002
${REINPLACE_CMD} -e '/pmap_unmapdev/s,(vm_offset_t),,' \
${WRKSRC}/src/${NVSRC}/nvidia_os.c
${REINPLACE_CMD} -e '/vm_offset_t virtual_address/s,vm_offset_t ,char *,' \
diff --git a/x11/pixman/Makefile b/x11/pixman/Makefile
--- a/x11/pixman/Makefile
+++ b/x11/pixman/Makefile
@@ -13,7 +13,8 @@
USES= cpe meson pkgconfig tar:xz
MESON_ARGS= -Dloongson-mmi=disabled \
-Dgtk=disabled \
- -Ddemos=disabled
+ -Ddemos=disabled \
+ -Dmips-dspr2=disabled
OPTIONS_DEFINE= OPENMP TEST
OPTIONS_DEFAULT= OPENMP
@@ -52,11 +53,6 @@
-Dsse2=disabled \
-Dssse3=disabled
.endif
-.if ${ARCH:Mmips*}
-MESON_ARGS+= -Dmips-dspr2=enabled
-.else
-MESON_ARGS+= -Dmips-dspr2=disabled
-.endif
.if ${ARCH:Mpowerpc*}
MESON_ARGS+= -Dvmx=enabled
.else
diff --git a/x11/squeekboard/Makefile b/x11/squeekboard/Makefile
--- a/x11/squeekboard/Makefile
+++ b/x11/squeekboard/Makefile
@@ -14,8 +14,6 @@
LICENSE= GPLv3
LICENSE_FILE= ${WRKSRC}/COPYING
-BROKEN_FreeBSD_13_powerpc64= fails to link: ld: error: undefined symbol: eekboard_context_service_get_overlay
-
BUILD_DEPENDS= wayland-protocols>=1.12:graphics/wayland-protocols
LIB_DEPENDS= libfeedback-0.0.so:accessibility/feedbackd \
libwayland-client.so:graphics/wayland \
diff --git a/x11/swayimg/Makefile b/x11/swayimg/Makefile
--- a/x11/swayimg/Makefile
+++ b/x11/swayimg/Makefile
@@ -35,12 +35,6 @@
LIB_DEPENDS+= libinotify.so:devel/libinotify
.endif
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-.endif
-
OPTIONS_DEFINE= AVIF BASH GIF HEIF JPEG JSON JXL LIBEXIF LIBRSVG2 \
OPENEXR PNG RAW SIXEL TIFF WEBP ZSH
OPTIONS_DEFAULT=AVIF BASH DRM GIF HEIF JPEG JSON JXL LIBEXIF LIBRSVG2 \
diff --git a/x11/wmenu/Makefile b/x11/wmenu/Makefile
--- a/x11/wmenu/Makefile
+++ b/x11/wmenu/Makefile
@@ -18,14 +18,6 @@
USES= compiler:c11 gnome meson pkgconfig
USE_GNOME= cairo pango
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-CPPFLAGS+= `pkg-config --cflags epoll-shim`
-LDFLAGS+= `pkg-config --libs epoll-shim`
-.endif
-
WRKSRC= ${WRKDIR}/${PORTNAME}
PLIST_FILES= bin/wmenu \
diff --git a/x11/xdg-desktop-portal-wlr/Makefile b/x11/xdg-desktop-portal-wlr/Makefile
--- a/x11/xdg-desktop-portal-wlr/Makefile
+++ b/x11/xdg-desktop-portal-wlr/Makefile
@@ -30,12 +30,6 @@
share/dbus-1/services/org.freedesktop.impl.portal.desktop.wlr.service \
share/xdg-desktop-portal/portals/wlr.portal
-# XXX Drop after FreeBSD 13.5 EOL around 2026-04-30
-# https://cgit.freebsd.org/src/commit/?id=af93fea71038
-.if !exists(/usr/include/sys/timerfd.h)
-LIB_DEPENDS+= libepoll-shim.so:devel/libepoll-shim
-.endif
-
OPTIONS_DEFINE= MANPAGES
OPTIONS_DEFAULT=MANPAGES

File Metadata

Mime Type
text/plain
Expires
Thu, Mar 5, 8:05 AM (4 h, 51 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29233576
Default Alt Text
D55624.id173039.largetrue.diff (374 KB)

Event Timeline