diff --git a/net/freeradius3/Makefile b/net/freeradius3/Makefile
index dab52cd8b438..af32efd4d73b 100644
--- a/net/freeradius3/Makefile
+++ b/net/freeradius3/Makefile
@@ -1,319 +1,324 @@
 PORTNAME=	freeradius
 DISTVERSION=	3.2.6
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	net
 MASTER_SITES=	https://github.com/FreeRADIUS/freeradius-server/releases/download/release_${DISTVERSION:S/./_/g}/ \
 		https://freeradius.org/ftp/pub/radius/%SUBDIR%/ \
 		ftp://ftp.freeradius.org/pub/freeradius/%SUBDIR%/ \
 		ZI
 MASTER_SITE_SUBDIR=	. old
 PKGNAMESUFFIX=	3
 DISTNAME=	freeradius-server-${DISTVERSION}
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Free RADIUS server implementation
 WWW=		https://www.freeradius.org/
 
 LICENSE=	GPLv2
 
 BROKEN_SSL=			libressl libressl-devel
 BROKEN_SSL_REASON_libressl=	LibreSSL is no longer supported
 BROKEN_SSL_REASON_libressl-devel=	${BROKEN_SSL_REASON_libressl}
 
 LIB_DEPENDS=	libgdbm.so:databases/gdbm \
-		libtalloc.so:devel/talloc
+		libtalloc.so:${SAMBA_TALLOC_PORT}
 
 FLAVORS=	default ldap mysql pgsql sqlite3
 FLAVOR?=	${FLAVORS:[1]}
 ldap_PKGNAMESUFFIX=	3-ldap
 mysql_PKGNAMESUFFIX=	3-mysql
 pgsql_PKGNAMESUFFIX=	3-pgsql
 sqlite3_PKGNAMESUFFIX=	3-sqlite3
 
 LOGDIR?=	/var/log
 KRB5_CONFIG?=	/usr/bin/krb5-config --libs
 
 CONFLICTS_INSTALL=	freeradius-* # bin/dhcpclient
 
 USES=		cpe gmake readline shebangfix ssl tar:bzip2
 USE_RC_SUBR=	radiusd
 
 SHEBANG_FILES=	src/modules/rlm_counter/rad_counter scripts/sql/radsqlrelay \
 		scripts/sql/rlm_sqlippool_tool
 GNU_CONFIGURE=	yes
 GNU_CONFIGURE_MANPREFIX=	${PREFIX}/share
 CONFIGURE_ARGS+=--without-rlm_python
 # Prevent /root/.rnd leftover
 MAKE_ARGS+=	HOME=/dev/null
 CPPFLAGS+=	-I${LOCALBASE}/include
 CFLAGS+=	${CPPFLAGS}
 LDFLAGS+=	-L${LOCALBASE}/lib
 
 PLIST_SUB=	PORTVERSION=${DISTVERSION} LIBVER=0${PORTVERSION:C/\./0/g}
 
 # Default requirements for rc script
 _REQUIRE=	NETWORKING SERVERS
 
 OPTIONS_SUB=	yes
 OPTIONS_DEFINE=	USER LDAP MYSQL PGSQL UNIXODBC FIREBIRD REDIS \
 		EXPERIMENTAL UDPFROMTO DEVELOPER EDIR PERL REST \
 		FREETDS IDN DOCS SQLITE3 PYTHON RUBY UNBOUND PCRE \
 		WINBIND EXAMPLES JSON
 OPTIONS_DEFAULT=USER PERL HEIMDAL UDPFROMTO
 OPTIONS_SINGLE=	KRB
 OPTIONS_SINGLE_KRB=	NOKRB HEIMDAL HEIMDAL_PORT MITKRB_PORT
 
 .if ${FLAVOR} == ldap
 OPTIONS_DEFAULT+=	LDAP
 .endif
 .if ${FLAVOR} == mysql
 OPTIONS_DEFAULT+=	MYSQL
 .endif
 .if ${FLAVOR} == pgsql
 OPTIONS_DEFAULT+=	PGSQL
 .endif
 .if ${FLAVOR} == sqlite3
 OPTIONS_DEFAULT+=	SQLITE3
 .endif
 
 USER_DESC=		Run as user freeradius, group freeradius
 KRB_DESC=		${KERBEROS_DESC}
 NOKRB_DESC=		Without Kerberos support
 HEIMDAL_DESC=		With Heimdal Kerberos support
 HEIMDAL_PORT_DESC=	With Heimdal Kerberos from ports
 MITKRB_PORT_DESC=	With MIT Kerberos from ports
 UNIXODBC_DESC=		With unixODBC database support
 UNBOUND_DESC=		With unbound DNS support
 FIREBIRD_DESC=		With Firebird database support (EXPERIMENTAL)
 EXPERIMENTAL_DESC=	Build experimental modules
 UDPFROMTO_DESC=		Compile in UDPFROMTO support
 DEVELOPER_DESC=		Enable developer options
 EDIR_DESC=		Enable eDirectory support (implies LDAP)
 REST_DESC=		Enable RESTful API support
 WINBIND_DESC=		Enable native winbind support in rlm_mschap
 JSON_DESC=		With JSON support
 
 EDIR_CONFIGURE_WITH=		edir
 EDIR_IMPLIES=			LDAP
 FREETDS_CONFIGURE_WITH=		rlm_freetds
 FREETDS_CONFIGURE_OFF=		--without-freetds
 FREETDS_LIB_DEPENDS=		libct.so:databases/freetds
 HEIMDAL_CONFIGURE_ON=		--with-rlm-krb5-dir=/
 HEIMDAL_PORT_LIB_DEPENDS=	libkrb5.so:security/heimdal
 HEIMDAL_PORT_CONFIGURE_ON=	--with-rlm-krb5-dir=${LOCALBASE}
 HEIMDAL_CONFLICTS_BUILD=	krb5-[0-9].*
 IDN_CONFIGURE_WITH=		rlm_idn
 IDN_LIB_DEPENDS=		libidn.so:dns/libidn
 FIREBIRD_CONFIGURE_WITH=	rlm_sql_firebird
 FIREBIRD_USES=			firebird
 LDAP_CONFIGURE_WITH=		rlm_ldap
 LDAP_LIB_DEPENDS=		libsasl2.so:security/cyrus-sasl2
 LDAP_USES=			ldap
 LDAP_VARS=			_REQUIRE+=slapd
 MITKRB_PORT_CONFIGURE_ON=	--with-rlm-krb5-dir=${LOCALBASE}
 MITKRB_PORT_LIB_DEPENDS=	libkrb5support.so:security/krb5
 MITKRB_CONFLICTS_BUILD=		heimdal-[0-9].*
 MYSQL_CONFIGURE_WITH=		rlm_sql_mysql
 MYSQL_USES=			mysql
 MYSQL_VARS=			_REQUIRE+=mysql
 NOKRB_CONFIGURE_ON=		--without-rlm_krb5
 NOKRB_PLIST_SUB=		RLMKRB5="@comment "
 NOKRB_PLIST_SUB_OFF=		RLMKRB5=""
 PCRE_CONFIGURE_WITH=		pcre
 PCRE_LIB_DEPENDS=		libpcre.so:devel/pcre
 PERL_CONFIGURE_WITH=		rlm_perl
 PERL_CONFIGURE_OFF=		--without-perl
 PERL_USES=			perl5
 PGSQL_USES=			pgsql
 PGSQL_VARS=			_REQUIRE+=postgresql
 PGSQL_CONFIGURE_WITH=		rlm_sql_postgresql
 PYTHON_CONFIGURE_WITH=		rlm_python3
 PYTHON_CONFIGURE_ON=		--with-rlm-python3-lib-dir=${PYTHON_LIBDIR} \
 				--with-rlm-python3-config-bin=${PYTHON_CMD}-config \
 				--with-rlm-python3-include-dir=${PYTHON_INCLUDEDIR}
 PYTHON_USES=			python gettext-runtime
 PYTHON_VARS=			SHEBANG_FILES+=src/modules/rlm_python3/*.py
 REDIS_CONFIGURE_WITH=		rlm_redis rlm_rediswho
 REDIS_LIB_DEPENDS=		libhiredis.so:databases/hiredis
 REST_CONFIGURE_WITH=		rlm_rest
 REST_CONFIGURE_ON=		--with-libcurl=${LOCALBASE} \
 				--with-jsonc-lib-dir=${LOCALBASE}/lib \
 				--with-jsonc-include-dir=${LOCALBASE}/include
 REST_LIB_DEPENDS=		libcurl.so:ftp/curl \
 				libjson-c.so:devel/json-c
 RUBY_CONFIGURE_WITH=		rlm_ruby
 RUBY_USES=			ruby
 RUBY_IGNORE=			with ruby support leaks memory, breaks signal handling.  Please disable RUBY support
 SQLITE3_CONFIGURE_WITH=		rlm_sql_sqlite
 SQLITE3_LIB_DEPENDS=		libsqlite3.so:databases/sqlite3
 UDPFROMTO_CONFIGURE_OFF=	--without-udpfromto
 UNBOUND_CONFIGURE_WITH=		rlm_unbound
 UNBOUND_LIB_DEPENDS=		libunbound.so:dns/unbound
 UNIXODBC_CONFIGURE_WITH=	rlm_sql_unixodbc
 UNIXODBC_LIB_DEPENDS=		libodbc.so:databases/unixODBC
-WINBIND_USES=			samba:build,lib
-WINBIND_CONFIGURE_ON=		--with-winbind-include-dir=${LOCALBASE}/include/samba4 \
-				--with-winbind-lib-dir=${LOCALBASE}/lib/samba4
+WINBIND_CONFIGURE_ON=		--with-winbind-include-dir=${SAMBA_INCLUDEDIR} \
+				--with-winbind-lib-dir=${SAMBA_LIBDIR}
 JSON_CONFIGURE_WITH=		rlm_json
 JSON_CONFIGURE_ON=		--with-jsonc-lib-dir=${LOCALBASE}/lib \
 				--with-jsonc-include-dir=${LOCALBASE}/include
 JSON_LIB_DEPENDS=		libjson-c.so:devel/json-c
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MUSER}
 SUB_LIST+=	RUN_AS_USER="yes"
 .else
 SUB_LIST+=	RUN_AS_USER="no"
 .endif
 
+.if ${PORT_OPTIONS:MWINBIND}
+USES+=		samba:build,lib
+.else
+USES+=		samba:env
+.endif
+
 # User and group to use if USER option is chosen
 RADIUS_USER=	freeradius
 RADIUS_GROUP=	freeradius
 
 USERS=		${RADIUS_USER}
 GROUPS=		${RADIUS_GROUP}
 
 # Firebird module is still experimental
 .if ${PORT_OPTIONS:MFIREBIRD} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # python3 module is still experimental
 .if ${PORT_OPTIONS:MPYTHON} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # rlm_ruby module is still experimental
 .if ${PORT_OPTIONS:MRUBY} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # redis module is still experimental
 .if ${PORT_OPTIONS:MREDIS} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # rest module is still experimental
 .if ${PORT_OPTIONS:MREST} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # freetds module is still experimental
 .if ${PORT_OPTIONS:MFREETDS} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # idn module is still experimental
 .if ${PORT_OPTIONS:MIDN} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 # json module is still experimental
 .if ${PORT_OPTIONS:MJSON} && empty(PORT_OPTIONS:MEXPERIMENTAL)
 EXPM=		yes
 .endif
 
 .if ${PORT_OPTIONS:MEXPERIMENTAL} || defined(EXPM)
 CONFIGURE_ARGS+=--with-experimental-modules
 PLIST_SUB+=	EXPM=""
 .else
 CONFIGURE_ARGS+=--without-experimental-modules
 PLIST_SUB+=	EXPM="@comment "
 .endif
 
 .if ${PORT_OPTIONS:MDEVELOPER}
 CONFIGURE_ARGS+=--enable-developer
 # Turn off compiler optimisations
 CFLAGS!=	${ECHO} ${CFLAGS} | ${SED} -Ee 's:-O[0-9]?[[:space:]]*::g'
 .else
 CONFIGURE_ARGS+=--quiet
 .endif
 
 .include <bsd.port.pre.mk>
 
 # if we're installing, place sample configs into ${EXAMPLESDIR}
 MAKE_ARGS+=	raddbdir="${EXAMPLESDIR}/raddb" R=${STAGEDIR}
 
 FREERADIUS_LIBDIR=	lib/freeradius-${PORTVERSION}
 PLIST_SUB+=	LIBDIR="${FREERADIUS_LIBDIR}"
 USE_LDCONFIG=	${PREFIX}/${FREERADIUS_LIBDIR}
 
 .if empty(PORT_OPTIONS:MDOCS)
 CONFIGURE_ARGS+=--without-docdir
 PLIST_SUB+=	PORTDOCS="@comment "
 SUB_LIST+=	PORTDOCS="@comment "
 .else
 CONFIGURE_ARGS+=--with-docdir=${DOCSDIR}
 PLIST_SUB+=	PORTDOCS=""
 SUB_LIST+=	PORTDOCS=""
 .endif
 
 # This conditionality avoids -L/usr/lib in the radiusd build step when
 # building with base system OpenSSL
 .if ${OPENSSLLIB} != "/usr/lib"
 CONFIGURE_ARGS+=--with-openssl-libraries=${OPENSSLLIB}
 .endif
 CONFIGURE_ARGS+=--with-logdir=${LOGDIR} \
 		--with-openssl-includes=${OPENSSLINC} \
 		--prefix=${PREFIX} --libdir=${PREFIX}/${FREERADIUS_LIBDIR} \
 		--localstatedir=/var \
 		--without-rlm_eap_ikev2 \
 		--without-rlm_eap_tnc \
 		--without-rlm_eap2 \
 		--without-rlm_opendirectory \
 		--without-rlm_sql_db2 \
 		--without-rlm_sql_iodbc \
 		--without-rlm_sql_sybase \
 		--without-rlm_yubikey \
 		--without-rlm_sql_oracle \
 		--without-rlm_securid \
 		--without-rlm_cache_memcached \
 		--with-vmps \
 		--with-collectdclient-lib-dir=/dev/null \
 		--disable-openssl-version-check
 
 .if ${ARCH} == amd64
 CONFIGURE_ARGS+=--with-pic
 .endif
 
 SUB_FILES+=	pkg-install pkg-message
 SUB_LIST+=	RADIUS_USER="${RADIUS_USER}" \
 		RADIUS_GROUP="${RADIUS_GROUP}" \
 		RADDB_WORK="${WRKSRC}/raddb" \
 		RADDB="${PREFIX}/etc/raddb" \
 		LOGDIR="${LOGDIR}" \
 		LIBDIR="${PREFIX}/${FREERADIUS_LIBDIR}"
 SUB_LIST+=	REQUIRE="${_REQUIRE}"
 
 post-patch:
 # never try to find execinfo.h (needed until we can enable/disable backtrace
 	@${REINPLACE_CMD} -e '/#include <execinfo.h>/d' ${WRKSRC}/configure
 	@${REINPLACE_CMD} -Ee "s:tests/all.mk ::" ${WRKSRC}/src/all.mk
 	@${CP} ${WRKSRC}/m4/ax_with_prog.m4 ${WRKSRC}
 # Patch raddb/certs/Makefile for the full path to the openssl binary (using
 # ports OpenSSL if installed)
 	@${REINPLACE_CMD} -E \
 		-e "s:^([[:space:]])+openssl:\1${OPENSSLBASE}/bin/openssl:g" \
 		${WRKSRC}/raddb/certs/Makefile
 	@${REINPLACE_CMD} -Ee 's: ..R...sbindir./rc.radiusd : :' \
 		${WRKSRC}/scripts/all.mk
 
 # If we're using Heimdal from base, alter the LIBS variable
 .if ${PORT_OPTIONS:MHEIMDAL} && empty(PORT_OPTIONS:MHEIMDAL_PORT)
 	@${REINPLACE_CMD} -e 's|LIBS|KRB5LIBS|g' ${WRKSRC}/src/modules/rlm_krb5/configure
 	@${REINPLACE_CMD} -e 's|-lkrb5|$$(${KRB5_CONFIG})|g' \
 		${WRKSRC}/src/modules/rlm_krb5/configure
 .endif
 .if empty(PORT_OPTIONS:MRUBY)
 	@${RM} -r ${WRKSRC}/src/modules/rlm_ruby/
 .endif
 
 post-build:
 	@${FIND} ${WRKSRC}/build/lib -type f -name '*.so' -exec ${STRIP_CMD} {} \;
 	@${FIND} ${WRKSRC}/build/bin -type f -exec ${STRIP_CMD} {} \;
 
 post-install:
 	${MKDIR} ${STAGEDIR}/var/run/radiusd ${STAGEDIR}/var/log/radacct
 
 .include <bsd.port.post.mk>
diff --git a/security/sssd2/Makefile b/security/sssd2/Makefile
index b0fc081d536a..d0fbbca0cb92 100644
--- a/security/sssd2/Makefile
+++ b/security/sssd2/Makefile
@@ -1,164 +1,164 @@
 PORTNAME=	sssd
 PORTVERSION=	2.9.6
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	security
 PKGNAMESUFFIX=	2
 
 MAINTAINER=	jhixson@FreeBSD.org
 COMMENT=	System Security Services Daemon
 WWW=		https://sssd.io/
 
 LICENSE=	GPLv3+
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 CONFLICTS_INSTALL?=	sssd*
 
 BUILD_DEPENDS=	${PY_SETUPTOOLS} \
 		bash:shells/bash \
 		docbook-xsl>=1:textproc/docbook-xsl \
 		p11-kit:security/p11-kit \
 		nsupdate:dns/bind-tools \
 		xmlcatalog:textproc/libxml2 \
 		xmlcatmgr:textproc/xmlcatmgr \
 		xsltproc:textproc/libxslt
 
 LIB_DEPENDS=	libcares.so:dns/c-ares \
 		libcurl.so:ftp/curl \
 		libdbus-1.so:devel/dbus \
 		libdhash.so:devel/ding-libs \
 		libfido2.so:security/libfido2 \
 		libinotify.so:devel/libinotify \
 		libjansson.so:devel/jansson \
 		libjose.so:net/jose \
 		libldb.so:${SAMBA_LDB_PORT} \
 		libndr-krb5pac.so:${SAMBA_PORT} \
 		libndr-nbt.so:${SAMBA_PORT} \
 		libndr-standard.so:${SAMBA_PORT} \
 		libndr.so:${SAMBA_PORT} \
 		libp11-kit.so:security/p11-kit \
 		libpcre2-8.so:devel/pcre2 \
 		libpopt.so:devel/popt \
 		libsamba-util.so:${SAMBA_PORT} \
 		libsasl2.so:security/cyrus-sasl2 \
 		libsmbclient.so:${SAMBA_PORT} \
-		libtalloc.so:devel/talloc \
-		libtdb.so:databases/tdb \
-		libtevent.so:devel/tevent \
+		libtalloc.so:${SAMBA_TALLOC_PORT} \
+		libtdb.so:${SAMBA_TDB_PORT} \
+		libtevent.so:${SAMBA_TEVENT_PORT} \
 		libunistring.so:devel/libunistring \
 		libuuid.so:misc/e2fsprogs-libuuid
 
 RUN_DEPENDS=	adcli:net-mgmt/adcli \
 		cyrus-sasl-gssapi>0:security/cyrus-sasl2-gssapi
 
 USES=	autoreconf cpe gettext gmake gssapi:flags,mit iconv ldap \
 	libtool localbase:ldflags pathfix pkgconfig python:3.9+ samba:env \
 	shebangfix ssl
 
 USE_LDCONFIG=	yes
 GNU_CONFIGURE=	yes
 
 INSTALL_TARGET=	install-strip
 CPE_VENDOR=	fedoraproject
 
 CONFIGURE_ARGS=	--disable-dependency-tracking \
 		--datadir=${DATADIR} \
 		--localstatedir=/var \
 		--disable-nls \
 		--disable-cifs-idmap-plugin \
 		--disable-valgrind \
 		--disable-systemtap \
 		--enable-pammoddir=${PREFIX}/lib \
 		--enable-ldb-version-check \
 		--enable-pac-responder \
 		--with-db-path=/var/db/sss/db \
 		--with-os=freebsd \
 		--with-plugin-path=${LOCALBASE}/lib/sssd \
 		--with-pubconf-path=/var/db/sss/pubconf  \
 		--with-pid-path=/var/run \
 		--with-pipe-path=/var/run/sss/pipes \
 		--with-mcache-path=/var/db/sss/mc \
 		--with-environment-file=${LOCALBASE}/etc/sssd \
 		--with-init-dir=no \
 		--with-manpages \
 		--with-xml-catalog-path=${LOCALBASE}/share/xml/catalog \
 		--with-krb5-plugin-path=${LOCALBASE}/lib/krb5/plugins/libkrb5 \
 		--with-krb5authdata-plugin-path=${LOCALBASE}/lib/krb5/plugins/authdata \
 		--with-krb5-conf=/etc/krb5.conf \
 		--without-python2-bindings \
 		--with-winbind-plugin-path=${LOCALBASE}/lib/samba4/modules/idmap \
 		--without-selinux \
 		--with-gpo-cache-path=/var/db/sss/gpo_cache  \
 		--without-semanage \
 		--with-app-libs=${LOCALBASE}/lib/sssd/modules \
 		--without-autofs \
 		--with-files-provider \
 		--with-passkey \
 		--with-samba \
 		--without-nfsv4-idmapd-plugin \
 		--with-secrets-db-path=/var/lib/sss/secrets \
 		--with-kcm \
 		--with-oidc-child \
 		--with-ldb-lib-dir=${LOCALBASE}/lib/shared-modules/ldb \
 		--with-smb-idmap-interface-version=6 \
 		--without-libnl \
 		--with-nscd-conf=/etc/nscd.conf \
 		--with-python_prefix=${PREFIX}
 CONFIGURE_ENV=	KRB5_CONFIG="${KRB5CONFIG}"
 
 CPPFLAGS+=	-DRENEWAL_PROG_PATH='\"${LOCALBASE}/sbin/adcli\"'
 CFLAGS+=	-fstack-protector-all
 LIBS+=		-linotify -lintl
 
 PLIST_SUB=	PYTHON_VER=${PYTHON_VER}
 MAKE_ENV=	MAKELEVEL=0 LINGUAS="bg de eu es fr hu id it ja nb nl pl pt ru sv tg tr uk zh_CN zh_TW"
 SUB_FILES=	pkg-message
 
 BINARY_ALIAS=	python3=python${PYTHON_VER}
 SHEBANG_FILES=	sbus_generate.sh.in \
 		src/tools/analyzer/sss_analyze \
 		src/tools/sss_obfuscate \
 		src/config/SSSDConfigTest.py \
 		src/tests/*.py \
 		src/tests/cwrap/cwrap_test_setup.sh \
 		src/tests/whitespace_test \
 		src/tests/multihost/data/memcachesize.py \
 		src/tests/double_semicolon_test \
 		scripts/release.sh \
 		contrib/git/pre-push \
 		contrib/ci/rpm-spec-builddeps \
 		contrib/ci/clean \
 		contrib/ci/valgrind-condense \
 		contrib/ci/run-multihost \
 		contrib/ci/run \
 		contrib/ci/get-matrix.py \
 		contrib/vagrant/bootstrap.sh \
 		contrib/fedora/make_srpm.sh
 
 USE_RC_SUBR=	${PORTNAME}
 
 USE_GITHUB=yes
 GH_ACCOUNT=sssd
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|/usr/bin/|${PREFIX}/bin/|g' \
 		-e 's|/var/lib/sss/pubconf/|/var/db/sss/pubconf/|g' \
 		${WRKSRC}/src/man/sss_ssh_knownhostsproxy.1.xml \
 		${WRKSRC}/src/man/po/*.po || true
 	@${REINPLACE_CMD} -e 's|/etc/sssd/|${ETCDIR}/|g' \
 		-e 's|/etc/openldap/|${LOCALBASE}/etc/openldap/|g' \
 		${WRKSRC}/src/man/*xml || true
 	@${CP} ${FILESDIR}/sss_bsd_errno.h ${WRKSRC}/src/util/sss_bsd_errno.h
 	@${CP} ${FILESDIR}/bsdnss.c ${WRKSRC}/src/sss_client/bsdnss.c
 
 post-install:
 	${INSTALL_DATA} ${WRKSRC}/src/examples/sssd-example.conf \
 		${STAGEDIR}${ETCDIR}/sssd.conf.sample
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/dbus-1/system.d
 	${INSTALL_DATA} ${WRKSRC}/src/responder/ifp/org.freedesktop.sssd.infopipe.conf \
 		${STAGEDIR}${PREFIX}/share/dbus-1/system.d/org.freedesktop.sssd.infopipe.conf
 	${MKDIR} ${STAGEDIR}${PREFIX}/share/dbus-1/system-services
 	${INSTALL_DATA} ${WRKSRC}/src/responder/ifp/org.freedesktop.sssd.infopipe.service \
 		${STAGEDIR}${PREFIX}/share/dbus-1/system-services/org.freedesktop.sssd.infopipe.service
 	${LN} -sf libnss_sss.so.2 ${STAGEDIR}${PREFIX}/lib/nss_sss.so.1
 
 .include <bsd.port.mk>
diff --git a/www/squid/Makefile b/www/squid/Makefile
index 4d20dfeb86b2..33b326d4413a 100644
--- a/www/squid/Makefile
+++ b/www/squid/Makefile
@@ -1,288 +1,288 @@
 PORTNAME=	squid
 DISTVERSION=	6.12
 PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	http://www2.pl.squid-cache.org/Versions/v6/ \
 		http://www1.il.squid-cache.org/Versions/v6/ \
 		http://www2.gr.squid-cache.org/Versions/v6/ \
 		http://ca2.squid-cache.org/Versions/v6/ \
 		https://www.squid-cache.org/Versions/v6/
 
 PATCH_SITES=	http://www2.pl.squid-cache.org/%SUBDIR%/ \
 		http://www1.il.squid-cache.org/%SUBDIR%/ \
 		http://www2.gr.squid-cache.org/%SUBDIR%/ \
 		http://ca2.squid-cache.org/%SUBDIR%/ \
 		https://www.squid-cache.org/%SUBDIR%/
 PATCH_SITE_SUBDIR=	Versions/v6/changesets
 
 MAINTAINER=	timp87@gmail.com
 COMMENT=	HTTP Caching Proxy
 WWW=		https://www.squid-cache.org/
 
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 USES=		compiler:c++11-lib cpe gmake localbase:ldflags perl5 \
 		shebangfix tar:xz
 CPE_VENDOR=	squid-cache
 USE_RC_SUBR=	squid
 
 SHEBANG_FILES=	contrib/*.pl scripts/*.pl tools/*.pl
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--bindir=${PREFIX}/sbin \
 		--datadir=${ETCDIR} \
 		--disable-arch-native \
 		--disable-epoll \
 		--disable-strict-error-checking \
 		--enable-build-info \
 		--enable-removal-policies="lru heap" \
 		--libexecdir=${PREFIX}/libexec/squid \
 		--localstatedir=/var \
 		--sbindir=${PREFIX}/sbin \
 		--sysconfdir=${ETCDIR} \
 		--with-default-user=squid \
 		--with-included-ltdl \
 		--with-logdir=/var/log/squid \
 		--with-pidfile=/var/run/squid/squid.pid \
 		--with-swapdir=/var/squid/cache \
 		--without-cap \
 		--without-gnutls \
 		--without-netfilter-conntrack \
 		--without-systemd
 
 CONFLICTS=	squid-devel
 
 SUB_FILES+=	pkg-install pkg-message
 
 USERS=		squid
 GROUPS=		squid
 
 .if !defined(SQUID_CONFIGURE_ARGS) || \
 	${SQUID_CONFIGURE_ARGS:M*--disable-unlinkd*} == ""
 PLIST_SUB+=	UNLINKD=""
 .else
 PLIST_SUB+=	UNLINKD="@comment "
 .endif
 PORTDOCS=	${MYDOCS:T}
 PORTEXAMPLES=	*
 
 OPTIONS_DEFINE=		ARP_ACL CACHE_DIGESTS DEBUG DELAY_POOLS DOCS ECAP ESI \
 			EXAMPLES FOLLOW_XFF FS_AUFS FS_DISKD FS_ROCK HTCP ICAP \
 			ICMP IDENT IPV6 KQUEUE LARGEFILE LAX_HTTP NETTLE SNMP \
 			SSL SSL_CRTD STACKTRACES TDB VIA_DB WCCP WCCPV2
 OPTIONS_DEFAULT=	ARP_ACL AUTH_NIS CACHE_DIGESTS DELAY_POOLS FOLLOW_XFF \
 			FS_AUFS FS_DISKD FS_ROCK GSSAPI_BASE HTCP ICAP ICMP \
 			IDENT KQUEUE LARGEFILE LAX_HTTP SNMP SSL SSL_CRTD \
 			TP_IPFW VIA_DB WCCP WCCPV2
 OPTIONS_GROUP=		AUTH
 OPTIONS_GROUP_AUTH=	AUTH_LDAP AUTH_NIS AUTH_SASL AUTH_SMB AUTH_SQL
 OPTIONS_RADIO=		FW
 OPTIONS_RADIO_FW=	TP_IPF TP_IPFW TP_PF
 OPTIONS_SINGLE=		GSSAPI
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 OPTIONS_SUB=		yes
 
 ARP_ACL_DESC=		ARP/MAC/EUI based authentification
 AUTH_DESC=		Authentication helpers
 AUTH_LDAP_DESC=		Install LDAP authentication helpers
 AUTH_NIS_DESC=		Install NIS/YP authentication helpers
 AUTH_SASL_DESC=		Install SASL authentication helpers
 AUTH_SMB_DESC=		Install SMB auth. helpers (req. Samba)
 AUTH_SQL_DESC=		Install SQL based auth
 CACHE_DIGESTS_DESC=	Use cache digests
 DEBUG_DESC=		Build with extended debugging support
 DELAY_POOLS_DESC=	Delay pools (bandwidth limiting)
 ECAP_DESC=		Loadable content adaptation modules
 ESI_DESC=		ESI support
 FOLLOW_XFF_DESC=	Support for the X-Following-For header
 FS_AUFS_DESC=		AUFS (threaded-io) support
 FS_DISKD_DESC=		DISKD storage engine controlled by separate service
 FS_ROCK_DESC=		ROCK storage engine
 HTCP_DESC=		HTCP support
 ICAP_DESC=		the ICAP client
 ICMP_DESC=		ICMP pinging and network measurement
 IDENT_DESC=		Ident lookups (RFC 931)
 KQUEUE_DESC=		Kqueue(2) support
 LARGEFILE_DESC=		Support large (>2GB) cache and log files
 LAX_HTTP_DESC=		Do not enforce strict HTTP compliance
 NETTLE_DESC=		Nettle MD5 algorithm support
 SNMP_DESC=		SNMP support
 SSL_CRTD_DESC=		Use ssl_crtd to handle SSL cert requests
 SSL_DESC=		SSL gatewaying support
 STACKTRACES_DESC=	Enable automatic backtraces on fatal errors
 TDB_DESC=		TrivialDB support required for session and time quota external helpers
 TP_IPFW_DESC=		Transparent proxying with IPFW
 TP_IPF_DESC=		Transparent proxying with IPFilter
 TP_PF_DESC=		Transparent proxying with PF
 VIA_DB_DESC=		Forward/Via database
 WCCPV2_DESC=		Web Cache Coordination Protocol v2
 WCCP_DESC=		Web Cache Coordination Protocol
 
 ARP_ACL_CONFIGURE_ENABLE=	eui
 AUTH_LDAP_USES=			ldap
 AUTH_LDAP_CONFIGURE_WITH=	ldap
 AUTH_LDAP_VARS=			BASIC_AUTH+=LDAP \
 				DIGEST_AUTH+="eDirectory LDAP" \
 				EXTERNAL_ACL+="LDAP_group eDirectory_userip"
 AUTH_SASL_LIB_DEPENDS=		libsasl2.so:security/cyrus-sasl2
 AUTH_SASL_VARS=			BASIC_AUTH+=SASL
 AUTH_SMB_USES=			samba:run
 AUTH_SMB_VARS=			BASIC_AUTH+=SMB \
 				EXTERNAL_ACL+=wbinfo_group
 AUTH_SQL_RUN_DEPENDS=		p5-DBI>=1.08:databases/p5-DBI
 AUTH_SQL_VARS=			EXTERNAL_ACL+=SQL_session
 CACHE_DIGESTS_CONFIGURE_ENABLE=	cache-digests
 DELAY_POOLS_CONFIGURE_ENABLE=	delay-pools
 ECAP_LIB_DEPENDS=		libecap.so:www/libecap
 ECAP_USES=			pkgconfig:build
 ECAP_CONFIGURE_ENABLE=		ecap
 ESI_LIB_DEPENDS=		libexpat.so:textproc/expat2 \
 				libxml2.so:textproc/libxml2
 ESI_CONFIGURE_ENABLE=		esi
 ESI_CONFIGURE_WITH=		expat xml2
 FOLLOW_XFF_CONFIGURE_ENABLE=	follow-x-forwarded-for
 FS_AUFS_CONFIGURE_WITH=		pthreads
 # Nil aufs threads is default, set any other value via SQUID_CONFIGURE_ARGS,
 # e.g. SQUID_CONFIGURE_ARGS=--with-aufs-threads=N
 FS_AUFS_LDFLAGS=		-pthread
 FS_AUFS_VARS=			DISKIO_MODULES+=DiskThreads \
 				STORAGE_SCHEMES+=aufs
 FS_DISKD_VARS=			DISKIO_MODULES+=DiskDaemon \
 				STORAGE_SCHEMES+=diskd
 FS_ROCK_VARS=			STORAGE_SCHEMES+=rock
 GSSAPI_BASE_USES=		gssapi
 GSSAPI_BASE_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-heimdal-krb5=${GSSAPIBASEDIR} \
 				krb5_config=${GSSAPIBASEDIR}/bin/krb5-config
 GSSAPI_BASE_PLIST_SUB=		AUTH_KERB=""
 GSSAPI_HEIMDAL_USES=		gssapi:heimdal
 GSSAPI_HEIMDAL_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-heimdal-krb5=${GSSAPIBASEDIR} \
 				krb5_config=${GSSAPIBASEDIR}/bin/krb5-config
 GSSAPI_HEIMDAL_PLIST_SUB=	AUTH_KERB=""
 GSSAPI_MIT_USES=		gssapi:mit
 GSSAPI_MIT_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-mit-krb5=${GSSAPIBASEDIR} \
 				krb5_config=${GSSAPIBASEDIR}/bin/krb5-config
 GSSAPI_MIT_PLIST_SUB=		AUTH_KERB=""
 GSSAPI_NONE_CONFIGURE_ON=	--without-gnugss \
 				--without-heimdal-krb5 \
 				--without-mit-krb5
 HTCP_CONFIGURE_ENABLE=		htcp
 ICAP_CONFIGURE_ENABLE=		icap-client
 ICMP_CONFIGURE_ENABLE=		icmp
 IDENT_CONFIGURE_ENABLE=		ident-lookups
 IPV6_CONFIGURE_ENABLE=		ipv6
 KQUEUE_CONFIGURE_ENABLE=	kqueue
 LARGEFILE_CONFIGURE_WITH=	large-files
 LAX_HTTP_CONFIGURE_ENABLE=	http-violations
 NETTLE_LIB_DEPENDS=		libnettle.so:security/nettle
 NETTLE_CONFIGURE_WITH=		nettle
 SNMP_CONFIGURE_ENABLE=		snmp
 SSL_USES=			ssl
 SSL_CONFIGURE_ON=		--enable-security-cert-generators="file" \
 				--with-openssl \
 				LIBOPENSSL_CFLAGS=-I${OPENSSLINC} \
 				LIBOPENSSL_LIBS="-lcrypto -lssl"
 SSL_CONFIGURE_ENABLE=		ssl
 SSL_CRTD_IMPLIES=		SSL
 SSL_CRTD_CONFIGURE_ENABLE=	ssl-crtd
 STACKTRACES_LIB_DEPENDS=	libunwind.so:devel/libunwind
 STACKTRACES_CONFIGURE_ENABLE=	stacktraces
 STACKTRACES_CFLAGS=		-g
 STACKTRACES_LDFLAGS=		-lunwind
 STACKTRACES_EXTRA_PATCHES=	${FILESDIR}/extra-patch-gen-stacktrace
 STACKTRACES_VARS=		STRIP=""
-TDB_LIB_DEPENDS=		libtdb.so:databases/tdb
-TDB_USES=			pkgconfig:build
+TDB_LIB_DEPENDS=		libtdb.so:${SAMBA_TDB_PORT}
+TDB_USES=			pkgconfig:build samba:env
 TDB_CONFIGURE_WITH=		tdb
 TDB_VARS=			EXTERNAL_ACL+="time_quota session"
 TP_IPFW_CONFIGURE_ENABLE=	ipfw-transparent
 TP_IPF_CONFIGURE_ENABLE=	ipf-transparent
 TP_PF_CONFIGURE_ENABLE=		pf-transparent
 TP_PF_CONFIGURE_WITH=		nat-devpf
 VIA_DB_CONFIGURE_ENABLE=	forw-via-db
 WCCPV2_CONFIGURE_ENABLE=	wccpv2
 WCCP_CONFIGURE_ENABLE=		wccp
 
 MYDOCS=		QUICKSTART README RELEASENOTES.html doc/debug-sections.txt
 
 change_files=	ChangeLog errors/Makefile.am errors/Makefile.in \
 		src/auth/basic/SMB_LM/README.html src/Makefile.am \
 		src/Makefile.in src/cf_gen.cc src/squid.8.in \
 		test-suite/Makefile.in tools/Makefile.am tools/Makefile.in
 
 .include <bsd.port.options.mk>
 
 # Authentication methods and modules:
 BASIC_AUTH+=	DB NCSA PAM POP3 RADIUS SMB_LM fake getpwnam
 DIGEST_AUTH+=	file
 EXTERNAL_ACL+=	file_userip unix_group delayer
 
 # POLA: allow the old global make.conf(5) (pre src.conf(5)) defines, too:
 .if ${PORT_OPTIONS:MAUTH_NIS} && !defined(NO_NIS) && !defined(WITHOUT_NIS)
 BASIC_AUTH+=	NIS
 .endif
 
 # POLA: allow the old global make.conf(5) (pre src.conf(5)) defines, too:
 .if ${PORT_OPTIONS:MGSSAPI_NONE} || defined(NO_KERBEROS) || \
 	defined(WITHOUT_KERBEROS)
 NEGOTIATE_AUTH=	none
 PLIST_SUB+=	AUTH_KERB="@comment "
 .else
 # The kerberos_ldap_group external helper also depends on LDAP and SASL:
 # The kerberos_sid_group external helper depends on kerberos_ldap_group meanwhile
 . if ${PORT_OPTIONS:MAUTH_LDAP} && ${PORT_OPTIONS:MAUTH_SASL}
 EXTERNAL_ACL+=	kerberos_ldap_group kerberos_sid_group
 . endif
 NEGOTIATE_AUTH=	kerberos wrapper
 .endif
 
 # Storage schemes:
 STORAGE_SCHEMES+=	ufs
 DISKIO_MODULES+=	AIO Blocking IpcIo Mmapped
 
 CONFIGURE_ARGS+=	--enable-auth-basic="${BASIC_AUTH}" \
 			--enable-auth-digest="${DIGEST_AUTH}" \
 			--enable-auth-negotiate="${NEGOTIATE_AUTH}" \
 			--enable-auth-ntlm="fake SMB_LM" \
 			--enable-disk-io="${DISKIO_MODULES}" \
 			--enable-external-acl-helpers="${EXTERNAL_ACL}" \
 			--enable-log-daemon-helpers="file DB" \
 			--enable-security-cert-validators="fake" \
 			--enable-storeid-rewrite-helpers="file" \
 			--enable-storeio="${STORAGE_SCHEMES}" \
 			--enable-url-rewrite-helpers="fake LFS"
 # Other options set via 'make config':
 
 .if ${PORT_OPTIONS:MDEBUG} || defined(WITH_DEBUG)
 CONFIGURE_ARGS+=	--disable-optimizations
 WITH_DEBUG?=		yes
 .endif
 
 # Finally, add additional user specified configuration options:
 CONFIGURE_ARGS+=	${SQUID_CONFIGURE_ARGS}
 
 post-patch:
 	@(cd ${WRKSRC} && ${REINPLACE_CMD} \
 		-e 's|\.conf\.default|.conf.sample|' \
 		-e 's|)\.default|).sample|' \
 		${change_files})
 	@(cd ${WRKSRC} && ${MV} src/mime.conf.default src/mime.conf.sample)
 
 post-patch-IPV6-off:
 	@${REINPLACE_CMD} -E -e's| ::1$$||' -e's| ::1?/128||g' \
 		-e'/acl localnet src f[ce][08]0::/d' \
 		-e's| 2001:DB8::[^[:space:]]+$$||' \
 		-e'/tcp_outgoing_address 2001:db8::/d' \
 		${WRKSRC}/src/cf.data.pre
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${EXAMPLESDIR}
 	${INSTALL_DATA} ${WRKSRC}/src/auth/basic/DB/passwd.sql \
 		${STAGEDIR}${EXAMPLESDIR}
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	(cd ${WRKSRC} && ${INSTALL_DATA} ${MYDOCS} ${STAGEDIR}${DOCSDIR})
 
 .include <bsd.port.mk>