I have a few C programs, which could be cleaned up.
But I know nothing about automated testing nor
what FreeBSD currently does.

It was found with an automated test. I just don't know
the details, except it is python code. I'll forward the
email and koobs@ can fill you in.

Mark inline comment as done.

As suggested by jhb@, add a command line option
to rpc.tlsclntd to specify preferred ciphers.
If the option is not specified, the daemon does
not make a SSL_CTX_set_cipher_list() call.

Mark jhb@s comment as done.
W.r.t. the review of the rest of it, I understand
completely and will probably commit soon without
a full review.

Essentially revert the last changes that made the
code build without KTLS. Always building seems
to be a desirable property for a port, which is why
I made the change.

Marked inline comments as done.

Apply changes suggested by asomers@.

Revert the last change and take setting root/wheel out
of the port's Makefile, as requested by loader.

Add check for UID == 0, since this port
can only be installed as root.

Change BROKEN to IGNORE as suggested.

Bumped the software to version1.1 as suggested.

Marked inline comment as done.

Fixed usr.sbin/Makefile as suggested by jhb@.

Add loader as a reviewer.

Patch the daemons so that they will build
for an OpenSSL that is not patched for KTLS.
Also added a check for them being built with
an OpenSSL with KTLS enabled and just errx()
if not.

The return value for SSL_get_verify_result() is
long and not int.
This update declares a long variable called verfret
to hold the value returned by SSL_get_verify_result()
instead of using "ret", which is an int.

Mark inline comment as done.

Fix export to exports as reported by gbe@.
Also, delete a couple of debug output lines
that got missed by a previous edit.

Well, not exactly missing. I was planning on
the rc.d changes being a separate review,
in part because they will need a detailed
look, given my lack of expertise w.r.t. them.

Your patch sounds fine to me and is what I was
thinking when I asked.
(I didn't understand why the ncl_pager_setsize() call
was added, but I also admit I don't understand the
vm side of vnode_pager_setsze().)

Comment inline.

Looks fine to me, although I'll admit that I
do not really understand the vnode_pager_setsize()
stuff well enough to say whether or not this is correct?

Marked comments as done.

Yes, bextpgsiz is the bytes remaining to be used in the page.
It was easier than using offset within the page, since there
is 1st_page_off to deal with.

Handled inline comments.

Update patch as recommended by asomers@.

Looks fine to me now.
With these changes my test run works fine.

Comments inline.

Marked inline comments as done.

Made the recommended changes.
I'll admit I started with .Ar and then changed to .Dq
because a plain text screen like I use does not mark
.Ar in any way.

Well, the nfscbd should definitely be done before mountcritremote.
I have not seen evidence that this does not happen, but nothing I
know of forces the ordering.

Righto. I was thinking that, someday (maybe within the
FreeBSD13 release lifetime) that NFS over TLS might
become widely useful and not needing to build a
custom kernel would be nice then.

It's up to you, however I tend to think of sysctls as orthogonal
to kernel options and, as such, having the default change
based on KERN_TLS seems a little weird to me.