Index: head/lang/phantomjs/Makefile
===================================================================
--- head/lang/phantomjs/Makefile	(revision 465898)
+++ head/lang/phantomjs/Makefile	(revision 465899)
@@ -1,65 +1,67 @@
 # $FreeBSD$
 
 PORTNAME=	phantomjs
 PORTVERSION=	2.1.1
 PORTREVISION=	7
 CATEGORIES=	lang
 
 MAINTAINER=	feld@FreeBSD.org
 COMMENT=	Minimalistic, headless, WebKit-based, JavaScript-driven tool
 
 LICENSE=	BSD3CLAUSE
 
 BROKEN_powerpc64=	fails to build: g++48: not found
 BROKEN_sparc64=		does not link on sparc64
 NOT_FOR_ARCHS=		armv6 armv7
 NOT_FOR_ARCHS_REASON=	Platform.h: Not supported ARM architecture
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: member access into incomplete type 'X509' (aka 'x509_st')
 
 BUILD_DEPENDS=	bash:shells/bash
 LIB_DEPENDS=	libfreetype.so:print/freetype2 \
 		libfontconfig.so:x11-fonts/fontconfig \
 		libicui18n.so:devel/icu \
 		libpng.so:graphics/png
 
 USES=		bison:build compiler:c++11-lang gmake gperf jpeg perl5 pkgconfig python:build ssl sqlite
 USE_GNOME+=	libxml2
 USE_PERL5=	build
 USE_RUBY=	yes
 USE_GITHUB=	yes
 GH_ACCOUNT=	ariya
 GH_TUPLE=	Vitallium:phantomjs-3rdparty-win:19051aa:msvc2013/src/qt/3rdparty \
 		Vitallium:qtbase:b5cc008:qtbase/src/qt/qtbase \
 		Vitallium:qtwebkit:e7b7433:qtwebkit/src/qt/qtwebkit
 RUBY_NO_RUN_DEPENDS=	yes
 PLIST_FILES=	bin/phantomjs
 NO_CCACHE=	yes
 BINARY_ALIAS=	python=${PYTHON_CMD}
 
 OPTIONS_DEFINE=	X11
 X11_USE=	XORG=x11
 
 .include <bsd.port.options.mk>
 
 # qmake.conf detection is in src/qt/qtbase/configure script.
 SPEC=	${WRKSRC}/src/qt/qtbase/mkspecs
 post-extract:
 	${MKDIR} ${SPEC}/freebsd-clang
 	cd ${SPEC} && ${SED} -e 's|\.\./\.\./|../|g' unsupported/freebsd-clang/qmake.conf > freebsd-clang/qmake.conf
 	cd ${SPEC} && ${SED} -e 's|\.\./\.\./|../|g' unsupported/freebsd-clang/qplatformdefs.h > freebsd-clang/qplatformdefs.h
 	${MKDIR} ${WRKSRC}/src/qt/qtbase/.git
 	${MKDIR} ${WRKSRC}/src/qt/qtwebkit/.git
 	${RM} ${WRKSRC}/src/qt/qtwebkit/Source/WebCore/DerivedSources.cpp
 
 _ENV=	CC=${CC} CXX=${CXX} GMAKE=${GMAKE} OSTYPE=freebsd MAKEFLAGS=
 _BLD=	${PYTHON_CMD} build.py --jobs ${MAKE_JOBS_NUMBER} --confirm
 do-build:
 .if defined(_PHANTOMJS_USE_QT_SYSTEM)
 	cd ${WRKSRC} && ${SETENV} ${_ENV} PATH=${PATH}:${QT_BINDIR} ${_BLD} --qt=system --qtwebkit=system
 .else
 	cd ${WRKSRC} && ${SETENV} ${_ENV} PATH=${PATH} ${_BLD}
 .endif
 
 do-install:
 	cd ${WRKSRC} && ${INSTALL_PROGRAM} bin/phantomjs ${STAGEDIR}${PREFIX}/bin/
 
 .include <bsd.port.mk>
Index: head/mail/opendkim/Makefile
===================================================================
--- head/mail/opendkim/Makefile	(revision 465898)
+++ head/mail/opendkim/Makefile	(revision 465899)
@@ -1,179 +1,182 @@
 # Created by: Hirohisa Yamaguchi <umq@ueo.co.jp>
 # $FreeBSD$
 
 PORTNAME=	opendkim
 PORTVERSION=	2.10.3
 PORTREVISION=	7
 CATEGORIES=	mail security
 MASTER_SITES=	SF/${PORTNAME} \
 		SF/${PORTNAME}/Previous%20Releases \
 		ftp://ftpmirror.uk/freebsd-ports/${PORTNAME}/
 
 MAINTAINER=	freebsd-ports@dan.me.uk
 COMMENT=	DKIM library and milter implementation
 
 LICENSE=	BSD3CLAUSE SENDMAIL
 LICENSE_COMB=	multi
 
 LICENSE_FILE_SENDMAIL=	${WRKSRC}/LICENSE.Sendmail
 LICENSE_GROUPS_SENDMAIL=FSF OSI
 LICENSE_NAME_SENDMAIL=	Sendmail Open Source License
 LICENSE_PERMS_SENDMAIL=	dist-mirror dist-sell pkg-mirror pkg-sell auto-accept
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	checking for library containing SSL_library_init... no
+
 GNU_CONFIGURE=	yes
 NO_OPTIONS_SORT=yes
 USES=		libtool perl5 pkgconfig shebangfix ssl
 USE_PERL5=	run
 SHEBANG_FILES=	opendkim/opendkim-genkey* reputation/opendkim-* stats/opendkim-* \
 		reprrd/opendkim-reprrdimport*
 USE_LDCONFIG=	yes
 
 PORTDOCS=	*
 
 CONFIGURE_ARGS+=	--without-tre
 
 OPTIONS_SUB=		yes
 OPTIONS_SINGLE=		RESOLV
 OPTIONS_SINGLE_RESOLV=	STOCK_RESOLVER UNBOUND
 OPTIONS_DEFINE=		FILTER CURL GNUTLS JANSSON LDNS LMDB LUA MEMCACHED \
 			BDB_BASE OPENDBX OPENLDAP POPAUTH QUERY_CACHE SASL
 OPTIONS_DEFAULT=	FILTER LUA UNBOUND
 
 STOCK_RESOLVER_DESC=	Use the stock resolver library
 
 UNBOUND_DESC=		Use unbound DNS library
 UNBOUND_CONFIGURE_WITH=	unbound
 UNBOUND_LIB_DEPENDS=	libunbound.so:dns/unbound
 
 FILTER_DESC=		OpenDKIM filter, requires libmilter/Sendmail
 FILTER_USE=		RC_SUBR=milter-opendkim
 
 CURL_DESC=		Use cURL for web queries
 CURL_CONFIGURE_WITH=	libcurl
 CURL_LIB_DEPENDS=	libcurl.so:ftp/curl
 
 GNUTLS_DESC=		Use GnuTLS instead of OpenSSL
 GNUTLS_LIB_DEPENDS=	libgnutls.so:security/gnutls
 GNUTLS_CONFIGURE_WITH=	gnutls
 GNUTLS_CONFIGURE_OFF=	--with-openssl=${OPENSSLBASE}
 
 JANSSON_DESC=		Statistics and other output as JSON data
 JANSSON_CONFIGURE_WITH=	libjansson
 JANSSON_LIB_DEPENDS=	libjansson.so:devel/jansson
 
 LDNS_DESC=		Use LDNS library for DNS queries
 LDNS_CONFIGURE_WITH=	ldns
 LDNS_LIB_DEPENDS=	libldns.so:dns/ldns
 
 LMDB_DESC=		Use Lightning Memory-Mapped DB key-value store
 LMDB_CONFIGURE_WITH=	lmdb
 LMDB_LIB_DEPENDS=	liblmdb.so:databases/lmdb
 
 LUA_DESC=		Describe filter policy with lua
 LUA_CONFIGURE_WITH=	lua
 LUA_USES=		lua
 
 MEMCACHED_DESC=		Use memcached as a data set
 MEMCACHED_CONFIGURE_WITH=	libmemcached
 MEMCACHED_LIB_DEPENDS=	libmemcached.so:databases/libmemcached
 
 BDB_BASE_DESC=		Use Berkeley DB from base
 
 OPENDBX_DESC=		Store filter policies via OpenDBX
 OPENDBX_CONFIGURE_WITH=	odbx
 OPENDBX_LIB_DEPENDS=	libopendbx.so:databases/opendbx
 
 OPENLDAP_DESC=		Store filter policies in LDAP
 OPENLDAP_CONFIGURE_WITH=openldap
 OPENLDAP_USE=		OPENLDAP=yes
 
 POPAUTH_DESC=		Use POP authentication DB
 POPAUTH_CONFIGURE_ENABLE=	popauth
 
 QUERY_CACHE_DESC=	Cache DNS query results locally
 QUERY_CACHE_CONFIGURE_ENABLE=	query_cache
 
 SASL_DESC=		Enable SASL authentication with LDAP
 SASL_CONFIGURE_WITH=	sasl
 
 DOCS_CONFIGURE_ON=	--docdir=${WRKDIR}/doc
 
 MAKE_ARGS+=	pkgconfigdir="${PREFIX}/libdata/pkgconfig"
 MAKE_ENV=	INSTALL_STRIP_FLAG=${STRIP}
 
 .include "${.CURDIR}/Makefile.options"
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MSASL} && ${PORT_OPTIONS:MOPENLDAP}
 WANT_OPENLDAP_SASL=	yes
 .endif
 
 .if ${PORT_OPTIONS:MFILTER}
 SUB_FILES=		pkg-message
 WITHOUT_MILTER_CFLAGS=	yes
 WITHOUT_MILTER_LDFLAGS=	yes
 .include "${PORTSDIR}/mail/sendmail/bsd.milter.mk"
 CONFIGURE_ARGS+=	--with-milter=${MILTERBASE}
 .endif
 
 .if ${PORT_OPTIONS:MLUA_ONLY_SIGNING} || \
     ${PORT_OPTIONS:MRBL}
 .if !${PORT_OPTIONS:MLUA}
 IGNORE=	options LUA_ONLY_SIGNING and RBL require LUA as well
 .endif
 .endif
 
 .if ${PORT_OPTIONS:MREPUTATION}
 .if !${PORT_OPTIONS:MCURL} || !${PORT_OPTIONS:MJANSSON}
 IGNORE=	option REPUTATION requires CURL and JANSSON as well
 .endif
 .endif
 
 .if ${PORT_OPTIONS:MSTATSEXT}
 .if !${PORT_OPTIONS:MSTATS} || !${PORT_OPTIONS:MLUA}
 IGNORE=	option STATSEXT requires STATS and LUA as well
 .endif
 .endif
 
 .if ${PORT_OPTIONS:MPOPAUTH}             \
 	|| ${PORT_OPTIONS:MQUERY_CACHE}  \
 	|| ${PORT_OPTIONS:MLDAP_CACHING} \
 	|| ${PORT_OPTIONS:MREPUTATION}   \
 	|| ${PORT_OPTIONS:MSTATS}
 . if ${PORT_OPTIONS:MBDB_BASE}
 CONFIGURE_ARGS+=	--with-db-lib=c
 . else
 CONFIGURE_ARGS+=	--with-db-incdir=${BDB_INCLUDE_DIR} \
 			--with-db-libdir=${BDB_LIB_DIR}     \
 			--with-db-lib=${BDB_LIB_NAME}
 USES+=		bdb
 . endif
 .endif
 
 .if ${PORT_OPTIONS:MCODECOVERAGE}
 LDFLAGS+=		-lpthread
 .endif
 
 pre-configure:
 	${REINPLACE_CMD} -e '/LIBLUA_LIBS/s/lua5\.[0-9]/lua-${LUA_VER}/' \
 	    -e '/PKG_CONFIG/s/lua5\.[0-9]/lua-${LUA_VER}/'		 \
 	    -e '/PKG_CONFIG/s/cyrussasl/libsasl2/'			 \
 	    ${WRKSRC}/configure
 
 post-patch:
 .if ${PORT_OPTIONS:MLCOV}
 	${CP} ${FILESDIR}/lcov-helper.sh ${WRKSRC}/libopendkim/tests/
 	${CP} ${FILESDIR}/lcov-helper.sh ${WRKSRC}/opendkim/tests/
 	${FIND} ${WRKSRC} -type f -name \*-helper.sh -exec ${CHMOD} 755 {} +
 .endif
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/etc/mail
 	${INSTALL_DATA} ${WRKSRC}/opendkim/opendkim.conf.sample \
 	    ${STAGEDIR}${PREFIX}/etc/mail/
 
 regression-test: build
 	cd ${WRKSRC} ; ${MAKE} check
 
 .include <bsd.port.mk>
Index: head/multimedia/librtmp/Makefile
===================================================================
--- head/multimedia/librtmp/Makefile	(revision 465898)
+++ head/multimedia/librtmp/Makefile	(revision 465899)
@@ -1,20 +1,23 @@
 # $FreeBSD$
 
 PORTNAME=	librtmp
 PORTVERSION=	2.4.20151223
 CATEGORIES=	multimedia net
 MASTER_SITES=	LOCAL/hrs
 DISTNAME=	rtmpdump-2.4.fa8646da
 
 MAINTAINER=	hrs@FreeBSD.org
 COMMENT=	RTMP stream library
 
 LICENSE=	GPLv2
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: incomplete definition of type 'struct dh_st'
+
 USES=		pkgconfig tar:bz2 ssl
 USE_LDCONFIG=	yes
 CFLAGS+=	-I${OPENSSLINC}
 LDFLAGS+=	-L${OPENSSLLIB}
 WRKSRC=		${WRKDIR}/${DISTNAME}/librtmp
 
 .include <bsd.port.mk>
Index: head/net/liboauth/Makefile
===================================================================
--- head/net/liboauth/Makefile	(revision 465898)
+++ head/net/liboauth/Makefile	(revision 465899)
@@ -1,26 +1,29 @@
 # $FreeBSD$
 
 PORTNAME=	liboauth
 PORTVERSION=	1.0.3
 PORTREVISION=	3
 CATEGORIES=	net
 MASTER_SITES=	SF/${PORTNAME}
 
 MAINTAINER=	hrs@FreeBSD.org
 COMMENT=	C library implementing the OAuth Core standard
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/COPYING.MIT
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: variable has incomplete type 'EVP_MD_CTX' (aka 'struct evp_md_ctx_st')
+
 LIB_DEPENDS=	libcurl.so:ftp/curl
 
 USES=		libtool pkgconfig ssl
 USE_LDCONFIG=	yes
 GNU_CONFIGURE=	yes
 MAKE_ARGS=	pkgconfigdir="${PREFIX}/libdata/pkgconfig"
 INSTALL_TARGET=	install-strip
 
 post-patch:
 	@${REINPLACE_CMD} -e '/PC_REQ=/s/ libcrypto//' ${WRKSRC}/configure
 
 .include <bsd.port.mk>
Index: head/net/qt4-network/Makefile
===================================================================
--- head/net/qt4-network/Makefile	(revision 465898)
+++ head/net/qt4-network/Makefile	(revision 465899)
@@ -1,62 +1,65 @@
 # Created by: lofi@FreeBSD.org
 # $FreeBSD$
 
 PORTNAME=	network
 DISTVERSION=	${QT4_VERSION}
 PORTREVISION=	3
 CATEGORIES=	net ipv6
 PKGNAMEPREFIX=	qt4-
 
 MAINTAINER=	kde@FreeBSD.org
 COMMENT=	Qt network module
 
 LICENSE=	GPLv3 LGPL21 LGPL3 GFDL
 LICENSE_COMB=	dual
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: member access into incomplete type 'RSA' (aka 'rsa_st')
+
 RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 
 USES=		ssl
 USE_QT4=	qmake_build moc_build rcc_build corelib
 QT_DIST=	yes
 HAS_CONFIGURE=	yes
 USE_LDCONFIG=	${PREFIX}/${QT_LIBDIR_REL}
 
 ALL_TARGET=	first
 CONFIGURE_ENV?=	QTDIR=${WRKSRC} PATH=${WRKSRC}/bin:$$PATH
 MAKE_ENV?=	QTDIR=${WRKSRC} LD_LIBRARY_PATH=${WRKSRC}/lib:$$LD_LIBRARY_PATH \
 		PATH=${WRKSRC}/bin:$$PATH
 
 DO_NOT_EXTRACT=	demos doc examples mkspecs qmake tools translations \
 		src/activeqt src/dbus src/gui src/multimedia src/opengl \
 		src/openvg src/phonon src/qt3support src/s60installs \
 		src/s60main src/script src/scripttools src/sql src/svg \
 		src/testlib src/tools src/winmain src/xml src/xmlpatterns \
 		src/3rdparty/clucene src/3rdparty/freetype \
 		src/3rdparty/libjpeg src/3rdparty/libmng src/3rdparty/libpng \
 		src/3rdparty/libtiff src/3rdparty/phonon src/3rdparty/webkit
 .for dne in ${DO_NOT_EXTRACT}
 EXTRACT_AFTER_ARGS+=	--exclude '${DISTNAME}/${dne}'
 .endfor
 
 BUILD_WRKSRC=	${WRKSRC}/src/${PORTNAME}
 INSTALL_WRKSRC=	${BUILD_WRKSRC}
 
 pre-configure:
 	${MKDIR} ${WRKSRC}/mkspecs
 	${LN} -sf ${QMAKE} ${WRKSRC}/bin/qmake
 	${LN} -sf ${MOC} ${WRKSRC}/bin/moc
 	${LN} -sf ${RCC} ${WRKSRC}/bin/rcc
 
 post-configure:
 	${REINPLACE_CMD} -e 's|${PREFIX}/${QT_LIBDIR_REL}/pkgconfig|${PREFIX}/libdata/pkgconfig|g' \
 			-e 's|.*$$(QMAKE).*||g' ${BUILD_WRKSRC}/Makefile
 	${REINPLACE_CMD} -E -e 's|-L.[^[:space:]]*qt-x11-opensource.[^[:space:]]*lib||g' \
 			-E -e 's|(.*location=).*moc|\1${PREFIX}/${QT_BINDIR_REL}/${MOC:T}|g' \
 			-E -e 's|(.*location=).*uic|\1${PREFIX}/${QT_BINDIR_REL}/${UIC:T}|g' \
 		${WRKSRC}/lib/pkgconfig/QtNetwork.pc
 	${REINPLACE_CMD} -e 's|/usr/local|${LOCALBASE}|g' \
 		${WRKSRC}/src/network/ssl/qsslsocket_openssl.cpp
 	${REINPLACE_CMD} -e 's|%%OPENSSLLIB%%|${OPENSSLLIB}|g' \
 		${WRKSRC}/src/network/ssl/qsslsocket_openssl_symbols.cpp
 
 .include <bsd.port.mk>
Index: head/net/qt5-network/Makefile
===================================================================
--- head/net/qt5-network/Makefile	(revision 465898)
+++ head/net/qt5-network/Makefile	(revision 465899)
@@ -1,49 +1,52 @@
 # $FreeBSD$
 
 PORTNAME=	network
 DISTVERSION=	${QT5_VERSION}
 PORTREVISION=	1
 CATEGORIES=	net ipv6
 PKGNAMEPREFIX=	qt5-
 
 MAINTAINER=	kde@FreeBSD.org
 COMMENT=	Qt network module
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: member access into incomplete type 'X509' (aka 'x509_st')
+
 RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 
 USES=		ssl
 USE_QT5=	core qmake_build buildtools_build
 QT_DIST=	base
 HAS_CONFIGURE=	yes
 CONFIGURE_ARGS=	-no-gui -no-xcb
 USE_LDCONFIG=	${PREFIX}/${QT_LIBDIR_REL}
 
 BUILD_WRKSRC=	${WRKSRC}/src/${PORTNAME}
 INSTALL_WRKSRC=	${BUILD_WRKSRC}
 
 QT_DEFINES=	OPENSSL SSL
 QT_CONFIG=	openssl
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|/usr/local|${LOCALBASE}|g' \
 		${BUILD_WRKSRC}/ssl/qsslsocket_openssl.cpp
 	@${REINPLACE_CMD} -e 's|%%OPENSSLLIB%%|${OPENSSLLIB}|g' \
 		${BUILD_WRKSRC}/ssl/qsslsocket_openssl_symbols.cpp
 
 post-configure:
 .for d in src/network src/plugins/bearer/generic
 	${MKDIR} ${WRKSRC}/${d}
 	cd ${WRKSRC}/${d} && ${SETENV} ${QMAKE_ENV} ${_QMAKE} ${QMAKE_ARGS} ${WRKSRC}/${d}
 .endfor
 
 post-build:
 	@cd ${WRKSRC}/src/plugins/bearer/generic && \
 		${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_FLAGS} ${MAKEFILE} \
 		${_MAKE_JOBS} ${MAKE_ARGS} ${ALL_TARGET}
 
 post-install:
 	@cd ${WRKSRC}/src/plugins/bearer/generic && \
 		${SETENV} ${MAKE_ENV} ${MAKE} ${MAKE_FLAGS} ${MAKEFILE} \
 		${MAKE_ARGS} ${INSTALL_TARGET}
 
 .include <bsd.port.mk>
Index: head/security/botan110/Makefile
===================================================================
--- head/security/botan110/Makefile	(revision 465898)
+++ head/security/botan110/Makefile	(revision 465899)
@@ -1,62 +1,65 @@
 # Created by: Ying-Chieh Liao <ijliao@FreeBSD.org>
 # $FreeBSD$
 
 PORTNAME=	botan
 PORTVERSION=	1.10.13
 PORTREVISION=	7
 CATEGORIES=	security
 MASTER_SITES=	http://botan.randombit.net/releases/
 PKGNAMESUFFIX=	110
 DISTNAME=	Botan-${PORTVERSION}
 
 MAINTAINER=	lapo@lapo.it
 COMMENT=	Portable, easy to use, and efficient C++ crypto library
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: variable has incomplete type 'EVP_MD_CTX' (aka 'struct evp_md_ctx_st')
+
 LICENSE=	BSD2CLAUSE
 LICENSE_FILE=	${WRKSRC}/doc/license.txt
 
 OPTIONS_DEFINE=		SSL GMP DOCS
 OPTIONS_DEFAULT=	SSL GMP
 
 USES=		compiler gmake python:build tar:tgz
 HAS_CONFIGURE=	yes
 CONFIGURE_SCRIPT=	configure.py
 CONFIGURE_ARGS=	--prefix=${PREFIX} --cc ${CHOSEN_COMPILER_TYPE} \
 		--with-tr1-implementation=system --with-bzip2 --with-zlib
 MAKE_ARGS=	CXX="${CXX}" LIB_OPT="${CXXFLAGS}"
 USE_LDCONFIG=	yes
 PLIST_FILES=	bin/botan-config-1.10 lib/libbotan-1.10.a lib/libbotan-1.10.so lib/libbotan-1.10.so.1 \
 		lib/libbotan-1.10.so.1.13 libdata/pkgconfig/botan-1.10.pc
 
 DOCSDIR=	${PREFIX}/share/doc/${PORTNAME}-${PORTVERSION}
 PORTDOCS=	*
 
 BROKEN_aarch64=		Fails to configure: unknown or unidentifiable processor arm64
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MSSL}
 USES+=		ssl
 CONFIGURE_ARGS+=--with-openssl
 .endif
 
 .if ${PORT_OPTIONS:MGMP}
 USES+=		localbase:ldflags
 LIB_DEPENDS+=	libgmp.so:math/gmp
 CONFIGURE_ARGS+=--with-gnump
 .endif
 
 .include <bsd.port.pre.mk>
 
 post-patch:
 	${REINPLACE_CMD} -e "s|#!/usr/bin/env python|#!${PYTHON_CMD}|" \
 			${WRKSRC}/configure.py
 .if ! ${PORT_OPTIONS:MDOCS}
 	${REINPLACE_CMD} -e '/DOCDIR/d' \
 			${WRKSRC}/src/build-data/makefile/unix_shr.in
 .endif
 
 post-install:
 	@(cd "${STAGEDIR}${PREFIX}"; ${FIND} -s include/botan-1.10 -not -type d) >> ${TMPPLIST}
 
 .include <bsd.port.post.mk>
Index: head/security/dsniff/Makefile
===================================================================
--- head/security/dsniff/Makefile	(revision 465898)
+++ head/security/dsniff/Makefile	(revision 465899)
@@ -1,40 +1,43 @@
 # Created by: Kris Kennaway <kris@FreeBSD.org>
 # $FreeBSD$
 
 PORTNAME=	dsniff
 DISTVERSION=	2.4b1
 PORTREVISION=	1
 CATEGORIES=	security
 MASTER_SITES=	http://www.monkey.org/~dugsong/${PORTNAME}/beta/ \
 		LOCAL/sbz
 
 MAINTAINER=	sbz@FreeBSD.org
 COMMENT=	Various sniffing utilities for penetration testing
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	incomplete definition of type 'struct rsa_st'
+
 BUILD_DEPENDS=	${LOCALBASE}/lib/libnids.a:net/libnids
 LIB_DEPENDS=	libnet.so:net/libnet
 
 USES=		gettext pkgconfig ssl
 USE_GNOME=	glib20
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--with-libnet=${LOCALBASE}
 DESTDIRNAME=	install_prefix
 WRKSRC=		${WRKDIR}/${PORTNAME}-${DISTVERSION:C/..$//}
 
 OPTIONS_DEFINE=	X11
 OPTIONS_DEFAULT=	X11
 OPTIONS_SUB=	yes
 
 X11_USE=	xorg=x11,xmu
 X11_CONFIGURE_WITH=x
 
 post-patch:
 	@${REINPLACE_CMD} -e 's,csin,_csin,g' \
 		${WRKSRC}/webmitm.c \
 		${WRKSRC}/sshmitm.c
 
 .include <bsd.port.mk>
Index: head/security/krb5-116/Makefile
===================================================================
--- head/security/krb5-116/Makefile	(revision 465898)
+++ head/security/krb5-116/Makefile	(revision 465899)
@@ -1,150 +1,153 @@
 # Created by: nectar@FreeBSD.org
 # $FreeBSD$
 
 PORTNAME=		krb5
 PORTVERSION=		1.16
 PORTREVISION=		1
 CATEGORIES=		security
 MASTER_SITES=		http://web.mit.edu/kerberos/dist/${PORTNAME}/${PORTVERSION:C/^[0-9]*\.[0-9]*/&X/:C/X\.[0-9]*$//:C/X//}/
 .if !defined(MASTERDIR)
 PKGNAMESUFFIX=		-116
 .endif
 
 PATCH_SITES=		http://web.mit.edu/kerberos/advisories/
 PATCH_DIST_STRIP=	-p2
 
 MAINTAINER=		cy@FreeBSD.org
 COMMENT=		MIT implementation of RFC 4120 network authentication service
 
 LICENSE=		MIT
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: "This file is obsolete; please update your software."
+
 CONFLICTS=		heimdal-[0-9]* srp-[0-9]* krb5-11[34]-[0-9]* \
 			krb5-1.[0-9]* krb5-devel-*
 
 KERBEROSV_URL=		http://web.mit.edu/kerberos/
 USE_PERL5=		build
 USE_LDCONFIG=		yes
 USE_CSTD=		gnu99
 GNU_CONFIGURE=		yes
 USES=			cpe gmake localbase perl5 libtool:build \
 			gssapi:bootstrap,mit pkgconfig:run ssl \
 			gettext-runtime
 CONFIGURE_ARGS?=	--enable-shared --without-system-verto \
 			--disable-rpath --localstatedir="${PREFIX}/var"
 CONFIGURE_ENV=		INSTALL="${INSTALL}" INSTALL_LIB="${INSTALL_LIB}" YACC="${YACC}"
 MAKE_ARGS=		INSTALL="${INSTALL}" INSTALL_LIB="${INSTALL_LIB}"
 
 CPE_VENDOR=		mit
 CPE_VERSION=		5-${PORTVERSION}
 CPE_PRODUCT=		kerberos
 
 OPTIONS_DEFINE=		EXAMPLES NLS KRB5_PDF KRB5_HTML DNS_FOR_REALM LDAP
 OPTIONS_DEFAULT=	KRB5_PDF KRB5_HTML READLINE
 OPTIONS_RADIO=		CMD_LINE_EDITING
 OPTIONS_RADIO_CMD_LINE_EDITING=	READLINE READLINE_PORT LIBEDIT
 CMD_LINE_EDITING_DESC=	Command line editing for kadmin and ktutil
 KRB5_PDF_DESC=		Install krb5 PDF documentation
 KRB5_HTML_DESC=		Install krb5 HTML documentation
 DNS_FOR_REALM_DESC=	Enable DNS lookups for Kerberos realm names
 DNS_FOR_REALM_CONFIGURE_ENABLE=	dns-for-realm
 LDAP=			Enable LDAP support
 LDAP_USE=		OPENLDAP=yes
 LDAP_CONFIGURE_WITH=	ldap
 NLS_USES=		gettext
 READLINE_USES=		readline
 READLINE_PORT_DESC=	Command line editing via devel/readline
 READLINE_PORT_USES=	readline:port
 LIBEDIT_USES=		libedit
 LIBEDIT_CONFIGURE_WITH=	libedit
 
 .if defined(KRB5_HOME)
 PREFIX=			${KRB5_HOME}
 .endif
 CPPFLAGS+=		-I${OPENSSLINC}
 LDFLAGS+=		-L${OPENSSLLIB}
 
 USE_RC_SUBR=		kpropd
 OPTIONS_SUB=		yes
 WRKSRC_SUBDIR=		src
 PORTEXAMPLES=		kdc.conf krb5.conf services.append
 
 .include <bsd.port.options.mk>
 
 # Fix up -Wl,-rpath in LDFLAGS
 .if !empty(KRB5_HOME)
 _RPATH=	${KRB5_HOME}/lib:
 .else
 _RPATH=	${LOCALBASE}/lib:
 .endif
 .if !empty(LDFLAGS:M-Wl,-rpath,*)
 .for F in ${LDFLAGS:M-Wl,-rpath,*}
 LDFLAGS:=	-Wl,-rpath,${_RPATH}${F:S/-Wl,-rpath,//} \
 		${LDFLAGS:N-Wl,-rpath,*}
 .endfor
 .endif
 
 .if defined(KRB5_HOME) && ${KRB5_HOME} != ${LOCALBASE}
 BROKEN=			LIB_DEPENDS when using KRB5_HOME is broken
 .endif
 
 # OPTIONS helper causes conflicting with/without
 .if ${PORT_OPTIONS:MREADLINE} || ${PORT_OPTIONS:MREADLINE_PORT}
 CONFIGURE_ARGS+=	--with-readline
 .else
 CONFIGURE_ARGS+=	--without-readline
 .endif
 
 .if defined(PROGRAM_TRANSFORM_NAME) && ${PROGRAM_TRANSFORM_NAME} != ""
 CONFIGURE_ARGS+=	--program-transform-name="${PROGRAM_TRANSFORM_NAME}"
 .endif
 
 HTML_DOC_DIR=		${WRKDIR}/${PORTNAME}-${PORTVERSION}/doc/html
 PDF_DOC_DIR=		${WRKDIR}/${PORTNAME}-${PORTVERSION}/doc/pdf
 
 .include <bsd.port.pre.mk>
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/share/doc/krb5
 # html documentation
 .if ${PORT_OPTIONS:MKRB5_PDF}
 	pdf_files=`${FIND} ${PDF_DOC_DIR} ! -type d`
 	pdf_dirs=`${FIND} ${PDF_DOC_DIR} -type d`
 	for i in $${pdf_dirs}; do \
 		${MKDIR} ${STAGEDIR}${PREFIX}/share/doc/krb5/$${i}; \
 	done; \
 	for i in $${pdf_files}; do \
 		${INSTALL_DATA} $${pdf} ${PREFIX}/share/doc/krb5/$${i}; \
 		${ECHO_CMD} share/doc/krb5/$${i} >> ${TMPPLIST}; \
 	done
 .endif
 .if ${PORT_OPTIONS:MKRB5_HTML}
 	html_files=`${FIND} ${HTML_DOC_DIR} ! -type d | ${GREP} -v /_sources`
 	html_dirs=`${FIND} ${HTML_DOC_DIR} -type d | ${GREP} -v /_sources`
 	for i in $${html_dirs}; do \
 		${MKDIR} ${PREFIX}/share/doc/krb5/$${i}; \
 	done; \
 	for i in $${html_files}; do \
 		${INSTALL_DATA} $${i} ${PREFIX}/share/doc/krb5/$${i}; \
 		${ECHO_CMD} share/doc/krb5/$${i} >> ${TMPPLIST}; \
 	done
 .endif
 .if ${PORT_OPTIONS:MKRB5_PDF}
 	for i in $${pdf_dirs}; do \
 		${ECHO_CMD} @dir share/doc/krb5/$${i} >> ${TMPPLIST}; \
 	done | ${TAIL} -r >> ${TMPPLIST}
 .endif
 .if ${PORT_OPTIONS:MKRB5_HTML}
 	for i in $${html_dirs}; do \
 		${ECHO_CMD} @dir share/doc/krb5/$${i} >> ${TMPPLIST}; \
 	done | ${TAIL} -r >> ${TMPPLIST}
 .endif
 	${ECHO_CMD} @dir share/doc/krb5 >> ${TMPPLIST}
 
 post-install-LDAP-on:
 	${MKDIR} ${STAGEDIR}${DATADIR}
 	${INSTALL_DATA} ${WRKSRC}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema \
 		${STAGEDIR}${DATADIR}
 	${INSTALL_DATA} ${WRKSRC}/plugins/kdb/ldap/libkdb_ldap/kerberos.ldif \
 		${STAGEDIR}${DATADIR}
 
 .include <bsd.port.post.mk>
Index: head/security/libssh/Makefile
===================================================================
--- head/security/libssh/Makefile	(revision 465898)
+++ head/security/libssh/Makefile	(revision 465899)
@@ -1,53 +1,56 @@
 # Created by: Alexander Logvinov <ports@logvinov.com>
 # $FreeBSD$
 
 PORTNAME=	libssh
 DISTVERSION=	0.7.5
 CATEGORIES=	security devel
 MASTER_SITES=	https://git.libssh.org/projects/libssh.git/snapshot/
 
 MAINTAINER=	johans@FreeBSD.org
 COMMENT=	Library implementing the SSH1 and SSH2 protocol
 
 LICENSE=	LGPL21
 LICENSE_FILE=	${WRKSRC}/COPYING
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: variable has incomplete type 'EVP_MD_CTX' (aka 'struct evp_md_ctx_st')
+
 OPTIONS_DEFINE=	SSH1 STATIC
 OPTIONS_RADIO=	CRYPTO
 OPTIONS_RADIO_CRYPTO=	GCRYPT OPENSSL
 OPTIONS_DEFAULT=	OPENSSL STATIC
 OPTIONS_SUB=	yes
 
 USES=		cmake:outsource cpe tar:xz
 USE_LDCONFIG=	yes
 
 CMAKE_ARGS=	-DWITH_EXAMPLES:BOOL=OFF \
 		-DWITH_GSSAPI:BOOL=ON \
 		-DWITH_TESTING:BOOL=OFF \
 		-DWITH_ZLIB:BOOL=ON
 
 GCRYPT_LIB_DEPENDS=	libgcrypt.so:security/libgcrypt
 GCRYPT_CMAKE_ON=	-DWITH_GCRYPT:BOOL=ON
 GCRYPT_CMAKE_OFF=	-DWITH_GCRYPT:BOOL=OFF
 
 OPENSSL_USES=		ssl
 
 SSH1_DESC=		Build with SSH1 support
 SSH1_CMAKE_ON=		-DWITH_SSH1:BOOL=ON
 SSH1_CMAKE_OFF=		-DWITH_SSH1:BOOL=OFF
 
 STATIC_CMAKE_ON=	-DWITH_STATIC_LIB:BOOL=ON
 STATIC_CMAKE_OFF=	-DWITH_STATIC_LIB:BOOL=OFF
 
 post-patch:
 	@${RM} ${PATCH_WRKSRC}/cmake/Modules/UseDoxygen.cmake
 	@${REINPLACE_CMD} \
 		-e 's|LIB_INSTALL_DIR}|CMAKE_INSTALL_PREFIX}/libdata|' \
 		-e 's|CMAKE_INSTALL_DIR}|CMAKE_INSTALL_DIR}/libssh|' \
 		${WRKSRC}/CMakeLists.txt
 	@${REINPLACE_CMD} -e 's|-lssh_threads|-lssh_threads -lpthread|' \
 		${WRKSRC}/libssh_threads.pc.cmake
 	@${REINPLACE_CMD} -e 's| -pedantic-errors||' \
 		${WRKSRC}/cmake/Modules/DefineCompilerFlags.cmake
 
 .include <bsd.port.mk>
Index: head/security/openssh-portable/Makefile
===================================================================
--- head/security/openssh-portable/Makefile	(revision 465898)
+++ head/security/openssh-portable/Makefile	(revision 465899)
@@ -1,228 +1,229 @@
 # Created by: dwcjr@inethouston.net
 # $FreeBSD$
 
 PORTNAME=	openssh
 DISTVERSION=	7.6p1
 PORTREVISION=	3
 PORTEPOCH=	1
 CATEGORIES=	security ipv6
 MASTER_SITES=	OPENBSD/OpenSSH/portable
 PKGNAMESUFFIX?=	-portable
 
 MAINTAINER=	bdrewery@FreeBSD.org
 COMMENT=	The portable version of OpenBSD's OpenSSH
 
 #LICENSE=      BSD2,BSD3,MIT,public domain,BSD-Style,BEER-WARE,"any purpose with notice intact",ISC-Style
 #LICENSE_FILE= ${WRKSRC}/LICENCE
 
 CONFLICTS?=		openssh-3.* ssh-1.* ssh2-3.* openssh-portable-devel-*
 
 USES=			alias autoreconf ncurses ssl
 GNU_CONFIGURE=		yes
 CONFIGURE_ENV=		ac_cv_func_strnvis=no
 CONFIGURE_ARGS=		--prefix=${PREFIX} --with-md5-passwords \
 			--without-zlib-version-check --with-ssl-engine \
 			--with-mantype=man
 
 ETCOLD=			${PREFIX}/etc
 
-BROKEN_SSL_REASON_openssl-devel=	incomplete definition of type struct rsa_st
+BROKEN_SSL=	openssl-devel libressl
+BROKEN_SSL_REASON_openssl-devel=	error: OpenSSL >= 1.1.0 is not yet supported
 BROKEN_SSL_REASON_libressl=		random crashes with 7.6 PR 223000
 
 OPTIONS_DEFINE=		PAM TCP_WRAPPERS LIBEDIT BSM \
 			HPN X509 KERB_GSSAPI \
 			SCTP LDNS NONECIPHER
 OPTIONS_DEFAULT=	LIBEDIT PAM TCP_WRAPPERS LDNS
 OPTIONS_RADIO=		KERBEROS
 OPTIONS_RADIO_KERBEROS=	MIT HEIMDAL HEIMDAL_BASE
 TCP_WRAPPERS_DESC=	tcp_wrappers support
 BSM_DESC=		OpenBSM Auditing
 KERB_GSSAPI_DESC=	Kerberos/GSSAPI patch (req: GSSAPI)
 HPN_DESC=		HPN-SSH patch
 LDNS_DESC=		SSHFP/LDNS support
 X509_DESC=		x509 certificate patch
 SCTP_DESC=		SCTP support
 HEIMDAL_DESC=		Heimdal Kerberos (security/heimdal)
 HEIMDAL_BASE_DESC=	Heimdal Kerberos (base)
 MIT_DESC=		MIT Kerberos (security/krb5)
 NONECIPHER_DESC=	NONE Cipher support
 
 OPTIONS_SUB=		yes
 
 TCP_WRAPPERS_EXTRA_PATCHES=${FILESDIR}/extra-patch-tcpwrappers
 
 LDNS_CONFIGURE_WITH=	ldns=${LOCALBASE}
 LDNS_LIB_DEPENDS=	libldns.so:dns/ldns
 LDNS_EXTRA_PATCHES=	${FILESDIR}/extra-patch-ldns
 LDNS_CFLAGS=		-I${LOCALBASE}/include
 LDNS_CONFIGURE_ON=	--with-ldflags='-L${LOCALBASE}/lib'
 
 # http://www.psc.edu/index.php/hpn-ssh
 HPN_CONFIGURE_WITH=		hpn
 NONECIPHER_CONFIGURE_WITH=	nonecipher
 
 # See http://www.roumenpetrov.info/openssh/
 X509_VERSION=		11.0
 X509_PATCH_SITES=	http://www.roumenpetrov.info/openssh/x509-${X509_VERSION}/:x509
 X509_EXTRA_PATCHES+=	${FILESDIR}/extra-patch-x509-glue
 X509_PATCHFILES=	${PORTNAME}-7.6p1+x509-${X509_VERSION}.diff.gz:-p1:x509
 
 # See https://bugzilla.mindrot.org/show_bug.cgi?id=2016
 # and https://bugzilla.mindrot.org/show_bug.cgi?id=1604
 #SCTP_PATCHFILES=	${PORTNAME}-7.2_p1-sctp.patch.gz:-p1
 SCTP_BROKEN=		Does not apply to 7.6+
 SCTP_CONFIGURE_WITH=	sctp
 SCTP_EXTRA_PATCHES+=	${FILESDIR}/extra-patch-sctp:-p1
 
 MIT_LIB_DEPENDS=		libkrb5.so.3:security/krb5
 HEIMDAL_LIB_DEPENDS=		libkrb5.so.26:security/heimdal
 
 PAM_CONFIGURE_WITH=	pam
 TCP_WRAPPERS_CONFIGURE_WITH=	tcp-wrappers
 
 LIBEDIT_CONFIGURE_WITH=	libedit
 LIBEDIT_USES=		libedit
 BSM_CONFIGURE_ON=	--with-audit=bsm
 
 ETCDIR?=		${PREFIX}/etc/ssh
 
 .include <bsd.port.pre.mk>
 
 PATCH_SITES+=		http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,x509,hpn,gsskex
 
 # X509 patch includes TCP Wrapper support already
 .if ${PORT_OPTIONS:MX509}
 EXTRA_PATCHES:=		${EXTRA_PATCHES:N${TCP_WRAPPERS_EXTRA_PATCHES}}
 .endif
 
 # Must add this patch before HPN due to conflicts
 .if ${PORT_OPTIONS:MKERB_GSSAPI}
 BROKEN=	No patch for 7.6 yet.
 # Patch from:
 # http://sources.debian.net/data/main/o/openssh/1:7.4p1-5/debian/patches/gssapi.patch
 # which was originally based on 5.7 patch from
 # http://www.sxw.org.uk/computing/patches/
 # It is mirrored simply to apply gzip -9.
 .  if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER}
 # Needed glue for applying HPN patch without conflict
 EXTRA_PATCHES+=	${FILESDIR}/extra-patch-hpn-gss-glue
 .  endif
 PATCHFILES+=	openssh-7.4p1-gsskex-all-20141021-debian-rh-20161228.patch.gz:-p1:gsskex
 .endif
 
 # http://www.psc.edu/index.php/hpn-ssh https://github.com/rapier1/hpn-ssh https://github.com/rapier1/openssh-portable
 .if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER}
 BROKEN=			Not yet updated for 7.6+ and disabled in base
 PORTDOCS+=		HPN-README
 HPN_VERSION=		14v5
 HPN_DISTVERSION=	6.7p1
 #PATCH_SITES+=		SOURCEFORGE/hpnssh/HPN-SSH%20${HPN_VERSION}%20${HPN_DISTVERSION}/:hpn
 #PATCHFILES+=		${PORTNAME}-${HPN_DISTVERSION}-hpnssh${HPN_VERSION}.diff.gz:-p1:hpn
 EXTRA_PATCHES+=		${FILESDIR}/extra-patch-hpn:-p2
 .elif !${PORT_OPTIONS:MHPN} && !${PORT_OPTIONS:MNONECIPHER}
 # Apply compatibility patch
 EXTRA_PATCHES+=		${FILESDIR}/extra-patch-hpn-compat
 .endif
 
 CONFIGURE_LIBS+=	-lutil
 
 CONFIGURE_ARGS+=	--disable-utmp --disable-wtmp --disable-wtmpx --without-lastlog
 
 # Keep this last
 EXTRA_PATCHES+=		${FILESDIR}/extra-patch-version-addendum
 
 .if ${PORT_OPTIONS:MX509}
 .  if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER}
 BROKEN=		X509 patch and HPN patch do not apply cleanly together
 .  endif
 
 .  if ${PORT_OPTIONS:MSCTP}
 BROKEN=		X509 patch and SCTP patch do not apply cleanly together
 .  endif
 
 .  if ${PORT_OPTIONS:MKERB_GSSAPI}
 BROKEN=		X509 patch incompatible with KERB_GSSAPI patch
 .  endif
 
 .endif
 
 .if ${PORT_OPTIONS:MHEIMDAL_BASE} && ${PORT_OPTIONS:MKERB_GSSAPI}
 BROKEN=		KERB_GSSAPI Requires either MIT or HEMIDAL, does not build with base Heimdal currently
 .endif
 
 .if ${PORT_OPTIONS:MHEIMDAL_BASE} && !exists(/usr/lib/libkrb5.so)
 IGNORE=		you have selected HEIMDAL_BASE but do not have heimdal installed in base
 .endif
 
 .if ${PORT_OPTIONS:MMIT} || ${PORT_OPTIONS:MHEIMDAL} || ${PORT_OPTIONS:MHEIMDAL_BASE}
 .	if ${PORT_OPTIONS:MHEIMDAL_BASE}
 CONFIGURE_LIBS+=	-lgssapi_krb5
 CONFIGURE_ARGS+=	--with-kerberos5=/usr
 .	else
 CONFIGURE_ARGS+=	--with-kerberos5=${LOCALBASE}
 .	endif
 .	if ${OPENSSLBASE} == "/usr"
 CONFIGURE_ARGS+=	--without-rpath
 LDFLAGS=		# empty
 .	endif
 .else
 .	if ${PORT_OPTIONS:MKERB_GSSAPI}
 IGNORE=	KERB_GSSAPI requires one of MIT HEIMDAL or HEIMDAL_BASE
 .	endif
 .endif
 
 .if ${OPENSSLBASE} != "/usr"
 CONFIGURE_ARGS+=	--with-ssl-dir=${OPENSSLBASE}
 .endif
 
 EMPTYDIR=		/var/empty
 
 USE_RC_SUBR=		openssh
 
 # After all
 CONFIGURE_ARGS+=	--sysconfdir=${ETCDIR} --with-privsep-path=${EMPTYDIR}
 .if !empty(CONFIGURE_LIBS)
 CONFIGURE_ARGS+=	--with-libs='${CONFIGURE_LIBS}'
 .endif
 
 CONFIGURE_ARGS+=	--with-xauth=${LOCALBASE}/bin/xauth
 
 RC_SCRIPT_NAME=		openssh
 VERSION_ADDENDUM_DEFAULT?=	${OPSYS}-${PKGNAME}
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|-ldes|-lcrypto|g' ${WRKSRC}/configure
 	@${REINPLACE_CMD} \
 	    -e 's|install: \(.*\) host-key check-config|install: \1|g' \
 	    ${WRKSRC}/Makefile.in
 	@${REINPLACE_CMD} -e 's|%%PREFIX%%|${LOCALBASE}|' \
 		-e 's|%%RC_SCRIPT_NAME%%|${RC_SCRIPT_NAME}|' ${WRKSRC}/sshd.8
 	@${REINPLACE_CMD} \
 	    -e 's|\(VersionAddendum\) none|\1 ${VERSION_ADDENDUM_DEFAULT}|' \
 	    ${WRKSRC}/sshd_config
 	@${REINPLACE_CMD} \
 	    -e 's|%%SSH_VERSION_FREEBSD_PORT%%|${VERSION_ADDENDUM_DEFAULT}|' \
 	    ${WRKSRC}/sshd_config.5
 	@${ECHO_CMD} '#define SSH_VERSION_FREEBSD_PORT	"${VERSION_ADDENDUM_DEFAULT}"' >> \
 		${WRKSRC}/version.h
 
 post-install:
 	${MV} ${STAGEDIR}${ETCDIR}/ssh_config \
 	    ${STAGEDIR}${ETCDIR}//ssh_config.sample
 	${MV} ${STAGEDIR}${ETCDIR}/sshd_config \
 	    ${STAGEDIR}${ETCDIR}/sshd_config.sample
 .if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER}
 	${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/HPN-README ${STAGEDIR}${DOCSDIR}
 .endif
 
 test: build
 	cd ${WRKSRC} && ${SETENV} -i \
 		OBJ=${WRKDIR} ${MAKE_ENV} \
 		TEST_SHELL=${SH} \
 		SUDO="${SUDO}" \
 		LOGNAME="${LOGNAME}" \
 		PATH=${WRKSRC}:${PREFIX}/bin:${PREFIX}/sbin:${PATH} \
 		${MAKE_CMD} ${MAKE_FLAGS} ${MAKEFILE} ${MAKE_ARGS} tests
 
 .include <bsd.port.post.mk>
Index: head/security/py-m2crypto/Makefile
===================================================================
--- head/security/py-m2crypto/Makefile	(revision 465898)
+++ head/security/py-m2crypto/Makefile	(revision 465899)
@@ -1,35 +1,38 @@
 # Created by: Peter Haight <peterh@sapros.com>
 # $FreeBSD$
 
 PORTNAME=	m2crypto
 PORTVERSION=	0.29.0
 CATEGORIES=	security python
 MASTER_SITES=	CHEESESHOP
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
 DISTNAME=	M2Crypto-${PORTVERSION}
 
 MAINTAINER=	sunpoet@FreeBSD.org
 COMMENT=	Crypto and SSL toolkit for Python
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENCE
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	Error: Syntax error in input(1).
+
 BUILD_DEPENDS=	swig3.0:devel/swig30
 
 PYDISTUTILS_BUILDARGS=	build_ext --include=${OPENSSLINC} --openssl=${OPENSSLBASE} --swig=${LOCALBASE}/bin/swig3.0
 USE_PYTHON=	autoplist concurrent distutils
 USES=		python ssl
 
 post-patch:
 	@${REINPLACE_CMD} -e "s|swig\(', '-version\)|swig3.0\1|" ${WRKSRC}/setup.py
 
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${PYTHON_SITELIBDIR}/M2Crypto/_m2crypto.so
 
 .include <bsd.port.pre.mk>
 
 .if ${PYTHON_REL} < 3500
 RUN_DEPENDS+=	${PYTHON_PKGNAMEPREFIX}typing>=0:devel/py-typing@${FLAVOR}
 .endif
 
 .include <bsd.port.post.mk>
Index: head/www/nghttp2/Makefile
===================================================================
--- head/www/nghttp2/Makefile	(revision 465898)
+++ head/www/nghttp2/Makefile	(revision 465899)
@@ -1,85 +1,88 @@
 # Created by: Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
 # $FreeBSD$
 
 PORTNAME=	nghttp2
 PORTVERSION=	1.31.0
 DISTVERSIONPREFIX=	v
 CATEGORIES=	www net
 
 MAINTAINER=	sunpoet@FreeBSD.org
 COMMENT=	HTTP/2.0 C Library
 
 LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/COPYING
 
+BROKEN_SSL=	openssl-devel
+BROKEN_SSL_REASON_openssl-devel=	error: use of undeclared identifier 'SSL_get0_next_proto_negotiated'
+
 BUILD_DEPENDS=	libnghttp2>=${PORTVERSION}:www/libnghttp2
 LIB_DEPENDS=	libnghttp2.so:www/libnghttp2
 
 OPTIONS_DEFINE=	APP ASIO DOCS EXAMPLES HPACK
 OPTIONS_DEFAULT=APP HPACK
 OPTIONS_SUB=	yes
 APP_DESC=	Build h2load, nghttp, nghttpd and nghttpx
 
 CONFIGURE_ARGS=	--disable-python-bindings --with-jemalloc
 CONFIGURE_ENV=	OPENSSL_CFLAGS="-I${OPENSSLINC}" \
 		OPENSSL_LIBS="-L${OPENSSLLIB} -lcrypto -lssl"
 GNU_CONFIGURE=	yes
 INSTALL_TARGET=	install-strip
 USE_CXXSTD=	c++11
 USE_LDCONFIG=	yes
 USE_RC_SUBR=	nghttpx
 USES=		autoreconf compiler:c++11-lib gmake libtool localbase pathfix pkgconfig ssl
 
 PORTDATA=	fetch-ocsp-response
 PORTDOCS=	*
 PORTEXAMPLES=	*
 
 USE_GITHUB=	yes
 
 APP_BUILD_DEPENDS=	c-ares>=1.7.5:dns/c-ares \
 			libev>=4.11:devel/libev
 APP_CONFIGURE_ENABLE=	app
 APP_CONFIGURE_OFF=	--without-libxml2
 APP_LIB_DEPENDS=	libcares.so:dns/c-ares \
 			libev.so:devel/libev
 APP_USE=		GNOME=libxml2
 APP_USES=		gnome
 ASIO_BUILD_DEPENDS=	boost-libs>=1.54.0:devel/boost-libs
 ASIO_CONFIGURE_OFF=	--with-boost=no
 ASIO_CONFIGURE_ON=	--enable-asio-lib --with-boost-asio --with-boost-system --with-boost-thread
 ASIO_LIB_DEPENDS=	libboost_thread.so:devel/boost-libs
 EXAMPLES_CONFIGURE_ENABLE=	examples
 EXAMPLES_BUILD_DEPENDS=	libevent>=2.0.8:devel/libevent
 EXAMPLES_LIB_DEPENDS=	libevent_openssl.so:devel/libevent
 HPACK_BUILD_DEPENDS=	jansson>=2.5:devel/jansson
 HPACK_CONFIGURE_ENABLE=	hpack-tools
 HPACK_LIB_DEPENDS=	libjansson.so:devel/jansson
 
 .include <bsd.port.options.mk>
 
 post-patch:
 	@${REINPLACE_CMD} -e '/^SUBDIRS = / s| lib||' ${WRKSRC}/Makefile.am
 	@${REINPLACE_CMD} -e 's|$$[({]top_builddir[})]/lib/libnghttp2.la|-lnghttp2|' ${WRKSRC}/*/Makefile.am
 	@${REINPLACE_CMD} -e '1d' ${WRKSRC}/script/fetch-ocsp-response
 
 # lib/libnghttp2.* are not available until configure phase
 post-configure:
 	@${MKDIR} ${WRKSRC}/lib/.libs/
 	@${CP} ${LOCALBASE}/lib/libnghttp2.so* ${WRKSRC}/lib/.libs/
 	@cd ${WRKSRC}/lib/.libs/ && ${AR} x ${LOCALBASE}/lib/libnghttp2.a
 # Disable thread_local support for hosts without __cxa_thread_atexit()
 # See PR/192320 for details
 .if ${OPSYS} == FreeBSD && ((${OSVERSION} < 1003506) || (${OSVERSION} == 1100500))
 	@${REINPLACE_CMD} -e '/HAVE_THREAD_LOCAL/d' ${WRKSRC}/config.h
 .endif
 
 post-install:
 	${MKDIR} ${STAGEDIR}${PREFIX}/etc/nghttpx/
 	${INSTALL_DATA} ${FILESDIR}/nghttpx.conf.sample ${STAGEDIR}${PREFIX}/etc/nghttpx/nghttpx.conf.sample
 
 post-install-EXAMPLES-on:
 	${MKDIR} ${STAGEDIR}${EXAMPLESDIR}/
 	${INSTALL_DATA} ${WRKSRC}/examples/*.c* ${STAGEDIR}${EXAMPLESDIR}/
 	cd ${WRKSRC}/examples/ && ${INSTALL_PROGRAM} client deflate libevent-client libevent-server ${STAGEDIR}${EXAMPLESDIR}/
 
 .include <bsd.port.mk>