New version of jng (9.0)
Changes for jng 2.0 -> 9.0 include:
+ Use ng_bridge(4) uplink hooks on ng_ether(4) lower so the host
mapping table stays small (first hook is uplink; unknown unicast
goes only to uplink)
+ Add `jng pin [-h] {-a | NAME ...}' to plant eiface MACs with
NGM_BRIDGE_MOVE_HOST and raise maxStaleness so they do not expire
+ Remove experimental NG_TYPE=iface / ng_tcpmss(4); ng_iface(4)
cannot work with ng_bridge(4)
+ Add -v
+ SPDX-License-Identifier: BSD-2-Clause; bump copyright to 2026
See D58902 for the ng_bridge(4) data-path MOVE_HOST fix.
MFC after: 1 week
Reviewed by: kfv, jlduran
Differential Revision: https://reviews.freebsd.org/D58903
graphics/jogamp-jogl: modernize patches
Ran: make patch; rm files/*; make makepatch.
This renames a patch and splits patch-freebsd to 3 separate patch files.
Manually checked that the patches are equal.
Approved by: no maintainer
mail/postfix-current: Fix MONGO flavor
Fix MONGO flavor by depending on libbson and mongo-c-driver contained
in quarterly branch.
This is a direct commit to 2026Q3
mail/postfix: Fix MONGO flavor
Fix MONGO flavor by depending on libbson and mongo-c-driver contained
in quarterly branch.
Also fix pkg-plist for MONGO flavor.
This is a direct commit to 2026Q3
stand: set st_dev/st_ino in the loader's ZFS stat for veriexec
The loader's ZFS implementation never set st_dev or st_ino in
zfs_dnode_stat(). With an uninitialized struct stat, veriexec's device
comparison in lib/libsecureboot/veopen.c read stack garbage and skipped
the matching manifest entry, failing with a spurious "no entry" on ZFS
root under UEFI Secure Boot.
Rather than zeroing the device (which would break veriexec's ability to
tell apart the same path on different datasets), populate st_dev and
st_ino with the same intrinsic identifiers the kernel uses:
- st_dev = the dataset's ds_fsid_guid (as the kernel does via
dmu_objset_fsid_guid()/dsl_dataset_fsid_guid()), already read in
zfs_mount_dataset() and now propagated through struct zfsmount.
- st_ino = the object number resolved in zfs_lookup(), propagated
through struct file (the loader's equivalent of the kernel's z_id).
dev_t and ino_t are 64-bit on FreeBSD, so both are assigned directly
[14 lines not shown]
math/octave-forge-octave_ffmpeg_free: Update to 2.0.0.
- Build will work when ffmpeg updates to version 9.
PR: 297384
Reported by: Daniel Engberg <diizzy at FreeBSD.org>
<If someone else reported the issue>
Mk/Scripts/qa.sh: Filter baselibs() input to improve performance
After the baselibs() fix in f0f863b1a2d6, readelf is executed for each
result from find(1). There are two concerns with this fix:
1. -exec readelf -d {} \; drops the filename from the error messages
readelf prints "File: <name>" headers only when it is supplied with two
or more files, and baselibs() uses ${file} from those headers. So, the
two err() messages in baselibs() will break.
This is moot for now, though, because nothing in the ports tree can
trigger these errors. Those base soname versions for libarchive and
libedit are long gone.
2. Performance hit with one readelf execution per staged file
The costs are high for ports that stage many files. For
emulators/linux_base-rl9, the find returns over 30k hits that the while
[12 lines not shown]
ipfilter: Fix checksum update for NAT_DIVERTOUT
When taking a snapshot of the before ip_len (s1) for comparison with the
after-translated ip_len (s2), we must convert it from network to host
byte order before we can use it. Add the missing ntohs() call.
PR: 296944
MFC after: 3 days
security/wpa_supplicant*: Fix EAPOL_TEST build for non-standard SSL_DEFAULT
The post-build target does not have the same environment variables setup
as the do-build target. This results in the eapol_test binary getting
compiled against the headers of the TLS library specified in
SSL_DEFAULT, but getting linked against the TLS library from the base
system regardless of SSL_DEFAULT, causing build failures when
SSL_DEFAULT is set to a different TLS library/version than the on from
the base system.
Fix this by not using the post-build target to build the eapol_test
binary, but instead conditionally add the eapol_test target to
TARGET_ALL if the EAPOL_TEST option is enabled for the port.
Signed-off-by: Pascal Ernster <git at hardfalcon.net>
