Add the necessary infrastructure for the DIFFUSE control raw socket, which will
be used to communicate between userspace and the forthcoming DIFFUSE kernel
module.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
Integrate DIFFUSE related hooks and supporting infrastructure into the IPFW
kernel code. DIFFUSE is called both as part of packet processing (for per-flow
management, feature calculation and classification) and IPFW related
configuration (for handling DIFFUSE related rule configuration). The interface
between IPFW and DIFFUSE was intentionally kept hook based to ensure minimal
coupling between them. It should therefore be quite simple to integrate DIFFUSE
with other firewalls in future if desired.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
Add the core DIFFUSE kernel module code and supporting build infrastructure.
This module provides the kernel-side support for handling DIFFUSE's IPFW
configuration extensions, rule exporting, classifier/feature modules and
flow-related housekeeping.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A DIFFUSE feature kernel module which calculates per-flow minimum, mean, maximum
and standard deviation interarrival time statistics for use in classification
decisions.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A DIFFUSE feature kernel module which calculates per-flow, bidirectional
minimum, mean, maximum and standard deviation interarrival time statistics for
use in classification decisions.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A DIFFUSE feature kernel module which calculates per-flow forward/reverse packet
count and ratio statistics for use in classification decisions.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A DIFFUSE feature kernel module which calculates per-flow minimum, mean,
maximum, standard deviation and sum packet length statistics for use in
classification decisions.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A DIFFUSE feature kernel module which calculates per-flow, bidirectional
minimum, mean, maximum, standard deviation and sum packet length statistics for
use in classification decisions.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A DIFFUSE feature kernel module which calculates per-flow statistics for the
mean, absolute two packet difference and ratio of the packet payload lengths for
use in classification decisions. This module calculates features which have been
empirically found to be useful in identifying Skype flows.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A C4.5 decision tree classifier implementation in the form of a DIFFUSE
classifier kernel module. This type of classifier has been empirically shown to
perform the fastest and highest accuracy classifications compared to a set of
common classification algorithms.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
A fixed-point math based naive-bayes classifier implementation in the form of a
DIFFUSE classifier kernel module. It classifies using discretised feature
values, and has been empirically shown to perform classifications quickly and
with high accuracy.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
Fix a whitespace nit.

Sponsored by:	FreeBSD Foundation
Fix a whitespace nit.

Sponsored by:	FreeBSD Foundation
Fix another whitespace nit.

Sponsored by:	FreeBSD Foundation
s/di_conf/di_config in the files which had been accidentally missed.

Sponsored by:	FreeBSD Foundation
Return ENOMEM on malloc failure instead of success.

Sponsored by:	FreeBSD Foundation
Integrate DIFFUSE related functionality into the IPFW userspace control utility.
The code extends sbin/ipfw to manage, parse and output DIFFUSE specific
configuration exchanged with the DIFFUSE kernel module via the DIFFUSE control
raw socket. The UI extension for features and classifiers is kept modular to
minimise the overhead involved in adding new features and classifiers in future.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
Add the diffuse_exporter program, which can be used to receive export data from
the DIFFUSE kernel module via UDP and propagate it out to one or more action
nodes using UDP, TCP or SCTP. The exporter caches propagated rules for 5
minutes, and will forward the rules to action nodes again if a state request
packet is received.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
Add the diffuse_collector program, which can be used to receive export data from
the DIFFUSE kernel module via UDP or export data relayed from a diffuse_exporter
via SCTP, TCP or UDP. The collector instantiates firewall rules based on the
flow and classification data received from one or more classifier nodes.

Sponsored by:	FreeBSD Foundation
Reviewed by:	bz
We don't need bsd.own.mk for either utility and for some reason, including it
counteracts the inclusion of "NO_MAN=" in the Makefile. This causes the build to
break when bsd.prog.mk sets the default manpage to <utilname>.1 and attempts to
make the non-existant file.

Sponsored by:	FreeBSD Foundation