Import OpenSSL-1.0.1.

  Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1:

      o TLS/DTLS heartbeat support.
      o SCTP support.
      o RFC 5705 TLS key material exporter.
      o RFC 5764 DTLS-SRTP negotiation.
      o Next Protocol Negotiation.
      o PSS signatures in certificates, requests and CRLs.
      o Support for password based recipient info for CMS.
      o Support TLS v1.2 and TLS v1.1.
      o Preliminary FIPS capability for unvalidated 2.0 FIPS module.
      o SRP support.

  Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h:

      o Fix for CMS/PKCS#7 MMA CVE-2012-0884
      o Corrected fix for CVE-2011-4619
      o Various DTLS fixes.
Merge branch 'vendor/OPENSSL'
Update files for OpenSSL-1.0.1 update.

This commit changes the order of sources in Makefiles to better conform
to what's in the OpenSSL distribution.  This should make it easier to
update the build system for future imports.
IPXrouted(8): Re-indent some code to make the outer for() better visible.
acpi_hp(4): Fix some previously overlooked issues.
kernel: Remove NULL checks after kmalloc() with M_WAITOK.
mps(4): Add a missing kfree().
pst(4): Add a missing contigfree().
Merge branch 'master' into gsocdrm_github
carp: Lock MPSAFE, step 10 of 11

Make carp_softc.sc_carpdev and ifnet.if_carp accessing and updating
lockless MPSAFE.

carp_softc.sc_carpdev:
- Reader of the sc_carpdev will cache the value in temporary variable
  and use the cached value instead of always accessing sc_carpdev,
  which may be inconsistent due to change of sc_carpdev.

ifnet.if_carp
- if_carp is a pointer to the carp_softc container list, while the list
  only contains pointer to carp_softc
- Reader of if_carp will cache the value in temporary variable and use
  the cached value instead of always accessing if_carp, which may be
  inconsistent due to if_carp updating.
- Updating of the if_carp is done in the following way:
    ocif = ifp->if_carp;
    ncif = cif_copy(ocif);
    cif_modify(ncif);
    ifp->if_carp = ncif;
    netmsg_service_sync();
    /* when we reach here all users of old if_carp (ocif) are done */
    cif_free(ocif)
carp: Lockless MPSAFE, step 11 of 11

Remove big giant carp token.
Merge remote-tracking branch 'origin/master'
Bring in the krb5 module in OpenSSL.

Even though we don't have Kerberos5 in base, we should still be
installing the krb5_asn.h header.
Merge branch 'vendor/OPENSSL'
acpi_hp.4: List the HP Compaq nc6320 as tested with the acpi_hp(4) driver.

The reported values looked sane.

Tested-by: Andrea Magliano <masterblaster@tiscali.it>
tcp/sack: Take FIN bit into consideration when setup report SACK block end

The invalid SACK option observed on the heavily segment reordering network
path (50% segments out of order) contains only one SACK block which tries
to cover the FIN segment but sets the right edge incorrectly, i.e. the right
edge is same as the left edge; mainly because the FIN bit is not counted.
tcp/sack: Cleanup the SACK related bits when return from tcp_input slow path

When the code path that could generate the invalid SACK block on out-of-order
FIN segment was walked through, it turned out that some SACK related bits
could be leftover from the previous input segment, e.g. SACKLEFT.

Since the observed invalid SACK option contains only one SACK block and the
block's right edge is same as its left edge, the code which can generate that
SACK block could be run only if SACKLEFT is turned on and reportblk's start
and end are same.
- If SACKLEFT is on then reportblk's start and end must not be same, so the
  SACKLEFT is leftover from the previous input segment.
- If KASSERTs about the clearance of the SACK bits are added immediately
  before returning from the tcp_input slow path, the KASSERTs could fail due
  to SACKLEFT are still on.

Obviously the SACK related bits are never intended to be inheritted from one
input segment to another input segment, so we just clear them before returning
from the tcp_input slow path.
tcp_input: Use acceptable_window_update when applicable

While I'm here, adjust comment (ACK is always on when we reach that code)
tcp_input: Partly revert 98cb2337e1000153d84b64a5e9aabbecda8e8dbf

Since all TCP operations are carried in its own netisr thread, the
workaround/comment is no longer needed/applied; change it into
assertion instead.

The "snd_nxt < snd_una" should (hopefully) have been fixed by:
1ff9b7d322dc5a26f7173aa8c38ecb79da80e419
Remove one more old OpenSSL file via 'make upgrade'.