MFC: stat() after chdir("..") to ensure we end up in a known location.
MFC: Protect the remaining instance of chdir() using fts_safe_changedir().
MFC: Unbreak paranoid host checking
Don't allow STROUT() to use a negative string length.
Use fn_print() and fn_printn() to print strings from the packet.

Approved by:	kris
MFS: don't share shared signal handlers accross the exec
MFS: ipfw `me' fix.
Add PRNG security patch to prevent guessing of internal state.

Obtained from:  OpenSSL
MFC: Prevent remotely exploitable buffer overflow in telnetd
MFC: Correct semantics of output_data*() and netflush() to ensure
deterministic operation
Preliminary attempt to codify the changes made to RELENG_4_3 tree.
There appear to have been 9 commits to the tree after 4.3 release was
finalized.  In the future, I plan on committing here shortly after
changes I notice and also after advisories are released.

Approved in concept by: kris
Slightly reviewed by: rwatson
Note that p7 and FreeBSD-SA-01:51 are related.

Submitted b: kris
MFS

src/sys/netinet/ip_input.c      rev 1.130.2.22
src/sys/netinet6/frag6.c        rev 1.2.2.4
src/sys/netinet6/in6_proto.c    rev 1.6.2.4

  Prevent denial of service using bogus fragmented IPv4 packets.

  A attacker sending a lot of bogus fragmented packets to the target
  (with different IPv4 identification field - ip_id), may be able
  to put the target machine into mbuf starvation state.

  By setting a upper limit on the number of reassembly queues we
  prevent this situation.

  This upper limit is controlled by the new sysctl
  net.inet.ip.maxfragpackets which defaults to nmbclusters/4

  If you want old behaviour (no upper limit) set this sysctl
  to a negative value.

  If you don't want to accept any fragments (not recommended)
  set the sysctl to 0 (zero)

  Change the default value of net.inet6.ip6.maxfragpackets from
  200 to nmbclusters/4 to match the IPv4 case.

Approved by:	security-officer (kris)
Obtained from:  NetBSD (partially)
MFC: rev 1.101 into RELENG_4_3 branch. (filehandle checking)

Approved by:  kris
MFS of procfs "kmem" cleanup.  With the advent of an entirely
sysctl-driven "ps" (and friends), special-casing of kmem gid in the
procfs authorization is no longer needed.  Clean up this morally
ambiguous code.  This MFC is from fs/procfs, as procfs has been
repo-copied.  Unlike -CURRENT, linprocfs required modification as
in -STABLE, it has direct knowledge of the inter-process debugging
authorization policy.  In -CURRENT, this is abstracted behind
p_cansignal().

procfs.h: 1.36, 1.37
procfs_mem.c: 1.53
procfs_subr.c: 1.35
procfs_vnops.c: 1.100, 1.101

Reviewed by:	jedgar, tmm
Add p10 (ip fragment attack), p11 (nfs filehandle issue) and p12 (procfs)
changes to the 4.3 branch.
Append -p12.  This is lexically larger than before without getting
into the issues of -FISH vs -FOUL.  I'll take care of updating this
file when I'm updating UPDATING, but hold no locks like I do on
UPDATING.

Approved by: kris
Fix typo in current patchlevel pointed out by many people
Add ipfw me advisory
MFC: 1.10: Close the "IRC DCC" security breach.

Approved by:	kris
Fix command line processing security problem found by SecurityFocus.
This is already fixed in the HEAD and RELENG_4 by virtue of the
sendmail 8.11.6 import.  Further, it doesn't need to be put in RELENG_3
or earlier as the bug only affects sendmail 8.11.0-8.11.5, none of which
were in anything before RELENG_4.

Approved by:	kris