Merge of r4968, r4969, r4977, r4980, r4981, r4990: geo fixes.

*) Geo: improved ngx_http_geo_block() code readability.

*) Geo: fixed the "ranges" without ranges case.  The following
   configuration returned an empty value for $geo:

       geo $geo {
           ranges;
           default default;
       }

*) Fixed return type of internal function that allocates radix tree nodes.

*) There's no need to normalize address returned by ngx_ptocidr().

*) Geo: ensure that default entry is always present.  If 0.0.0.0/32 entry
   was present and there was no explicit "default", we failed to add an
   empty string as a default value.

*) Trailing whitespace fix.
Merge of r4993, r4994, r4997, r5000: geo ipv6 support.

*) Geo: IPv6 support.  The "ranges" mode is still limited to IPv4 only.

*) Geo: properly initialize ngx_cidr_t when dealing with "default".

*) Geo: made "default" affect both IPv4 and IPv6 when using prefixes.
   Previously, "default" was equivalent to specifying 0.0.0.0/0, now
   it's equivalent to specifying both 0.0.0.0/0 and ::/0 (if support
   for IPv6 is enabled) with the same value.

*) Geo: improved code readability.
Merge of r4974: avoid sending "100 Continue" on 413. 

Avoid sending "100 Continue" on 413 Request Entity Too Large.

Patch by Igor Sysoev.
Merge of r4983: crypt_r() error handling fixed.

The crypt_r() function returns NULL on errors, check it explicitly instead
of assuming errno will remain 0 if there are no errors (per POSIX, the
setting of errno after a successful call to a function is unspecified
unless the description of that function specifies that errno shall not
be modified).

Additionally, dropped unneeded ngx_set_errno(0) and fixed error handling
of memory allocation after normal crypt(), which was inapropriate and
resulted in null pointer dereference on allocation failures.
Merge of r4976: let add_header affect 201 responses (ticket #125).
Merge of r4979, r4982: image filter configuration inheritance.

*) Image filter: configuration inheritance fixes.

   The image_filter_jpeg_quality, image_filter_sharpen and
   "image_filter rotate" were inherited incorrectly if a directive
   with variables was defined, and then redefined to a literal value,
   i.e. in configurations like

       image_filter_jpeg_quality $arg_q;

       location / {
           image_filter_jpeg_quality 50;
       }

   Patch by Ian Babrou, with minor changes.

*) Image filter: fixed image_filter rotate inheritance.

   Configurations like

       location /i/ {
           image_filter resize 200 200;
           image_filter rotate 180;

           location /i/foo/ {
               image_filter resize 200 200;
           }
      }

   resulted in rotation incorrectly applied in the location /i/foo,
   without any way to clear it.  Fix is to handle conf->angle/conf->acv
   consistently with other filter variables and do not try to inherit
   them if there are transformations defined for current location.
Merge of r4985, r4986, r4987, r4988, r4989, r5002: access_log gzip.

*) Access log: fixed redundant buffer reallocation.  Previously a new
   buffer was allocated for every "access_log" directive with the same
   file path and "buffer=" parameters, while only one buffer per file
   is used.

*) Reopening log files code moved to a separate function.  The code
   refactored in a way to call custom handler that can do appropriate
   cleanup work (if any), like flushing buffers, finishing compress
   streams, finalizing connections to log daemon, etc..

*) Access log: the "flush" parameter of the "access_log" directive.

*) Configure: added the NGX_ZLIB define.  This was introduced for
   conditional compilation of the code that requires the zlib library.

*) Access log: the "gzip" parameter of the "access_log" directive.
   Note: this requires zlib version 1.2.0.4 or above to work.

*) The data pointer in ngx_open_file_t objects must be initialized.
   Uninitialized pointer may result in arbitrary segfaults if access_log
   is used without buffer and without variables in file path.
   Patch by Tatsuhiko Kubo (ticket #268).
Merge of r4991: fixed proxied HEAD requests with gzip enabled.

Fixed HEAD requests handling when proxying is used (ticket #261).
Merge of r4992: off-by-one with 32/64 upstream backup servers.

Fixed off-by-one during upstream state resetting when switching to
backup servers if there were exactly 32 (64 on 64-bit platforms)
backup servers configured.

Based on patch by Thomas Chen (ticket #257).
Merge of r4999, r5003: detect duplicate "events" and "keepalive".

*) Upstream keepalive: detect duplicate "keepalive" directive.  A
   failure to detect duplicate "keepalive" directive resulted in
   stack exhaustion.

*) Events: added check for duplicate "events" directive.
Merge of r5001: year 2013.
Merge of r5004, r5019-r5025: ssl fixes.

*) SSL: speedup loading of configs with many ssl servers.  The patch
   saves one EC_KEY_generate_key() call per server{} block by informing
   OpenSSL about SSL_OP_SINGLE_ECDH_USE we are going to use before
   the SSL_CTX_set_tmp_ecdh() call.

   For a configuration file with 10k simple server{} blocks with SSL
   enabled this change reduces startup time from 18s to 5s on a slow
   test box here.

*) SSL: removed conditions that always hold true.

*) SSL: resetting of flush flag after the data was written.  There is
   no need to flush next chunk of data if it does not contain a buffer
   with the flush or last_buf flags set.

*) SSL: preservation of flush flag for buffered data.  Previously,
   if SSL buffer was not sent we lost information that the data
   must be flushed.

*) SSL: calculation of buffer size moved closer to its usage.
   No functional changes.

*) SSL: avoid calling SSL_write() with zero data size.  According to
   documentation, calling SSL_write() with num=0 bytes to be sent
   results in undefined behavior.

   We don't currently call ngx_ssl_send_chain() with empty chain and
   buffer.  This check handles the case of a chain with total data size
   that is a multiple of NGX_SSL_BUFSIZE, and with the special buffer
   at the end.

   In practice such cases resulted in premature connection close and
   critical error "SSL_write() failed (SSL:)" in the error log.

*) SSL: take into account data in the buffer while limiting output.
   In some rare cases this can result in a more smooth sending rate.

*) SSL: fixed ngx_ssl_handshake() with level-triggered event methods.
   Missing calls to ngx_handle_write_event() and ngx_handle_read_event()
   resulted in a CPU hog during SSL handshake if an level-triggered event
   method (e.g. select) was used.
Merge of r5012: configure: removed redundant variable assignment.
Merge of r5013: proxy: fixed proxy_method to always add space.

Before the patch if proxy_method was specified at http{} level the code
to add trailing space wasn't executed, resulting in incorrect requests
to upstream.
Merge of r5014, r5015, r5016, r5030: geoip ipv6 support.

*) Configure: fixed style of include directories.

*) Configure: fixed GeoIP library detection.

*) GeoIP: IPv6 support.  When using IPv6 databases, IPv4 addresses are
   looked up as IPv4-mapped IPv6 addresses.  Mostly based on a patch
   by Gregor Kališnik (ticket #250).

*) GeoIP: removed pseudo-support of "proxy" and "netspeed" databases.
Merge of r5017: fixed null dereference with resolver and poll.

Events: fixed null pointer dereference with resolver and poll.

A POLLERR signalled by poll() without POLLIN/POLLOUT, as seen on
Linux, would generate both read and write events, but there's no
write event handler for resolver events.  A fix is to only call
event handler of an active event.
Merge of r5018: secure link: fixed configuration inheritance.

The "secure_link_secret" directive was always inherited from the outer
configuration level even when "secure_link" and "secure_link_md5" were
specified on the inner level.
Merge of r5027, r5028, r5029: fastcgi_keep_conn fixes.

*) FastCGI: fixed wrong connection close with fastcgi_keep_conn.

   With fastcgi_keep_conn it was possible that connection was closed after
   FCGI_STDERR record with zero padding and without any further data read
   yet.  This happended as f->state was set to ngx_http_fastcgi_st_padding
   and then "break" happened, resulting in p->length being set to
   f->padding, i.e. 0 (which in turn resulted in connection close).

   Fix is to make sure we continue the loop after f->state is set.

*) FastCGI: unconditional state transitions.  Checks for f->padding
   before state transitions make code hard to follow, remove them and
   make sure we always do another loop iteration after f->state is
   set to ngx_http_fastcgi_st_padding.

*) FastCGI: proper handling of split fastcgi end request.  If fastcgi
   end request record was split between several network packets, with
   fastcgi_keep_conn it was possible that connection was saved in
   incorrect state (e.g. with padding bytes not yet read).
Merge of r5005, r5031, r5066: PCRE and OpenSSL for win32 builds.