Amend previous commit to unbreak TLS cert validation when using a proxy.
ok miod@
If we have to match against a wildcard in a cert, verify that it contains
at least a domain label before the tld, as in *.example.org.
Suggested by Richard Moore (rich@kde)
ok tedu@
When verifying whether an IP address is in the commonName of a
certificate, do not perform wildcard matching.
Suggested by Richard Moore (rich@kde)
ok tedu@
In case of invalid syntax like "chmod -Pr -w tf" (trailing mode letter
in a group of option letters), do not silently ignore the syntax error
and do something undefined, but instead error out properly.
Found because miod@ said "read the code" (not to me, though).

ok doug@
As libevent provides safe signal callbacks instead of signal handlers,
the sigprocmask(2) protection is not necessary and can be removed.
OK nicm@ deraadt@
Make amd64 pmap more efficient on multi-processor

With the current implementation, when accessing an inactive pmap, its
ptes are mapped in the APTE range. This has the problem that the APTE
range is mapped on all CPUs and changes to the APTE must therefore be
followed by a remote TLB flush on all CPUs. This is very inefficient
because the costs increase quadratically with the number of CPUs.

Therefore, the code is changed to remove the APTE mechanism completely
and instead switch the pmap locally. A remote TLB flush is then only
done if the pmap is in use on the remote CPU. In the common case, this
will replace one TLB flush on all CPUs with two local TLB flushes.

An additional optimization is done in cases where only a single PTE of
an inactive pmap is accessed: The requested PTE is found by walking the
page tables manually via the direct mapping. This makes some more TLB
flushes unnecessary.

Furthermore, some code is reordered so that the TLB-shootdown-IPIs are
sent first, then more local processing takes place, and only afterwards
the CPU waits for the remote TLB-shootdowns to finish.

This diff is based on a patch for i386 by Artur Grabowski <art blahonga org>
from 2008. Some additional bits were taken from a different patch by
Artur from 2005.

Tested by many. OK mlarkin@
Remove the #ifdef HAVE_SIGACTION from libevent.  The struct
evsignal_info does not change, so no library crank.
OK nicm@ deraadt@
When reading time intervals, start with a long long and convert from there.
Similarly, print them by casting to long long and using %lld.

ok otto@
Rare to find a gem this amazing missed by tedu.
EC_KEY_set_group() does an EC_GROUP_dup() of its argument, so we don't
need to do it in ec_copy_parameters() prior to invoking EC_KEY_set_group().
ok doug@ jsing@
Use strdup() instead of malloc() + memcpy().
ok doug@ jsing@
Correct the l1 pte permission bits for armv7.  Problem pointed out
by Patrick Wildt who made a similiar change in Bitrig.

ok miod@ rapha@
Do not protect the SIOCSIFADDR call by splnet().  Drivers already
raise it inside their ioctl handler (except for carp(4), what else?).

In general, global structures manipulated in the softnet codepath only
require a splsoftnet() protection when they are modified in process
(ioctl) context.

Also put some IPL_SOFNET asserts in functions accessing global structures.

Previous version diff ok mikeb@, with inputs from and ok bluhm@
Since the list of mpe(4) interfaces is only accessed in process context,
it does not need to be protected by splnet().

Rafael Zalamena agrees, no objection from the MPLS gang.
Use L1_S_V7_AP instead of L1_S_AP for the v7 case
otherwise the high bit of AP will end up in TEX.
when running bpf on an outgoing vlan interface that doesnt have a
parent that doesnt offload the tag insertion, we need to chop the
vlan subheader out before the filter is run, not after.

this moves the mbuf surgery out from the bpf layer into the vlan
layer.

ok henning@ jmatthew@
zap duplicated line; Theo Buehler
If a tbl(7) layout contains unknown font modifiers, fall back to the
default font rather than failing the whole table.
Needed by some pages in books/man-pages-posix.
Written on the plane back from EuroBSDCon in Sofia.
Switch HTML output to polyglot HTML5; have only one single -Thml mode.
Replace hard-coded widths and alignments with a minimal embedded stylesheet.
Do not use <p> because it cannot appear inside block macros.
Remove the "summary" attribute because it is not HTML5.

Written by kristaps@ some months ago, finished during EuroBSDCon.
be a bit more patient, 1s is sometimes insufficient for legitimate queries