To get a random seed, just call arc4random() instead of reading a
word from the (deprecated) /dev/arandom.  This also makes it work
in chroot environments.

ok deraadt@ afresh@
When vmcmd_map_readvn() maps in the page it reads into, it forces
it to be writable but otherwise uses the correct final permissions.
Ergo, it only needs to call uvm_map_protect() if the requested
permissions didn't include UVM_PROT_WRITE.

ok beck@
We now use arc4random() so PERL_RANDOM_DEVICE is no longer needed.

ok afresh@
Update to match recent changes
some basic formatting fixes;
for -a and -g, do not say "as per posix": it adds no value to the user, and
STANDARDS already notes these flags are compliant; it also stops us looking
redundant referring to older posix revs;

for -g, also note that output can safely be used by the shell;

while here, zap some unneeded Fl i missed in previous;
Grammar
Use .Er for errnos
zap double word;
Read MAXPHYS bytes at a time in the hibernate image read, instead of
PAGE_SIZE bytes. Completes the MAXPHYS optimizations in the read path.

with input from guenther@ who suggested a version that was a little easier
to understand. Tested on i386 and amd64.
Add missing NULL checks for calls to ssl_replace_hash(). This function
calls EVP_MD_CTX_create(), which will return NULL if it fails to allocate
memory.

ok miod@
no more gcc2.

ok miod@
Fix another two cases where the return value of ssl_replace_hash() is
unchecked.

In the case of tls1_change_cipher_state(), it is fairly pointless to use
ssl_replace_hash(), since it does not initialise the hash and there is
special handling required in the DTLS write case. Instead, just inline
the part of ssl_replace_hash() that is needed and only
ssl_clear_hash_ctx() the write hash in the non-DTLS case.

Also add a detailed comment explaining why there needs to be specialised
handling for DTLS write context and where the contexts are actually freed.

ok miod@
fsck should use the same values in checking as newfs does in creating
a filesystem. fs_nspf and its derivitives like fs_spc are DEV_BSIZE
values, not actual hardware disk sector values. Adjust initializations
accordingly.

Tweak header and man page comments to make the DEV_BSIZE'ness more
obvious for future spelunkers.

No-op for DEV_BSIZE (a.k.a. 512-byte) sector devices but should help
checking filesystems on, e.g., 4k-byte sector devices.

ok jmc@ on the man page tweaks.
flesh out STANDARDS;
document control characters which are extensions;
When you have functions that perform specific functions, use them.

EVP_CIPHER_CTX_free() does a NULL check, then calls EVP_CIPHER_CTX_cleanup()
and frees the memory. COMP_CTX_free() also had its own NULL check, so there
is no point in duplicating that here.

ok beck@
Make it substantially easier to identify protocol version requirements
by adding an enc_flags field to the ssl3_enc_method, specifying four flags
that are used with this field and providing macros for evaluating these
conditions. Currently the version requirements are identified by
continually checking the version number and other criteria.

This change also adds separate SSL3_ENC_METHOD data for TLS v1.1 and v1.2,
since they have different enc_flags from TLS v1.

Based on changes in OpenSSL head.

No objection from miod@
use calloc, from Benjamin Baier
repair KNF indent