Move traceroute6 to the attic, fully merged into traceroute.
re-add our own aesctr implementation; ok djm@
Constrain bytes read/written to positive values.
ok miod@ tedu@
when a session fails due to a TLS error in a smtp+tls:// connection, try
plain before giving up

ok eric@
a bit more merge for traceroute6 stuff, and some consistency fixes;
help/ok florian
make compiling against OpenSSL optional (make OPENSSL=no);
reduces algorithms to curve25519, aes-ctr, chacha, ed25519;
allows us to explore further options; with and ok djm
Implement RSA privilege separation for OpenSMTPD, based on my previous
implementation for relayd(8).  The smtpd(8) pony processes (mta
client, smtp server) don't keep the private keys in memory but send
their private key operations as imsgs to the "lookup"/mta process.
It's worth mentioning that this prevents acidental private key leakage
as it could have been caused by "Heartbleed".

ok gilles@
Move nulling of variable next to where it's freed.  ok markus@
Don't attempt to append a nul quote char to the filename.  Should prevent
fatal'ing with "el_insertstr failed" when there's a single quote char
somewhere in the string.  bz#2238, ok markus@
For RSA private key privsep, only ever load the keys after forking the
separated process.  This improves the previous because we don't trust
the PEM and BIO routines to cleanup the keys correctly.

ok gilles@
tedu ~/.klogin

ok henning@ deraadt@
Get rid of the per-softc freelist of transfer descriptors and use a
per-driver pool(9) instead.
fcntl.h is still needed here.
minor++ because of AI_ADDRCONFIG

prodded by naddy, confirmed by Mark Kettenis
sync
i suck at math. b - 8 = 3, not 4. detected by Antoine Pitrou. thanks.
Enforce proper alignment of stack variables which may get accessed with
double-word load and store instructions. This used to work by chance, but
recent compiler changes no longer put us in the lucky situation.

tweaks kettenis@
New buffer API; the first installment of the conversion/replacement
of OpenSSH's internals to make them usable as a standalone library.

This includes a set of wrappers to make it compatible with the
existing buffer API so replacement can occur incrementally.

With and ok markus@

Thanks also to Ben Hawkes, David Tomaschik, Ivan Fratric, Matthew
Dempsky and Ron Bowes for a detailed review.
unit tests for new buffer API; including basic fuzz testing
tidy up SYNOPSIS, usage() and the options list; ok sthen