Update ip_divert.ko to depend on version 3 of ipfw.
MFi386 r272761.

Noted by:	Holger Hans Peter Freyther <holger at freyther.de>
Sponsored by:	The FreeBSD Foundation
MFC after:	10 days
Fix nits in previous commit:
1.  Remove initializer for badstack_sbuf_size; it gets set unconditionally.
2.  Remove meaningless comment.
3.  Group witness_count and its sysctl together.
4.  Fix spacing in for statements (space after for and within condition).
5.  Change *all* M_NOWAIT usages in witness_initialize() to M_WAITOK; not
    just those that were newly introduced -- the allocation is assumed to
    succeed for all allocations.
6.  Avoid using uint8_t as the base type in sizeof() expressions; Use the
    variable name (w_rmatrix) as much as possible.

Pointed out by: jhb@ (thanks!)
Give physical and virtual ports numbers some more meaning.
HBSD: added UFS_EXTATTR to HARDENEDBSD conf

Signed-off-by: Oliver Pinter <oliver.pntr@gmail.com>
HBSD: updated OP-ASLR

Signed-off-by: Oliver Pinter <oliver.pntr@gmail.com>
tcpd: complete function prototypes.

This clears up at least a build issues on mysql-server
ports. While here also replace some spaces with tabs
in our headers.

PR:		42336
MFC after:	2 weeks
tcpd.h: add prototype for hosts_ctl

According the hosts_access(3) man page the hosts_ctl() prototype
should be in tcpd.h. For now, follow other declarations and don't
add the arguments in the prototype.

Reference:
https://www.illumos.org/issues/4385

PR:		32808
MFC after:	2 weeks
Bump FreeBSD_version due to cleanup of tcp wrapper header.

Due to revisions r272949 and r272950 which should affect
positively some ports.
Do not set IN_ACCESS flag for read-only mounts.  The IN_ACCESS
survives remount in rw, also it is set for vnodes on rootfs before
noatime can be set or clock is adjusted.  All conditions result in
wrong atime for accessed vnodes.

Submitted by:	bde
MFC after:	1 week
Add locking and mark MPSAFE.
- Add a mutex to protect the softc.
- Use callout(9) instead of timeout(9).
- Consolidate duplicated detach routines into a bus-independent detach
  routine.
- Add an extra sleep lock flag (MSESC_READING) to prevent other readers
  from reading while the first reader is copying data out of sc_bytes[]
  via uiomove().
- Use bus_*() instead of bus_space_*().

Tested by:	nyan
ddb: space/tab fixes.

No functional change.

MFC after:	3 days
Rename s/network/netif/ and set netif_enable for namespace consistency.
Fix buffer overrun.

MFC after:	1 day
Add a new option, -P, to pkt-gen which reads a single packet from a stored
pcap file and transmits it instead of the default UDP packet.

Reviewed by:	luigi
MFC after:	2 weeks
pstat(8): Correct description of the SESS column in pstat -t.

MFC after:	1 week
Merge remote-tracking branch 'freebsd/master' into hardened/current/master
Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/chacha