Integrate OpenSSL commit 9fe4603b8245425a4c46986ed000fca054231253:
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Feb 12 14:55:32 2013 +0000

    Check DTLS_BAD_VER for version number.

    The version check for DTLS1_VERSION was redundant as
    DTLS1_VERSION > TLS1_1_VERSION, however we do need to
    check for DTLS1_BAD_VER for compatibility.

    PR:2984
    (cherry picked from commit d980abb22e22661e98e5cee33d760ab0c7584ecc)

Approved by:	benl
Import vendor fixes:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).
Import OpenSSL 1.0.1f.

Approved by:	so (delphij), benl (silence)
Import OpenSSL 1.0.1g.

Approved by:	benl (maintainer)
Fix pf(4) to build with MAXCPU set to 256.  MAXCPU is actually a count,
not a maximum ID value (so it is a cap on mp_ncpus, not mp_maxid).
Minor style knit.
Update number of tests.

Suggested by:	jmmv
In the grab function, keep the bit 6 on in the IER, on XScale, using 0
turns the UART off, which is unfortunate if one want to use it as a console.
Correct KASSERT strings

Rows refer to height and cols to width.
Add rwlock to struct dadq.  A panic could occur when a large number of
addresses performed DAD at the same time.
In uart_bus_grab(), use the ier_mask instead of a custom hack for XScale.

Suggested by:	jmg
Change examples to have master skew above 0 to have ability to overwrite this
from the slave (for example, when master is failing on disk IO and could not be
logged into or execute cronjob).

Commented out examples changed too to simplify future merging.

Idea by:	kaa@zvuki.ru
Discussed with:	glebius
MFC after:	1 week
Fix unintended KBI change from r264905.  Add _fib versions of
ifa_ifwithnet() and ifa_ifwithdstaddr()  The legacy functions will call the
_fib() versions with RT_ALL_FIBS, preserving legacy behavior.

sys/net/if_var.h
sys/net/if.c
	Add legacy-compatible functions as described above.  Ensure legacy
	behavior when RT_ALL_FIBS is passed as fibnum.

sys/netinet/in_pcb.c
sys/netinet/ip_output.c
sys/netinet/ip_options.c
sys/net/route.c
sys/net/rtsock.c
sys/netinet6/nd6.c
	Call with _fib() functions if we must use a specific fib, or the
	legacy functions otherwise.

tests/sys/netinet/fibs_test.sh
tests/sys/netinet/udp_dontroute.c
	Improve the udp_dontroute test.  The bug that this test exercises is
	that ifa_ifwithnet() will return the wrong address, if multiple
	interfaces have addresses on the same subnet but with different
	fibs.  The previous version of the test only considered one possible
	failure mode: that ifa_ifwithnet_fib() might fail to find any
	suitable address at all.  The new version also checks whether
	ifa_ifwithnet_fib() finds the correct address by checking where the
	ARP request goes.

Reported by:	bz, hrs
Reviewed by:	hrs
MFC after:	1 week
X-MFC-with:	264905
Sponsored by:	Spectra Logic
Update size in vt_grow if we don't have to reallocate

vt_grow may be called with a new size that's larger than previous but
does not require reallocation - for example, when the number of columns
is the same and new number of rows is less than the history size.
Prior to this change we would fail to update vb_scr_size, and then hit
a KASSERT when trying to write to the newly visible rows.

Sponsored by:	The FreeBSD Foundation
Correct vt(4) border calculations on font switch

If a vt(4) font does not exactly fit the screen dimensions, the console
window is offset so that it is centered.  A rectangle is drawn at the
top, left, right, and bottom of the screen, to erase any leftovers that
are outside of the new usable console area.

If the x offset or y offset is 0 then the left border or top border
respectively is not drawn.  The right and bottom borders may be one
pixel larger than necessary due to rounding, and are always drawn.

Prior to this change a 0 offset would result in a panic when calling
vt_drawrect with an x or y coordinate of -1.

Sponsored by:	The FreeBSD Foundation
Create /var/unbound/conf.d for additional configuration files.
Ensure that it is used if present.

MFH:	3 weeks
Fix strcasecmp_l() and strncasecmp_l() POSIX 2008 compliance.

POSIX.1-2008 specifies that those two functions should be declared by
including <strings.h>, not <string.h> (the latter only has strcoll_l()
and strxfrm_l()):

http://pubs.opengroup.org/onlinepubs/9699919799/functions/strcasecmp.html

Obtained from:	DragonFlyBSD
Reviewed by:	theraven
MFC after:	2 weeks
Minor mdoc fix

Submitted by:	hrs
Approved by:	hrs (mentor, implicit)
Cleanup the RADXA kernel config file a bit and enable modules.
Add common kernel config file for Rockchip RK3188 systems by splitting
current RADXA config. Radxa Rock (RR) boards have few types such as
RR (full version), RR Lite and some variants of RR engineering samples.
Add kernel config and FDT file for RR Lite board.

Approved by:	stas (mentor)