Implement a fix from OpenBSD 5.6-stable:

backport 1.100: support for $2b$ hashes. ok deraadt

ok pedro@
Implement a fix from OpenBSD 5.6-stable:

backport 1.34. Don't crash without HTTP version.

ok pedro@
Implement a fix from OpenBSD 5.6-stable:

backport fix to avoid null deref with invalid hostnames

ok pedro@
Implement a fix from OpenBSD 5.6-stable:

Check the header fields of GRE and MPPE packets strictly.

ok pedro@
Implement a fix from OpenBSD 5.6-stable:

backport the correct fix for overlapping memcpy which caused corrupt
MACs

ok pedro@
Implement a fix from OpenBSD 5.6-stable:

httpd was developed very rapidly in the weeks before 5.6 release,
and it has a few flaws.  It would be nice to get these flaws fully
remediated before the next release, and that requires the community
to want to use it.
Therefore here is a "jumbo" patch that brings in the most important
fixes.

committing on behalf of reyk@
Implement a fix from OpenBSD 5.6-stable:

Backport fix for CVE-2014-8602 - Limit the number of fetches performed
for a DNS query, to avoid the resolver being tricked into following an
endless series of delegations, consuming a lot of resources.
Many DNS
recursive resolvers are affected by this bug (including BIND,
Unbound,
and PowerDNS recursor). More details at:

http://www.unbound.net/pipermail/unbound-users/2014-December/003662.html

Diff from florian@, tested by myself.

ok pedro@
Fix git branch in kernel bootup msg for branches with '/'.

Branches that use '/', like our stable branches, were not
shown correctly in the bootup message.  This is caused by
cut cutting at '/' and only using the 3rd field.

To fix this, let cut show every field after the 2nd.

ok natano@
fix intermittent iked crashes

in ca_reload(), set iovcnt according to the number of iov entries
filled. there are four cases we need to be concerned with:

1. certificate revocation lists (CRLs) have been configured

in this case, we load the CRLs and issue one IMSG_CERTREQ message to the
ikev2 process with the list of revoked certificates. (iovcnt = 2)

2. valid certificates have been configured

in this case, we load the certificates and issue one IMSG_CERTREQ
message to the ikev2 process with the list of valid certificates.
(iovcnt = 1)

3. CRLs *and* valid certificates have been configured

in this case, we load the CRLs and issue one initial IMSG_CERTREQ
message to the ikev2 process with the list of revoked certificates, i.e
we do step 1. however, we also do step 2, with a twist: we send a second
IMSG_CERTREQ message to the ikev2 process with a list of revoked
certificates *and* a list of valid certificates. ikev2 discards
previously received IMSG_CERTREQ messages once it receives a new one, so
this works.  (iovcnt = 2 for both messages)

4. no CRLs and no valid certificates have been configured

in this case, we send an empty IMSG_CERTREQ message to the ikev2
process. (iovcnt = 1)

ok patrick@
fix i2d_X509_NAME() error checking

use int instead of size_t to store the return of i2d_X509_NAME(), fixing
a < 0 check for error.

ok patrick@
correctly set nread when parsing floats

fixes a botch up by yours truly that broke scanf() with %n after %f in
6659d2ba. i blame immigrants on benefits.

ok natano@ marco@ haesbaert@