Fix rtsold(8) remote buffer overflow vulnerability. [SA-14:20]

Fix routed(8) remote denial of service vulnerability. [SA-14:21]

Fix memory leak in sandboxed namei lookup. [SA-14:22]

Fix OpenSSL multiple vulnerabilities. [SA-14:23]

Approved by:	so
Time zone data file update. [EN-14:10]

Approved by:	so
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=266209

Add a command line argument (-l) to end event collection after some
number of seconds.  The number of seconds may be a fraction.

Submitted by:	Julien Charbon <jcharbon@versign.com>
MFC after:	2 weeks
Relnotes:	yes

Conflicts:
	usr.sbin/pmcstat/pmcstat.c
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=266166

Extend the size of the function or symbol that can be annotated.

MFC after:	2 weeks
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=260796

Fix various places where we don't properly release a lock

PR:		185043
Submitted by:	Michael Bentkofsky
MFC after:	2 weeks
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=261242

Decrease lock contention within the TCP accept case by removing
the INP_INFO lock from tcp_usr_accept.  As the PR/patch states
this was following the advice already in the code.
See the PR below for a full disucssion of this change and its
measured effects.

PR:		183659
Submitted by:	Julian Charbon
Reviewed by:	jhb
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264321

Currently, the TCP slow timer can starve TCP input processing while it
walks the list of connections in TIME_WAIT closing expired connections
due to contention on the global TCP pcbinfo lock.

To remediate, introduce a new global lock to protect the list of
connections in TIME_WAIT.  Only acquire the TCP pcbinfo lock when
closing an expired connection.  This limits the window of time when
TCP input processing is stopped to the amount of time needed to close
a single connection.

Submitted by:	Julien Charbon <jcharbon@verisign.com>
Reviewed by:	rwatson, rrs, adrian
MFC after:	2 months
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264342

Don't leak the TCP pcbinfo lock if a time wait connection is closed
in between grabbing a reference on the connection structure and obtaining
the pcbinfo lock.

Reviewed by:	Julien Charbon
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264351

The tw_pcbrele() function does not need the global timewait lock.

Submitted by:	Julien Charbon
Suggested by:	glebius
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264356

Some whitespace and style fixes.

Submitted by:	bde
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=271119

In tcp_input(), don't acquire the pcbinfo global write lock for SYN
packets targeting a listening socket.  Permit to reduce TCP input
processing starvation in context of high SYN load (e.g. short-lived TCP
connections or SYN flood).

Submitted by:	Julien Charbon <jcharbon@verisign.com>
Reviewed by:	adrian, hiren, jhb, Mike Bentkofsky