Enable paranoid corruption checks in LevelDB >= 1.16
add GetRandBytes() as wrapper for RAND_bytes()

- add a small wrapper in util around RAND_bytes() and replace with
  GetRandBytes() in the code to log errors from calling RAND_bytes()
- remove OpenSSL header rand.h where no longer needed
move rand functions from util to new random.h/.cpp
make RandAddSeed() use OPENSSL_cleanse()

- removes the cstring include and is also used in RandAddSeedPerfmon()
Introduce whitelisted peers.

This adds a -whitelist option to specify subnet ranges from which peers
that connect are whitelisted. In addition, there is a -whitebind option
which works like -bind, except peers connecting to it are also
whitelisted (allowing a separate listen port for trusted connections).

Being whitelisted has two effects (for now):
* They are immune to DoS disconnection/banning.
* Transactions they broadcast (which are valid) are always relayed,
  even if they were already in the mempool. This means that a node
  can function as a gateway for a local network, and that rebroadcasts
  from the local network will work as expected.

Whitelisting replaces the magic exemption localhost had for DoS
disconnection (local addresses are still never banned, though), which
implied hidden service connects (from a localhost Tor node) were
incorrectly immune to DoS disconnection as well. This old
behaviour is removed for that reason, but can be restored using
-whitelist=127.0.0.1 or -whitelist=::1 can be specified. -whitebind
is safer to use in case non-trusted localhost connections are expected
(like hidden services).
Fix Error: No file at @loader_path/libboost_system-mt.dylib
Avoid a segfault on getblock if it can't read a block from disk.
Merge pull request #4190

502972f Fix Error: No file at @loader_path/libboost_system-mt.dylib (Federico Bond)
Clean up RPCs that are disabled in safe-mode.

This removes some inconsistencies in what worked and didn't work in
 safemode. Now only RPCs involved in getting balances or sending
 funds are disabled.

Previously you could mine but not submit blocks— but we may need more
 blocks to resolve a fork that triggered safe mode in the first place,
 and the non-submission was not reliable since some miners submit
 blocks via multiple means. There were also a number of random commands
 disabled that had nothing to do with the blockchain like verifymessage.

Thanks to earlz for pointing out that there were some moderately cheap
 ways to maliciously trigger safe mode, which brought attention to
 the fact that safemode wasn't used in a very intelligent way.
Merge pull request #4501

954d2e7 Avoid a segfault on getblock if it can't read a block from disk. (Ruben Dario Ponticelli)
getblocktemplate: longpolling support
Add test for getblocktemplate longpolling
Merge pull request #4507

b60be6b Clean up RPCs that are disabled in safe-mode. (Gregory Maxwell)
`getrawchangeaddress` should fail when keypool exhausted

An user on IRC reported an issue where `getrawchangeaddress`
keeps returning a single address when the keypool is exhausted.
In my opinion this is strange behaviour.

- Change CReserveKey to fail when running out of keys in the keypool.
- Make `getrawchangeaddress` return RPC_WALLET_KEYPOOL_RAN_OUT when
  unable to create an address.
- Add a Python RPC test for checking the keypool behaviour in combination
  with encrypted wallets.
Merge pull request #4347

6c37f7f `getrawchangeaddress` should fail when keypool exhausted (Wladimir J. van der Laan)
Do not flush the cache after every block outside of IBD
-datadir is now allowed in config files
In -? output: -keypool, -gen, -genproclimit depend on ENABLE_WALLET
Clarify that redeemScript is often optional
Merge pull request #4177

cd01a5e Enable paranoid corruption checks in LevelDB >= 1.16 (Pieter Wuille)