Import Apache apr-1.4.8 to vendor staging area.
Integrate OpenSSL commit 9fe4603b8245425a4c46986ed000fca054231253:
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Feb 12 14:55:32 2013 +0000

    Check DTLS_BAD_VER for version number.

    The version check for DTLS1_VERSION was redundant as
    DTLS1_VERSION > TLS1_1_VERSION, however we do need to
    check for DTLS1_BAD_VER for compatibility.

    PR:2984
    (cherry picked from commit d980abb22e22661e98e5cee33d760ab0c7584ecc)

Approved by:	benl
Import vendor fixes:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).
Import OpenSSL 1.0.1f.

Approved by:	so (delphij), benl (silence)
Import OpenSSL 1.0.1g.

Approved by:	benl (maintainer)
Remove some unused variables.

Found with:	Clang Static Analyzer
MFC after:	2 weeks
Fix spelling mistake in comment.

Spotted during:	http://www.bsdcan.org/2014/schedule/events/484.en.html
Reserve IP_FLOWID, IP_FLOWTYPE, IP_RSSCPUID socket option IDs for
near-term future use.

These are intended to fetch the current flow id, flow hash type
(M_HASHTYPE_* from the sys/mbuf.h) and if RSS is enabled, the
RSS destined CPU ID for the receive path.
Read in SRCCONF early and consistently, if src.sys.mk exists, which is
should for all normal builds. Read /etc/make.conf earlier than before,
but consistently before SRCCONF and local.sys.mk.
Clear the data buffer length field when freeing a command structure so that
it doesn't leak through when the command structure is reused for a user
command without a data buffer.

PR:		amd64/189668
Tested by:	Pete Long <pete@nrth.org>
MFC after:	1 week
Bump .Dd, missed in r266206

Approved by:	hrs (mentor, implicit)
Correct documentation of the limit on how much memory can be mlock()ed

vm.max_wired is a system-wide limit, not per-process.  Reword the
section to make this more clear.

PR:		docs/189214
Submitted by:	Lawrence Chen (original text)
Approved by:	hrs (mentor)
Look for root certificates in /usr/local/etc/ssl before /etc/ssl.

MFH:	1 week
- Add support for dumping current resource usage for processes via a new -r
  flag to procstat.
- Add an -H flag to request information about threads rather than processes
  when dumping statistics.  Currently it is only used for -r to display
  resource usage for individual threads instead of the entire process.

Reviewed by:	kib (older version without -H)
MFC after:	1 month
Correct some minor nits in the per-thread signal format description such
as missing posessives and misordering of fields.

MFC after:	1 week
Update example portion of comment to coincide with r264840 changes.

MFC after:	3 days
Add the start of the ARM platform code. This is based on the PowerPC
platform code, it is expected these will be merged in the future when the
ARM code is more complete.

Until more boards can be tested only use this with the Raspberry Pi and
rrename the functions on the other SoCs.

Reviewed by:	ian@
Fix a comment s/initarm_/platform_/
o In pf_normalize_ip() we don't need mtag in
  !(PFRULE_FRAGCROP|PFRULE_FRAGDROP) case.
o In the (PFRULE_FRAGCROP|PFRULE_FRAGDROP) case we should allocate mtag
  if we don't find any.

Tested by:	Ian FREISLICH <ianf cloudseed.co.za>
Provide compatibility #define after r265408.

Suggested by:	truckman