pull in uvm/uvm_extern.h (before and) and instead pmap.h, and do not assume
that user.h's tentacles fetched it even earlier.
if you use sysctl, you need sysctl.h
obvious need for systm.h, which no longer comes in from something user.h includes
various fixes in experimental ldap backend and add support for mailaddr service.
RSA_NULL used to be a compile option allowing the RSA interfaces to be
compiled-in, with nonfunctional code, to be able to cope with the RSA
patent.

However, we don't use this option, and the RSA patent has expired more than 10
years ago, so just drop this piece.
need uvm/uvm_extern.h since no longer supplied  below user.h
remove unused dynamic_cmd_defns_empty structure.

ok miod@ deraadt@ guenther@
Remove RSA_memory_lock(). This undocumented function sort-of serializes your
RSA components to memory and clears them, but there is no unserializing
function, so its usefulness is close to zero.

A grep through the ports tree sources show that it is only present in ports
embedding their own openssl copy, and never used otherwise.

ok jsing@
sync
In the old days (not in this century), SSLeay 0.4.5 would create X.509 RSA
signatures using the wrong oid for the signature type. The signature
verification code has thus been modified to allow these signatures to be
accepted, with a printf to stderr to notify the user something was fishy.

Remove this chunk; these signatures will no longer get accepted.
ok deraadt@ guenther@ jsing@ tedu@
Remove typecasts on password_callback.

Rather than casting password_callback to the correct function pointer
signature at every call site, change it to match the signature instead.

ok miod@ deraadt@ tedu@
Be more strict in RSA_padding_check_X931(), and thus avoid a possible
memcpy() with a negative size.
ok tedu@
Kill more FIPS tentacles by removing the private_AES_set_{enc,dec}rypt_key()
internal interfaces, and promoting them to being the public
AES_set_{enc,dec}rypt_key() interfaces. In non-FIPS mode, these public
interfaces were directly calling the private ones.

ok guenther@ jsing@
bpf code surgery / shuffling / simplification.
the various bpf_mtap_* are very similiar, they differ in what (and to some
extent how) they prepend something, and what copy function they pass to
bpf_catchpacket.
use an internal _bpf_mtap as "backend" for bpf_mtap and friends.
extend bpf_mtap_hdr so that it covers all common cases:
if dlen is 0, nothing gets prepended.
copy function can be given, if NULL the default bpf_mcopy is used.
adjust the existing bpf_mtap_hdr users to pass a NULL ptr for the copy fn.
re-implement bpf_mtap_af as simple wrapper for bpf_mtap_hdr.
re-implement bpf_mtap_ether using bpf_map_hdr
re-implement bpf_mtap_pflog as trivial bpf_mtap_hdr wrapper
ok bluhm benno
Kill code commented since forever; no obj change.
OK benno@
We don't have IPV6_REACHCONF, no obj change after unifdef(1).
Further cleanup by hand lead to a obj change though.
OK benno@
We do have SIGINFO; no obj change.
OK benno@
We do have NI_NODEADDR_FLAG_ANYCAST, no obj change.
OK benno@
We do have SO_SNDBUF & SO_RCVBUF; no obj change.
OK benno@
We do have ICMP6_FILTER; no obj change.
OK benno@