Security fix for CVE-2010-0740

"In TLS connections, certain incorrectly formatted records can cause an OpenSSL
client or server to crash due to a read attempt at NULL."

http://openssl.org/news/secadv_20100324.txt

ok deraadt@ djm@ sthen@
The openssl command line tool treats the non-null terminated buffer
"mbuf" as a C string when using the pop3 s_client feature. This causes
a segmentation fault with malloc.conf option "J" set when BIO_printf()
runs off the end of the buffer. The following patch fixes PR 6282
from Matthew Haub (asked to submit upstream), ok djm
When running in pic mode we don't have enough general registers for all
the xcrypt inputs, hence the dance which is done to make this work.

The constraint for the key however was "mr" which is both from
memory and from a general register, it seems gcc3 went with the former
and gcc4 went with the later in the pic case, so change the
constraint for the key to just "m" which gives us more efficient
code that both gcc3 and gcc4 are happy with.

ok kettenis@
Add the extendedKeyUsage flags serverAuth and clientAuth.  Newer Windows
version require these flags to accept the X.509 certificates from the
gateway or client;  I just add both flags to make it work in both cases
and verified it with win7, for example when authenticating against iked.

go ahead beck@
VIA xcrypt for amd64, simpler version of a diff from deraadt
with suggestions from miod.

The codepath doesn't seem to be called yet, this will be
investigated later.

looks good miod@, ok deraadt@
AES-NI engine support for OpenSSL.
This is code mostly picked up from upstream OpenSSL, or to be more exact
a diff from David Woodhouse <dwmw2 at infradead dot org>.

Remember to make includes before doing a build!

no objections from djm@
OK deraadt@, reyk@ (AES is about 4.25x faster on his x201 now)
This commit was manufactured by cvs2git to create branch 'OPENSSL'.

Cherrypick from master 2010-07-01 17:44:20 UTC thib 'AES-NI engine support for OpenSSL.':
    src/lib/libssl/src/crypto/aes/asm/aesni-x86_64.pl
oops. Missed this from my aes-ni commit.
Oracle has re-licensed sunrpc under a three-clause BSD license.
Update our sources appropriately.  OK deraadt@ jsg@
Use mandoc instead of groff to build PostScript manuals; note that
these are not built by default, but only built when MANPS is set.
kristaps@ and jmc@ agree with the idea,
and the patch doesn't bother deraadt@ at all
This commit was generated by cvs2git to track changes on a CVS vendor
branch.
import OpenSSL-1.0.0a
This commit was generated by cvs2git to track changes on a CVS vendor
branch.
import OpenSSL-1.0.0a
resolve conflicts, fix local changes
add missing; yay for cvs!
update supporting files, crank library majors
fix -Wall due to API change
percolate up errors from perl asm scripts, correctly enable SHA-256 asm on
amd64
DES_LONG should be u_int on all platforms, it was spuriously
u_long on i386. suggested by deraadt@ and kettenis@