Document the SSL configuration for httpd (partly based on relayd.conf(5)).
Limit the body size in client requests (eg. POST data) to 1M by default;
add a configuration option to change the limit.

ok florian@
Use memset(buf instead of memset(&buf.

Pointed out by deraadt@
Always zero-out the fcgi record header for STDIN data.

OK florian@
Support NOTE_EOF for kqueue EVFILT_READ filters on NFS files.

committing for jsg@,  ok reyk@ tedu@ guenther@
Prevent a possible use after free by mimicing the s3_srvr.c fixes contributed by
Adam Langley close to three years ago, which were commited in
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=e7928282d0148af5f28fa3437a625a2006af0214

ok jsing@
Change grammar to remove a shift/reduce conflict that was introduced
with the ssl options.
"listen on $ip port 443 ssl" turns into "listen on $ip ssl port 443".

ok florian@
If the very first fcgi STDOUT record has length 0 the cgi script
didn't send anything back. This is an internal server error.
OK reyk@
Write STDERR from the CGI to the web server error log as intended.

OK florian@
Mention how httpd responds to SIGHUP and SIGUSR1.

Description from reyk@
merge fix for CVE-2014-3509 -- basically a missing s->hit check; ok guenther
merge CVE-2014-3510; Fix DTLS anonymous EC(DH) denial of service
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=17160033765480453be0a41335fa6b833691c049
ok bcook
Fix CVE-2014-3511; TLS downgrade, verbatim diff
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=280b1f1ad12131defcd986676a8fc9717aaa601b
ok guenther miod
shorten signal text a bit
Opportunistically try to parse "Status: $code" in the very first
response from the fcgi daemon and use that code as HTTP response
code. If it doesn't work out fall back to code 200.
This might fix naddy@'s issue with redirects in cvsweb.
To be revisited after unlock.
Discussed with & grudgingly OK reyk@
Don't try to ouput FCGI_STDERR into error.log if there is no data.
Problem noticed by naddy@, OK reyk@
Fix and simplify the description of httpd(8)'s signal handling.  httpd
does not re-executed itself on SIGHUP, it simply reload the
configuration and sends it to its child processes.

ok deraadt@
Bump example pubkey filenames to /etc/signify/openbsd-56-base.pub for
5.6.

ok deraadt@
When you expect a function to return a particular value, don't put a comment
saying that you expect it to return that value and compare it against zero
because it is supposedly faster, for this leads to bugs (especially given the
high rate of sloppy cut'n'paste within ssl3 and dtls1 routines in this
library).

Instead, compare for the exact value it ought to return upon success.

ok deraadt@
Oops, revert changes commited by mistake. The previous commit was supposed
to only apply to s23_srvr.c.