Integrate OpenSSL commit 9fe4603b8245425a4c46986ed000fca054231253:
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Tue Feb 12 14:55:32 2013 +0000

    Check DTLS_BAD_VER for version number.

    The version check for DTLS1_VERSION was redundant as
    DTLS1_VERSION > TLS1_1_VERSION, however we do need to
    check for DTLS1_BAD_VER for compatibility.

    PR:2984
    (cherry picked from commit d980abb22e22661e98e5cee33d760ab0c7584ecc)

Approved by:	benl
Import vendor fixes:

197e0ea	Fix for TLS record tampering bug.  (CVE-2013-4353).
3462896	For DTLS we might need to retransmit messages from the
	previous session so keep a copy of write context in DTLS
	retransmission buffers instead of replacing it after
	sending CCS.  (CVE-2013-6450).
ca98926 When deciding whether to use TLS 1.2 PRF and record hash
	algorithms use the version number in the corresponding
	SSL_METHOD structure instead of the SSL structure.  The
	SSL structure version is sometimes inaccurate.
	Note: OpenSSL 1.0.2 and later effectively do this already.
	(CVE-2013-6449).
Import OpenSSL 1.0.1f.

Approved by:	so (delphij), benl (silence)
Import OpenSSL 1.0.1g.

Approved by:	benl (maintainer)
(split) Remove r264317 by accident.

Spotted by:	Kuan-Chung Chiu
Add missing libexec/bsdconfig subdirectories
Update default callchain depth to 16 to match kernel

MFC after:	1 week
Bump FreeBSD_version due to changed header for strcasecmp(3) family.

In r266865, strcasecmp_l() and strncasecmp_l() were moved from
<string.h> to <strings.h> for POSIX 2008 compliance.

Requested by:	linimon
Remove bogus check for kmem_malloc() failure even though M_WAITOK is set.

Requested by:	jkim
Rework the notion of CPU used in top.  In particular, for subsequent
displays after a pause, use the difference in runtime divided by the
length of the pause as the percentage of CPU used instead of the value
calculated by the kernel.  In addition, when determing if a process or
thread is idle or not, treat any process or thread that has used any
runtime or performed any context switches during the interval as busy.

Note that the percent CPU is calculated as a double and stored in an
array to avoid recalculating the value multiple times in the comparison
method used to sort processes in the CPU display.

Tested by:	Jamie Landeg-Jones <jamie@dyslexicfish.net>
Reviewed by:	emaste (earlier version)
MFC after:	1 week
While PAWS is disabled, there are no consumers for the tcp options
argument to tcp_twcheck();  thus mark it __unused.

MFC after:	2 weeks
cxgbe(4): Fix a NULL dereference when the very first call to
get_scatter_segment() in get_fl_payload() fails.  While here,
fix the code to adjust fl_bufs_used when a failure occurs for
any other scatter segment.

MFC after:	3 days
If VMX isn't enabled so long as the lock bit isn't set yet in MSR
IA32_FEATURE_CONTROL it still can be.

Approved by:	grehan (co-mentor)
Fix m2 regression test.

This is not really a good test as the behaviour for /c is unspecified.

For the record, ksh93 returns:

$ printf "abc\n\cdef"
abc
ef$

Discussed with:	Garret D'Amore (Illumos)
MFV 266913+266914:

3897 zfs filesystem and snapshot limits (fix leak)
4901 zfs filesystem/snapshot limit leaks

MFC after:	3 days
- Added myself and mentor/mentee relationship to the src committers
graph.

- Added my info to the FreeBSD calendar.

Approved by:	jmallett (mentor)
Add #NO_UNIVERSE to RADXA and RADXA-LITE kernel configs
since there aren't any new devices in those files so unhook them
from universe build.

Approved by:    stas (mentor)
Add a bounds verification to the SCL and SDA pin values.

At attach, print the SCL and SDA pin numbers.

Remove a stray blank line.

Remove the GPIOBUS locking from gpioiic_reset(), it is already called with
this lock held.  This fixes a crash when you try to scan the iicbus with
i2c(8).
Ignore IIC_ENOADDR from iicbus_reset() as it only means we have a
master-only controller.

This fixes the iic bus scan with i2c(8) (on supported controllers).

Tested with gpioiic(4).
Glibc was switched to the FUTEX_WAIT_BITSET op and CLOCK_REALTIME
flag has been added instead of FUTEX_WAIT to replace the FUTEX_WAIT
logic which needs to do gettimeofday() calls before the futex syscall
to convert the absolute timeout to a relative timeout.
Before this the CLOCK_MONOTONIC used by the FUTEX_WAIT_BITSET op.

When the FUTEX_CLOCK_REALTIME is specified the timeout is an absolute
time, not a relative time. Rework futex_wait to handle this.
On the side fix the futex leak in error case and remove useless
parentheses.

Properly calculate the timeout for the CLOCK_MONOTONIC case.

MFC after:	3 days