Fix multiple OpenSSL vulnerabilities:

The receipt of a specifically crafted DTLS handshake message may cause OpenSSL
to consume large amounts of memory. [CVE-2014-3506]

The receipt of a specifically crafted DTLS packet could cause OpenSSL to leak
memory. [CVE-2014-3507]

A flaw in OBJ_obj2txt may cause pretty printing functions such as
X509_name_oneline, X509_name_print_ex et al. to leak some information from
the stack. [CVE-2014-3508]

OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to
a denial of service attack. [CVE-2014-3510]

If a multithreaded client connects to a malicious server using a resumed
session and the server sends an ec point format extension it could write
up to 255 bytes to freed memory. [CVE-2014-3509]

A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
TLS 1.0 instead of higher protocol versions when the ClientHello message
is badly fragmented. [CVE-2014-3511]

A malicious client or server can send invalid SRP parameters and overrun
an internal buffer. [CVE-2014-3512]

A malicious server can crash the client with a NULL pointer dereference by
specifying a SRP ciphersuite even though it was not properly negotiated
with the client. [CVE-2014-5139]

Security:	CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3510,
		CVE-2014-3509, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139
Security:	FreeBSD-SA-14:18.openssl
Approved by:	so
Fix Denial of Service in TCP packet processing.

Security:	FreeBSD-SA-14:19.tcp
Approved by:	so
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=266209

Add a command line argument (-l) to end event collection after some
number of seconds.  The number of seconds may be a fraction.

Submitted by:	Julien Charbon <jcharbon@versign.com>
MFC after:	2 weeks
Relnotes:	yes

Conflicts:
	usr.sbin/pmcstat/pmcstat.c
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=266166

Extend the size of the function or symbol that can be annotated.

MFC after:	2 weeks
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=260796

Fix various places where we don't properly release a lock

PR:		185043
Submitted by:	Michael Bentkofsky
MFC after:	2 weeks
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=261242

Decrease lock contention within the TCP accept case by removing
the INP_INFO lock from tcp_usr_accept.  As the PR/patch states
this was following the advice already in the code.
See the PR below for a full disucssion of this change and its
measured effects.

PR:		183659
Submitted by:	Julian Charbon
Reviewed by:	jhb
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264321

Currently, the TCP slow timer can starve TCP input processing while it
walks the list of connections in TIME_WAIT closing expired connections
due to contention on the global TCP pcbinfo lock.

To remediate, introduce a new global lock to protect the list of
connections in TIME_WAIT.  Only acquire the TCP pcbinfo lock when
closing an expired connection.  This limits the window of time when
TCP input processing is stopped to the amount of time needed to close
a single connection.

Submitted by:	Julien Charbon <jcharbon@verisign.com>
Reviewed by:	rwatson, rrs, adrian
MFC after:	2 months
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264342

Don't leak the TCP pcbinfo lock if a time wait connection is closed
in between grabbing a reference on the connection structure and obtaining
the pcbinfo lock.

Reviewed by:	Julien Charbon
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264351

The tw_pcbrele() function does not need the global timewait lock.

Submitted by:	Julien Charbon
Suggested by:	glebius
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=264356

Some whitespace and style fixes.

Submitted by:	bde
Cherry-picked from HEAD:

Notes:
    svn path=/head/; revision=271119

In tcp_input(), don't acquire the pcbinfo global write lock for SYN
packets targeting a listening socket.  Permit to reduce TCP input
processing starvation in context of high SYN load (e.g. short-lived TCP
connections or SYN flood).

Submitted by:	Julien Charbon <jcharbon@verisign.com>
Reviewed by:	adrian, hiren, jhb, Mike Bentkofsky
[tcp-scaling]: Fix a race condition in TCP timewait
between tcp_tw_2msl_reuse() and tcp_tw_2msl_scan() that drives
(at least) timewait timeout cancellation.  Also simplify
implementation by holding inpcb reference and removing
tw_pcbref() and tw_pcbrele().
[tcp-scaling]: Introduce the INP_LIST global mutex for protecting pcbinfo
global structures. Then use INP_INFO_RLOCK in critical paths to increase
TCP processing parallelism, and use INP_INFO_WLOCK in full INPs iteration
loops.

Julien's review:
 - Fix INP_INFO_WLOCK assertions
 - Improve comments