Added passive-to-active transition support, including transitioning on
syncache timeout with a synfilter-configurable timeout.

Passive socket pairs now hold a reference to each other to that the
state of each is available for use during transition to active, even
if flow in one direction has been shut down by one of the remotes.

It is now possible for a non-passive listen socket to spawn passive
sockets and passive listen sockets to spawn non-passive socket - that
is, a syn filter can now decide whether to treat a given connection as
passive or not.  If no syn filter is used, new sockets spawned by a
listen socket still inherit their passive mode setting from the listen
socket.
Merge branch 'master' into passive_to_active
Merge branch 'master' into passive_to_active
Fixed lock-order reversal between sock lock and inp lock when setting
l2info on a socket.

The sock lock was being held by sosetopt() across the call to
ip_ctloutput(), which acquires the inp lock, now out-of-order.  This
tends to show up when the l2info is being set on a freshly accepted
socket while segments for that socket are being processed by
tcp_input() - when tcp_input() tries to acquire the receive sockbuf
lock while holding the inp lock, deadlock ensues, as the sock lock and
the receive sockbuf lock are currently one and the same.
Expand .gitignore
Improvements to passive-to-active transition

- l2info can now be set from a synfilter

- altfib can now be set from a synfilter, so the interface the
  syncache responds via during a timeout conversion to active can be
  selected

- SO_PASSIVE for new connections now defaults to the listen socket
  setting (as before) but can be overridden in/by the syncache.

- the INP_INFO lock is now acquired during passive-to-active
  transition on a socket.
Merge branch 'master' into passive_to_active
Fix inbound VLAN tag mask selection bug.  listens on specific VLAN tag
stacks were affected by this.
Merge branch 'master' into passive_to_active
Add missing consts and make room for type translation in setl2info.
Make optval pointer const in so_setsockopt() and cast away const-ness
internally.  This is consistent with how the userland setsockopt()
works.
Fix return value of uhi_rwlock_tryupgrade() to match rwlock_try_upgrade(9).
Commit gross hack and undef ifi_epoch.

This is not the right change, but it's nice to have things build on
FreeBSD -CURRENT.
Fix connscale build (fixes #15.)

Use uinet_soreadable instead of the shortlived uinet_sogetrxavail.

Adjust for new uinet_interface_up syntax.

Use UINET_SYNF_REJECT_RST instead of UINET_SYNF_REJECT.
sorele_nounlock() was a fiction.  Cleanup of passive socket pairs on
listen queues was not being handled correctly.  In the new approach,
putting extra refs on passive socket paris is abandoned in favor of
deferring cleanup of each until both have no refs remaining.
Squash socket refcount adjustments that are no longer needed.
When reusing tcp_do_segment() to set up passive peer sockets, I
completely overlooked its lock-releasing behavior.  This is the
practical near-term solution that Adrian and I worked out and that
Adrian authored.  Ideally, the operative bits of interest to the
passive peer construction code could be factored out of
tcp_do_segment().
Merge branch 'passive_to_active'