Sprout from master 2014-08-06 20:29:54 UTC reyk 'Change grammar to remove a shift/reduce conflict that was introduced'
Delete:
src/lib/libcrypto/arc4random/arc4random_linux.h
src/lib/libcrypto/arc4random/arc4random_osx.h
src/lib/libcrypto/arc4random/arc4random_solaris.h
src/lib/libcrypto/arc4random/arc4random_win.h
src/lib/libcrypto/arc4random/getentropy_linux.c
src/lib/libcrypto/arc4random/getentropy_osx.c
src/lib/libcrypto/arc4random/getentropy_solaris.c
src/lib/libcrypto/arc4random/getentropy_win.c

with the ssl options.
"listen on $ip port 443 ssl" turns into "listen on $ip ssl port 443".
ok florian@

max requests (per connection) and timeout.  We don't want to add too
many button, and there are good defaults, but these ones are kind of
mandatory.

that you don't have to push all kinds of buttons to run httpd.

OK ajacoutot@ halex@

up with a confusing output like:
multicast_host      >NO<
<...>
multicast_host      >YES<
Also properly evaluate values _after_ running _rc_quirks() because these
can modify flags.
ok robert@ halex@

servers, for example auto index for a sub-directory only.  Internally,
a "location" is just a special type of a "virtual" server.

The option "directory auto index" implements basic directory listing
and is turned off by default.
ok deraadt@

the details are under embargo. The original plan was to wait for the
embargo to lift, but we've been waiting for quite some time, and there's no
indication of when or even if it will end. No sense in dragging this out
any longer.
The SRP code has never been enabled in OpenBSD, though I understand it is
in use by some other people. However, in light of this and other issues,
we're officially saying SRP is outside the scope of libressl. (For now.)

ok ajacoutot@ benno@

The `+' sign was added by mistake thinking it was doing something else.
ok schwarze@

improvements.  It is not "finished" but serves static files.
ok deraadt@

than distribution. These would modify files in /etc, part of the base
set, but still... that makes it harder to discern their sets placement.

Requested by deraadt@

Also, zero the SHA256 context.
suggested by "eric" in a comment on an opensslrampage.org post
ok miod@ deraadt@

being-standardized <endian.h>
ok deraadt@ millert@ beck@

Move <sys/mman.h> and raise(SIGKILL) calls to OS-specific headers.
On OpenBSD, move thread_private.h as well to arc4random.h.
On Windows, use TerminateProcess on getentropy failure.
ok deraadt@

It may make sense to later replace this with a Critical Section later.
ok guenther@

- no need to start spamd in background mode
- return from rc_start() in case spamd failed to start
- execute spamd-setup without explicitly waiting for spamd
prodded by, discussed with and OK ajacoutot@

6.11.5 - Storage-class specifiers:
The placement of a storage-class specifier other than at the
beginning of the declaration specifiers in a declaration is
an obsolescent feature.
Diff from Jean-Philippe Ouellet (jean-philippe (at) ouellet.biz)

it shows up in libraries.  Even the system call is probably not finalized.
Bit dissapointed it has turned out to be a descriptor-less read() with
EINVAL and EINTR error conditions, but we can work with it.

writeable during shutdown.  This prevents ugly error messages when
the machine is rebooted from singe-user without mounting the file
systems read-write.
suggested by deraadt@

into one if a system has an awesome getentropy().  In that case it
is valid to totally throw away the rsx state in the child.  If the
getentropy() is not very good and has a lazy reseed operation, this
combining is a bad idea, and the reseed should probably continue to
use the "something old, something new" mix.  _rs_allocate() can
accomodate either method, but not on the fly.
ok matthew

1. Use "len" parameter instead of sizeof(*rs).
2. Simplify the atfork handler to be strictly async signal safe by
simply writing to a global volatile sig_atomic_t object, and then
checking for this in _rs_forkdetect().  (Idea from discussions with
Szabolcs Nagy and Rich Felker.)
3. Use memset(rs, 0, sizeof(*rs)) to match OpenBSD's MAP_INHERIT_ZERO
fork semantics to avoid any skew in behavior across platforms.
ok deraadt

we no longer need the spread of dev/log AF_UNIX sockets all over the
various chroot spaces.
ok beck millert aja

/usr/local/share/pkgconfig
ok sthen@