remember to set EACCES in bcrypt_checkpass for hash differences.
the higher level crypt_checkpass function will reset errno to EACCES in
all cases, which is probably the right behavior, but this change gives code
working with the lower level functions the correct errno if they care.

patch from Kinichiro Inoguchi, tested on HP-UX 11.31
ok deraadt@

what's going on.

guenther suggested using thread time, which actually may improve accuracy
if somebody puts this in a threaded program.

suggested by deraadt@ re: more general MIN/MAX cleanups

This avoids a namespace conflict with Solaris build environments.
discussed with deraadt@ and kettenis@

Switch to local definitions where MAX is needed.
discussed with deraadt@

Nothing is done with the return value from ntp_dns, and it already calls
fatal() on failure.
ok deraadt@

ok deraadt@ phessler@

ok jsing@ phessler@ naddy@

ok robert@

discussed with schwarze@

ok aja@

OK jasper

ok deraadt miod

ok miod@

egress group only works if you have a default route; this confused
some people.

from this case where we have a static buffer and cant realloc.
ok phessler, claudio, reyk

use global data. The simplest fix is to only check blowfish passwords,
and implicitly lock out DES passwords.
crypt_checkpass is currently only used in one place, passwd, to verify
the local user's password, so this is probably acceptable.
Gives people a little more time to migrate away from DES before introduing
checkpass into more places.

OK deraadt@ some time ago

ramdisk libc builds.  there has to be a better way without #ifdef's
in gross places, but I don't see it yet.

no objection from deraadt@

naddy found sparc64 gets a little slower when unrolled.
ok deraadt

when it's really old. but no actual ports fallout in espie's build.
ok deraadt

update SYNOPSIS and DESCRIPTION and add STANDARDS

reflect reality.
OK benno@

effectively disabled support for the SSL protocols.  SSL remains a
common term describing SSL/TLS, there is some controvery about this
change, and the name really doesn't matter, but I feel confident about
it now.
(btw., sthen@ pointed out some historical context:
http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html)
OK benno@, with input from tedu@

rewrite the function to be simpler as well. the compiler can unroll the
loop for us if necessary.
ok schwarze