install sample configs to /etc/.
ok claudio deraadt henning mcbride

ok sthen@

ok kettenis@

There is no reason we couldn't reload|stop a daemon even when _flags is
set to NO.
As a bonus side effect, we can now see usage() on disabled scripts.
discussed with sthen@ and espie@
ok sthen@

can trivially regen the <=4k bit ones.  ok djm@

ok deraadt@ robert@

prompted by deraadt@

to /dev/null.

point of view.
mostly ok sthen@ ajacoutot@, who were discussing the feng shui of the
start_daemons chunk

from robert at peichaer dot org
discussed with and ok halex@

scripts; from robert at peichaer dot org
ok halex@
While here, put the "sanitation" commands in their own block.

such).
from robert at peichaer dot org
modified after a discussion with halex@
ok halex@ robert@

from robert at peichaer dot org
ok halex@

privilege is needed to run rc_check.
In effect this means /etc/rc.d/foobar check can now be run as a regular
user.
Discussed with robert@ during g2k12.
ok todd@

signatures from observation.
ok mikeb@ jsing@ henning@ deraadt@

OK espie@ kettines@

ok robert@

ok robert@

ok ajacoutot@, krw@, deraadt@

initially from robert at peichaer dot org with some enhancement by halex@
ok halex@

out of the box.
ok deraadt@ pirofti@

descriptor starvation, we can crank the default user file descriptor
limits.

preventing them being locally allocated as dynamic ports.
If AMT is configured with the same IP address as the host (and, in
the case of redirection/https ports, if the relevant feature is
enabled), it will steal packets sent to its ports.
ok mikeb@. kettenis@ thinks it's probably a good idea.

These are useful if you're behind a bad nat with short timeouts as often
found in airport lounges and hotels. If the keepalives fail because the
network goes away (moving out of wireless reception, swapping cables etc)
your connections are more likely to drop so this is a double-edged sword.
ok henning@

daemon is not active (happens often to me, as I forget which box has
which daemons).
okay ajacoutot@

provide IP22 and IP28 kernels, as well as the ECOFF bootblock.
No objection from deraadt@

and have been stubbed on openbsd.org anyway ok millert@ robert@ otto@

ok jmatthew@

default, similar to the v6 entries.
While here, add a filter for 100.64.0.0/10, which is now reserved by RFC 6598
OK henning@, sthen@