dtls: add additional security_params

Now it is possible to handle 2 ciphers at one time, this is needed when
the cipher is changed and a package is received later, now we are able
to still decrypt it.

There is still a problem with the ChangeCipherSpec package, when the
client had send his Final handshake message, it receives a
ChangeCipherSpec message in the previous epoch and has to decrypt it.
Currently this CCS is ignored, because of an other bug. This patch is
needed to fix these problems in a later patch. It is planed to free the
old security_params after some time the new one was used.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: make it possible to send packages in different epoch.

This adds an epoch parameter to dtls_prepare_record().

This also moves the rseq to the dtls_security_parameters_t, so we are
able to send a message in the old epoch. This is needed when we do
retransmission of the flight with the Finish message in it. There we
have to use the old cipher with the old sequence number and not the new
one.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: use the correct epoch when retransmitting

Store the epoch and use it for sending the package.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: make it possible to send packages in different epoch

This adds a epcoh paramater to dtls_send_multi()

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: make it possible to send a CCS in a different epoch

We have to send the ChangeCipherSpec with the old cipher, but the
server should only send it after he received the Finish message
encrypted with the new cipher from the client. This makes it possible
to use the a different than the default cipher for CCS.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: send ChangeCipherSpec after receiving Finish

The server has to send the ChangeCipherSpec after he received the
Finish message from the client and not after he received the CCS
message.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: accept packages form old epochs

It could be that there are still some packages coming later, we should accept them.
This is also needed for the ChangeCipherSpec received by the client,
after the client already end his Finish message in the new epoch.

This handling should be improved in the future.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: add CCS to the retransmission buffer

We also have to retransmit the ChangeCipherSpec message. Also store the
type of message for retransmission.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: client should expect CCS from server

Without this patch the client expected a Finish message after it
received the ServerHelloDone message from the server. This worked
because the ChangeCipherSpec message was send in the old epoch and the
client was already in the new epoch and ignored it. Now this message
goes through and the client should handle it.

This uniforms the server and client states.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: store own and remote handshake sequence number

The next handshake message sequence number to send is stored and the
next expected to receive sequence number is also stored.
This is needed for reordering.

In the suscess case the switch in handle_handshake() should always be
ended with a break and not a return.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dtls: add support for reordering packages

This adds support for reordering packages received from the remote
peer. When one message in a flight was missing and we still need it all
the following messages are stored so if in the next send one other
message was missing we just needed to get the one we miss. This should
improve reliable on very unreliable networks. As storage the
retransmission buffer is used.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>