DTLS/SCTP Finished Auth Bug

PR: 2808

With DTLS/SCTP the SCTP extension SCTP-AUTH is used to protect DATA and
FORWARD-TSN chunks. The key for this extension is derived from the
master secret and changed with the next ChangeCipherSpec, whenever a new
key has been negotiated. The following Finished then already uses the
new key.  Unfortunately, the ChangeCipherSpec and Finished are part of
the same flight as the ClientKeyExchange, which is necessary for the
computation of the new secret. Hence, these messages are sent
immediately following each other, leaving the server very little time to
compute the new secret and pass it to SCTP before the finished arrives.
So the Finished is likely to be discarded by SCTP and a retransmission
becomes necessary. To prevent this issue, the Finished of the client is
still sent with the old key.
DTLS/SCTP struct authchunks Bug

PR: 2809

DTLS/SCTP requires DATA and FORWARD-TSN chunks to be protected with
SCTP-AUTH.  It is checked if this has been activated successfully for
the local and remote peer. Due to a bug, however, the
gauth_number_of_chunks field of the authchunks struct is missing on
FreeBSD, and was therefore not considered in the OpenSSL implementation.
This patch sets the corresponding pointer for the check correctly
whether or not this bug is present.
Add -ecdh_single option.

Add -ecdh_single option to set SSL_OP_SINGLE_ECDH_USE on the command line.
Fix SSL_OP_SINGLE_ECDH_USE

Don't require a public key in tls1_set_ec_id if compression status is
not needed. This fixes a bug where SSL_OP_SINGLE_ECDH_USE wouldn't work.
Typo.
(cherry picked from commit 13af1451595b514524b0efc17f99f6392ce090d5)
Extend SSL_CONF

Extend SSL_CONF to return command value types.

Add certificate and key options.

Update documentation.
(cherry picked from commit ec2f7e568ea18a22ab57326fffe78ef2aa6884f5)
Constification.
(cherry picked from commit 27f3b65f49ea91fcf4b46ec0298be51b4207214a)
Fix argument processing.
(cherry picked from commit abf840e4f71c3a8795428c213fd37ece2a910443)
Add SSL_CONF command to set DH Parameters.
(cherry picked from commit c557f921dcb20a1bf2ce75e9dc7dd164e59ec3ea)
Fix warning.
(cherry picked from commit 96e16bddb42563dc09187939dc20b35369d413b7)
Add brainpool curves to trace output.
PBKDF2 should be efficient. Contributed by Christian Heimes
<christian@python.org>.