Add a new 'multi' logger that dispatches log to several child loggers

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
ssl: Allow to specify a fixed length

By default openssl will only get 512 or 1024 (depending only of the
"export" setting). But 1024 is a bit short nowadays and 2048 is
recommended. It does break compatibility in very rare case, so it's
left by default to auto. (there is no negotiation, the client has to
support whatever the server sends)

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
ssl: If a valid peer certificate is submitted, extract subject/issuer

And we store it in the 'socket' structure, mostly for lack of a better
place to distribute it around ...

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
proxy: Add X-Forwarded-SSL-Peer-{Subject,Issuer}-Name headers if available

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
ssl: When no SNI is present, use the _server_ IP as 'servername'

Previously this used the client IP ... which is really annoying and
I don't see what use case this would fit.

Matching on the server IP is already possible using the v_target_ip
match module. However matching on the IP of servername allows better
control because it will be the IP only if the client doesn't do SNI
while v_target_ip will always match even if the client sent an explicit
name. So this way you can use IP matching only has a fallback for non-SNI.

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
ssl: Add a 'tolerate' option for client certificate verification

This option is very similar to accept with the exception that if the
certificate that's sent by the client can't be validated, the SSL
handshake will not be abruptly terminate but it will continue.

The application that use the client certificate should in any case call
the SSL_get_verify_status and this will still return that the validation
failed and the cert be ignored.

This is mainly useful because Apple, in it's great wisdom, decided to
make Safari send just about any client cert, even those not matching at
all the CA list sent by the server ... The only way to use client cert
with Safari is then to just accept any client cert and just ignore it
if it's invalid rather than preventing the SSL negotiation.

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>