ossl_recv: check for an OpenSSL error, don't assume

When we recently started to treat a zero return code from SSL_read() as
an error we also got false positives - which primarily looks to be
because the OpenSSL documentation is wrong and a zero return code is not
at all an error case in many situations.

Now ossl_recv() will check with ERR_get_error() to see if there is a
stored error and only then consider it to be a true error if SSL_read()
returned zero.

Bug: http://curl.haxx.se/bug/view.cgi?id=1249
Reported-by: Nach M. S.
Patch-by: Nach M. S.
c-ares: improve error message on failed resolve

When the c-ares based resolver backend failed to resolve a name, it
tried to show the name that failed from existing structs. This caused
the wrong output and shown hostname when for example --interface
[hostname] was used and that name resolving failed.

Now we use the hostname used in the actual resolve attempt in the error
message as well.

Bug: http://curl.haxx.se/bug/view.cgi?id=1191
Reported-by: Kim Vandry
TODO: 1.8 Modified buffer size approach

Thoughts around buffer sizes and what might be possible to do...
SIGPIPE: don't use 'data' in sigpipe restore

Follow-up fix from 7d80ed64e43515.

The SessionHandle may not be around to use when we restore the sigpipe
sighandler so we store the no_signal boolean in the local struct to know
if/how to restore.
tests: add test1395 to the tarball
printf: make sure %x are treated unsigned

When using %x, the number must be treated as unsigned as otherwise it
would get sign-extended on for example 64bit machines and do wrong
output. This problem showed when doing printf("%08x", 0xffeeddcc) on a
64bit host.
formpost: better random boundaries

When doing multi-part formposts, libcurl used a pseudo-random value that
was seeded with time(). This turns out to be bad for users who formpost
data that is provided with users who then can guess how the boundary
string will look like and then they can forge a different formpost part
and trick the receiver.

My advice to such implementors is (still even after this change) to not
rely on the boundary strings being cryptographically strong. Fix your
code and logic to not depend on them that much!

I moved the Curl_rand() function into the sslgen.c source file now to be
able to take advantage of the SSL library's random function if it
provides one. If not, try to use the RANDOM_FILE for seeding and as a
last resort keep the old logic, just modified to also add microseconds
which makes it harder to properly guess the exact seed.

The formboundary() function in formdata.c is now using 64 bit entropy
for the boundary and therefore the string of dashes was reduced by 4
letters and there are 16 hex digits following it. The total length is
thus still the same.

Bug: http://curl.haxx.se/bug/view.cgi?id=1251
Reported-by: "Floris"
RELEASE-NOTES: synced with 365c5ba39591

The 10 first bug fixes for the pending release...
curl.1: fix typo in --xattr description

Bug: http://curl.haxx.se/bug/view.cgi?id=1252
Reported-by: Jean-Noël Rouvignac
digest: improve nonce generation

Use the new improved Curl_rand() to generate better random nonce for
Digest auth.
digest: append the timer to the random for the nonce
url: restore the functionality of 'curl -u :'

This commit fixes a regression introduced in
fddb7b44a79d78e05043e1c97e069308b6b85f79.

Reported by: Markus Moeller
Bug: http://curl.haxx.se/mail/archive-2013-06/0052.html
lib506.c: Fixed possible use of uninitialized variables
darwinssl: SSLv2 connections are aborted if unsupported by the OS

I just noticed that OS X no longer supports SSLv2. Other TLS engines return
an error if the requested protocol isn't supported by the underlying
engine, so we do that now for SSLv2 if the framework returns an error
when trying to turn on SSLv2 support. (Note: As always, SSLv2 support is
only enabled in curl when starting the app with the -2 argument; it's off
by default. SSLv2 is really old and insecure.)
Merge branch 'master' of https://github.com/bagder/curl
examples: Moved usercertinmem.c to COMPLICATED_EXAMPLES

This prevents it from being built during a "make check" since it
depends on OpenSSL.
Added libmetalink URL; added Android versions.
Synced Makefile.vc6 with recent changes.

Issue posted to the list by malinowsky AT FTW DOT at.
Added winssl-zlib target to VC builds.
xc-am-iface.m4: provide XC_AUTOMAKE macro