Secure renegotiation extension should only be sent in case client supports secure renegotiation
Fixed offset for cert_type list in ssl_parse_certificate_request()
Fixed const correctness issues that have no impact on the ABI
Fixed const correctness issues in programs and tests
Disabled the HAVEGE random generator by default

Rationale: The HAVEGE random generator has too many caveats to be a
standard generator that people rely on. The HAVEGE random generator is not
suitable for virtualized environments. In addition the HAVEGE random
generator is dependent on timing and specific processor traits that
cannot be guaranteed by default on compile time.

Our advice: only use HAVEGE as an additional random source for your
entropy pool, never as your primary source.
Added error.h inclusion in error.c template
pem_read_buffer() already update use_len after header and footer are read

After header and footer are read, pem_read_buffer() is able to determine
the length of input data used. This allows calling functions to skip
this PEM bit if an error occurs during its parsing.
x509parse_crt() now better handles PEM error situations

Because of new pem_read_buffer() handling of when it writes use_len,
x509parse_crt() is able to better handle situations where a PEM blob
results in an error but the other blobs can still be parsed.
ssl_parse_certificate() now calls x509parse_crt_der() directly
Internally split up x509parse_key()

Split up x509parse_key() into a (PEM) handler function and specific
DER parser functions for the PKCS#1 (x509parse_key_pkcs1_der()) and
unencrypted PKCS#8 (x509parse_key_pkcs8_unencrypted_der()) private
key formats.
Parsing of PKCS#8 encrypted private key files added and PKCS#12 basis

PKCS#8 encrypted key file support has been added to x509parse_key() with
support for some PCKS#12 PBE functions (pbeWithSHAAnd128BitRC4,
pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd2-KeyTripleDES-CBC)
Make sure polarssl/config.h is included at the start
Added mechanism to provide alternative cipher / hash implementations

All symmetric cipher algorithms and hash algorithms now include support
for a POLARSSL_XXX_ALT flag that prevents the definition of the
algorithm context structure and all 'core' functions.
Changed x509parse_crt_der() to support adding to chain.

Removed chain functionality from x509parse_crt() as x509parse_crt_der()
now handles that much cleaner.
x509parse_crtpath() is now reentrant and uses more portable stat()

Moved from readdir() to readdir_r() and use stat instead of the less
portable d_type from struct dirent.
Fixed location of brackets in pkcs12.c
Fixed bignum.c and bn_mul.h to support Thumb2 and LLVM compiler
PKCS#5 module added. Moved PBKDF2 functionality inside and deprecated
old PBKDF2 module.
PKCS#5 v2 PBES2 support and use in PKCS#8 encrypted certificates

The error code POLARSSL_ERR_X509_PASSWORD_MISMATCH is now properly
returned in case of an encryption failure in the padding. The
POLARSSL_ERR_X509_PASSWORD_REQUIRED error code is only returned for PEM
formatted private keys as for DER formatted ones it is impossible to
distinguish if a DER blob is PKCS#8 encrypted or not.
Centralized module option values in config.h

Allow user-defined settings without editing header files by using
POLARSSL_CONFIG_OPTIONS in config.h