x509show improvements.

The -v (verbose) option is now taken into account.
Add serial number to the pretty output.
Bugfix: DirectoryString were not considered printable values.
Bugfix: CN should not be quoted too early in extract_dns_and_ips.
Bugfix in PKCS#1 signature verification: some cases were not handled correctly.

Sometimes, we may try to check a signature corresponding to the wrong modulus, leading
to a signature value too big to fit in the group. It should be discarded as a wrong
signature.

In case we do not know the hash algorithm, return false instead of an exception. This
might actually be subject to discussion.
Basic implementation of NPN.
Full rewrite of TlsEngineNG record handling.

The encrypt/decrypt functions in TLS context structure have changed.
The new representations can take two previously unhandled elements:
 - the direction of the message;
 - the integrity of the message produced.

Every call to parse_all_tls_record needs a new parameter: direction.
New Parsifal type: pcap-tls.

This new type allows for direction-sensitive PCAP TLS parsing.
First support for RC4 and AES128 record handling.

Function interfaces and unit tests have been modified accordingly.

This chunk will need some testing and then some refactoring.
Rename hash_fun_of_name -> hmac_fun_of_name.

Let's try to avoid misleading terms. The function returns a HMAC function.
New field in TLS "future" context: handshake_messages.

This field will keep track of previous handshake messages,
that are needed to produce the Finished message.
Add support for Finished messages.

Some changes were needed to get the correct result:
 - set PMS when making a CKE message
 - add a call to update_with_CCS on sending the message
 - update f_handshake_messages accordingly
 - change OutputTlsMsgs' type (it is now composed of *functions*,
   so that actions are taken in order: f_handshake_messages population,
   CCS, Finished generation)
TLS records are not always splittable/mergeable.

Appart from ApplicationData, 0-length records are forbidden. Let's look
at the different cases:
 - ApplicationData should be considered as streams, so they can be
   split/merged
 - Handshake are also supposed to be split/merged
 - Hearbeat messages are, by nature, supposed to fit in exactly one
   record (to measure the MTU). So they must not be reassembled.
 - CCS are 1-byte long it is impossible to get two CCS in a raw. Since
   0-length records are forbidden, CCS always fit in exactly one record
 - Finally, for alerts, which are 2-byte long, and that could be sent in
   a raw (2 non-fatal alerts for example), the answer is less clear. We
   choose to treat them as CCS and Heartbeat.
Add the raw string to trivial_union Parsed constructor.
Add a wrapper around X.509 certificate: smart_certificate.

Yet I probably should not be too liberal about the term smart.
New useful type: cert_store.

For the moment, stored certificates are indexed by hash and subject_hash.
Add some helpers to validate a link between two certificates.
Add first support for X.509 certificate chain.
Add algorithm to validate chains according to the RFC.

In particular, the presented certificates must all be present and ordered.
New, more generic, algorithm to build chains.

build_certchain is able to pick certificates from a store,
which can contain trusted roots, or untrusted intermediate
certificates.

It also handles unordered certificates.
Add a new probe_server subcommand, check-certs, to validate a certificate chain.