Making it possible to define parameters for Diffie–Hellman key exchange.

Motivation:

Improving security of SSL transactions that use DHE-based ciphers. For
instance, it should be possible to change key size.

Modifications:

Adding a new native operation on OpenSSL that makes it possible to add
to an SSL context a file that defines DH parameters.

Result:

One can now create his/her dhparam key file using the following command
line:
openssl dhparam -rand - 2048 > /etc/ssl/certs/dhparam.pem
For parameters to be taken int o account, in Java, one should then call:
SSLContext.setTmpDH(sslContext.context(), "/etc/ssl/certs/dhparam.pem")
Making it possible to have access to the chose session protocol (e.g. … TLSv1.2 or SSLv3)

Motivation:

It is possible to check what is the chosen cipher for an SSL session,
which is properly reported in netty using the OpenSSL implementation for
SSLSession. However, protocol is reported as unknown. If using the JDK
implementation, it is correctly reported such as as SSLv3.

Knowing the session protocol can help in managing security properly,
e.g. for accepting SSLv3 or TLSv1 in some parts of an application for
compatibility, and allowing only TLSv1.1 or TLSv1.2 for more secured
parts, such as user authentication.

Modifications:

Just adding a new native operation to SSL to quary protocol of an
existing session thanks to its id.

Result:

It will be possible to implement getProtocol for the
OpenSslEngine.getSession().getProtocol() so that it has same behavior as
JDK implementation.
Making it possible to define the elliptic curve by name for ephemeral
Diffie–Hellman.

Motivation:

Improving security of SSL transactions that use ECDHE-based ciphers.

Modifications:

Adding a new native operation on OpenSSL that makes it possible to set
the elliptic curve by meely giving its name. An exception is thrown in
case the curve is not found or fails to load.

Result:

One can now setup his/his elliptic curve as can be chosen in the liste
generated by:
openssl ecparam -list_curves
This is done e.g. by calling:
SSLContext.setTmpECDHByCurveName(sslContext.context(), "secp256k1")
Note that secp256k1 is the default value.
Merge remote-tracking branch 'origin/1.1.30' into dev

Conflicts:
	src/main/java/org/apache/tomcat/jni/SSLContext.java
Merge branch 'f-ecparam' into dev
ecdh elliptic curve name