Lets just gracefully handle the fact that TLS wasn't selected, and solve in the admin it should have been done.
ssl: When no SNI is present, use the _server_ IP as 'servername'

Previously this used the client IP ... which is really annoying and
I don't see what use case this would fit.

Matching on the server IP is already possible using the v_target_ip
match module. However matching on the IP of servername allows better
control because it will be the IP only if the client doesn't do SNI
while v_target_ip will always match even if the client sent an explicit
name. So this way you can use IP matching only has a fallback for non-SNI.

Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
@smunaut could you test if this branch does function as you expect from your pull request? Specifically because I have moved the verify inside of the the first if.
Enable TRACE on client side certificates.
This fixes the problem where IPv4 bindings try to bind as IPv6 socket,
which in cascade result in the closing of the socket and loosing the TLS
status of thereof. Thanks a million to @Crafter6432 for reporting
this incident #1020 because it might have occured in other situations as
well.
Implement a way to emit warnings as suggested by @Borkason in #993

A validation can validate, warn and give an error.
When we do not return any value the validation will pass.
Until we find an error, each warning will be added gracefully.
If we do in fact find one error, the for loop will break, and all
previously added warning and the last error is treated as error.

To show the "warnings" in the interface, we merge the dictionary
that we expect to return with our warning, this will override the
return value.

I consider this a hack, but for now it functions gracefully.
Commit code from @Borkason that implements the validation of a private key.

If the private key still contains a passphrase we emit a warning to the user.
Fix #501 with the code from @Borkason
Merge pull request #1044 from cherokee/fix-501-split

Fix #501 with the code from @Borkason
When no address is defined, our family remains 0.
First we attempt to bind with IPv6, if the server is configured with IPv6.
If that fails, or is not the case, we try to bind with with IPv4.
Secure by Default
Merge pull request #1046 from cherokee/fix_ssl_securebydefault2

Secure by Default
Merge pull request #1047 from cherokee/fix_startup_without_tls

The server starts normally if TLS wasn't selected but a port was defined.
Implement HTTP header Content-Encoding
Implement all current possible http header matches in rule header.
Tiny mistake
Warn if the regexp field for the header match is not yet defined or is empty.
Merge pull request #1048 from cherokee/feature_match_by_content-encoding

Feature match by content encoding + add all headers to rule
Some whitespace issues
Merge pull request #1049 from cherokee/skinkie-optimisation_ssl_client_cert_enum

Optimilations to reduce the requirement for string matching within the SSL client certificate code