tags as requested by miod and tedu
replace atoi() calls with strtol().  Follow the idiomatic pattern in our
manual page strictly.  Return -2 if the strings are not strict numbers.

The numbers remain in the range of "int".  Range checking for these parameters
is done later in the pkey_*_ctl() functions, or sometimes in functions much
further downstream... but not always!!!
ok millert miod mikeb
Remove support for the `opaque PRF input' extension, which draft has expired
7 years ago and never made it into an RFC. That code wasn't compiled in
anyway unless one would define the actual on-the-wire extension id bytes;
crank libssl major.

With help and enlightenment from Brendan MacDonell.
Add an SSL_AEAD_CTX to enable the use of EVP_AEAD with an SSL cipher.
Read and write contexts are also added to the SSL_CTX, along with
supporting code.

Based on Adam Langley's chromium diffs.

Rides the recent SSL library bump.
Add support for handling SSL_CIPHER_ALGORITHM2_AEAD ciphers, which are
those that use EVP_AEAD instead ov EVP_CIPHER. This means being able to
change cipher state with an EVP_AEAD and being able to encrypt/decrypt
TLS using the EVP_AEAD. This has no change on existing
non-SSL_CIPHER_ALGORITHM2_AEAD ciphers.

Based on Adam Langley's chromium patches.

Rides the recent libssl bump.

Tested by sthen@
Use SSL3_SEQUENCE_SIZE and if we're going to preincrement we may as well
do it properly.
Combine the MAC handling for both !EVP_CIPH_FLAG_AEAD_CIPHER and
EVP_CIPH_FLAG_AEAD_CIPHER into the same if/else block.
Switch the AES-GCM cipher suites to SSL_CIPHER_ALGORITHM2_AEAD.
Add ChaCha20-Poly1305 based ciphersuites.

Based on Adam Langley's chromium patches.

Tested by and ok sthen@
Rename a bunch of variables in ssl3_change_cipher_state() for readability.
This also brings it inline with tls1_change_cipher_state_cipher().
The export_key/export_iv variables are only used in the is_export case.
Also use c rather than &c[0].
Swap compress/expand around so they are in the correct order - these ended
up in the wrong order when the code was refactored.
Separate the comression handling from the cipher/message digest handling in
ssl3_change_cipher_state().
Do not bother trying to work out of we can reuse a cipher context - just
throw it away and create a new one. This simplifies the code and also
allows ASR to do its thing.
Use meaningful variable names, rather than i, j, k and cl.
Correctly calculate the key block length when used with export ciphers.
While here, use meaningful variable names and simplify the calculation.
Overhaul the keyblock handling in ssl3_change_cipher_state(). Use
meaningful variable names with use with pointer arithmitic rather than
complex array indexing.
Correctly calculate the key block length when using export ciphers.
typo
Add more bounded attributes to the buffer and md5/sha headers in libssl

ok miod@