Synchronize CHANGES between 0.9.8 and HEAD.

 Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]

  *) DTLS Handshake overhaul. There were longstanding issues with

     OpenSSL DTLS implementation, which were making it impossible for

     RFC 4347 compliant client to communicate with OpenSSL server.

     Unfortunately just fixing these incompatibilities would "cut off"

     pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e

     server keeps tolerating non RFC compliant syntax. The opposite is

     not true, 0.9.8f client can not communicate with earlier server.

     This update even addresses CVE-2007-4995.

     [Andy Polyakov]

  *) Changes to avoid need for function casts in OpenSSL: some compilers

     (gcc 4.2 and later) reject their use.

     [Kurt Roeckx <kurt@roeckx.be>, Peter Hartley <pdh@utter.chaos.org.uk>,

      Steve Henson]

  *) Add RFC4507 support to OpenSSL. This includes the corrections in

     RFC4507bis. The encrypted ticket format is an encrypted encoded

     SSL_SESSION structure, that way new session features are automatically

     supported.

     If a client application caches session in an SSL_SESSION structure

     support is transparent because tickets are now stored in the encoded

     SSL_SESSION.

     The SSL_CTX structure automatically generates keys for ticket

     protection in servers so again support should be possible

     with no application modification.

     If a client or server wishes to disable RFC4507 support then the option

     SSL_OP_NO_TICKET can be set.

     Add a TLS extension debugging callback to allow the contents of any client

     or server extensions to be examined.

     This work was sponsored by Google.

     [Steve Henson]

  *) Add initial support for TLS extensions, specifically for the server_name

     extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now

     have new members for a host name.  The SSL data structure has an

     additional member SSL_CTX *initial_ctx so that new sessions can be

     stored in that context to allow for session resumption, even after the

     SSL has been switched to a new SSL_CTX in reaction to a client's

     server_name extension.

     New functions (subject to change):

         SSL_get_servername()

         SSL_get_servername_type()

         SSL_set_SSL_CTX()

     New CTRL codes and macros (subject to change):

         SSL_CTRL_SET_TLSEXT_SERVERNAME_CB

                                 - SSL_CTX_set_tlsext_servername_callback()

         SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG

                                      - SSL_CTX_set_tlsext_servername_arg()

         SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()

     openssl s_client has a new '-servername ...' option.

     openssl s_server has new options '-servername_host ...', '-cert2 ...',

     '-key2 ...', '-servername_fatal' (subject to change).  This allows

     testing the HostName extension for a specific single host name ('-cert'

     and '-key' remain fallbacks for handshakes without HostName

     negotiation).  If the unrecogninzed_name alert has to be sent, this by

     default is a warning; it becomes fatal with the '-servername_fatal'

     option.

     [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]

  *) Add AES and SSE2 assembly language support to VC++ build.

     [Steve Henson]

  *) Mitigate attack on final subtraction in Montgomery reduction.

     [Andy Polyakov]