relayd: fix DEBUG build feedback and OK tb@

fix memory leak in config_purge() when dealing CONFIG_PROTOS original diff from CypherFox (openbsd at cypher-fox com), thanks! slightly rearranged to be a bit smaller by me, but still equivalent.

remove dup block that tries to close tls client ca fd it's already closed and fd set to -1 a few lines above. diff from Marc Jorge (openbsd [at] cypher-fox com), thanks!

Standardize logging with bgpd OK claudio@

Use imsg_get_fd() to extract the fd from an imsg. OK tb@

relayd: add support for client certificates This feature has been requested many times over the years. Various patches were provided by Asherah Connor, Rivo Nurges, Markus Läll and maybe others. These patches always stalled for various reasons. From Sören Tempel, mostly based on Asherah's latest patch. ok florian tb

Use imsg_get_fd() As usual proc_forward_imsg() is never forwarding a file descriptor so just use -1 there. This should be replaced by imsg_forward(). All other changes are simple conversions. OK tb@

remove ssl_init() it's a noop; nowadays both LibreSSL and OpenSSL libcrypto and libssl initialize themselves automatically before doing anything. ok tb

fix use after free ok tb@

Remove unneeded calls to tls_init(3) As per the manual and lib/libtls/tls.c revision 1.79 from 2018 "Automatically handle library initialisation for libtls." initialisation is handled automatically by other tls_*(3) functions. Remove explicit tls_init() calls from base to not give the impression of it being needed. Feedback tb OK Tests mestre

Add support for binary protocol health checking. Feedback and guidance from benno@ and reky@. Man page tweaks from jmc@. ok benno@

Add support for OCSP stapling Many thanks to Bruno Flueckiger who independently sent a very similar patch. He also tested the one I'm committing that it works as expected. OK tb@

Make sure that the IMSG_CTL_RESET message is sent immediately. This fixes an issue that might better be solved in imsg itself. The problem is that IMSG_CTL_RESET does not include an fd while the following messages (IMSG_CFG_RELAY and IMSG_CFG_RELAY_FD) do contain fds. If the receiver gets them in one buffer (via recvmsg), the first fd might be wrongly associated to the IMSG_CTL_RESET message. This is theoretically taken care of by the imsg API, so it is either a bug in relayd's API usage or in imsg itself. "sure" claudio@ as a temporary fix.

Add support for SNI with new "tls keypair" option to load additional certs. Tested by many (thanks!) Feedback & OK rob@

Move the relay keys/certs into a separate global list and look them up by id. Moving the certs out of the relay struct will help to add multiple SNI certs. Tested by many users (thanks!) Feedback & OK rob@

add options to specify the control socket in relayd and relayctl. From Kapetanakis Giannis, thanks. ok claudio@

Change the ecdhe curve configuration to the same way httpd is doing it. This removes 'no ecdh' and renames 'ecdh curve auto' to ecdhe default. The code uses now tls_config_set_ecdhecurves(3) so it is possible to specify multiple curves now. If people specified curves in their config they need to adjust their config now. OK beck@

Use file descriptor passing to load certificates into the relays. Especially the ca file (having all the trusted certs in them) can be so big that loading via imsg fails. OK beck@

Differentiate between a style string not being specified and an empty style string by including NUL in imsg and set the pointer in the struct passed over imsg to NULL in the receiving process to be sure nothing tries to use it. Avoids a crash when specifying an empty style string reported by Karl-Andre' Skevik. ok bluhm@

Migrate relayd to use libtls for TLS. Still does the TLS privsep via the engine but at least we can use a sane API for new features. Going in now so it is possible to work with this in tree. General agreement at d2k17.

The new fork+exec mode used too many fds in the parent process on startup, for a short time, so we needed a rlimit hack in relayd.c. Sync the fix from httpd: rzalamena@ has fixed proc.c and I added the proc_flush_imsg() mechanism that makes sure that each fd is immediately closed after forwarding it to a child process instead of queueing it up. OK rzalamena@ jca@ benno@

Split "struct relayd" into two structs: "struct relayd" and "struct relayd_config". This way we can send all the relevant global configuration to the children, not just the flags and the opts. With input from and OK claudio@ benno@

As done in httpd, (re-)initialize ps_what in all processes. This is no functional change at this point.

Switch from the not really working session cache (because of the multiprocess nature of relayd) to tls session tickets to do TLS session resumption. TLS session tickets do not need to store SSL session data in the server but instead send an encrypted ticket to the clients that allows to resume the session. This is mostly stateless (apart from the encryption keys). relayd now ensures that all relay processes use the same key to encrypt the tickets. Keys are rotated every 2h and there is a primary and backup key. The tls session timeout is set to 2h to hint to the clients how long the session tickets is supposed to be alive. Input and OK benno@, reyk@

Remove NULL-checks before free(). No functional change.