Add client-side support for cipher negotiation

Add client-side support for cipher negotiation

Based on the 'IV_NCP=2' mechanism described in
http://permalink.gmane.org/gmane.network.openvpn.devel/9385.

This is the first patch of a set that adds support for cipher negotiation.
Follow-up patches will add ways to restrict or disable the mechanism, and
add server-side support.

v2:
 * Account for crypto overhead through struct frame.  This is less
   transparant, but the code has been built to work this way.  The
   previous approach didn't work with TCP mode (or --port-share).
 * Calculate the link-mtu sent in the options string based on the crypto
   parameters specified in the config file (prevents link-mtu warnings in
   older peers when connecting).

v3:
 * Use existing max_int() function, instead of new MAX() macro.
 * Fix typo in comment.
 * Do not regenerate keys if the server sends a second push msg
 * Only push IV_NCP if we're pull-client (and thus can do NCP)

v4:
 * Fix rebase errors (OPT_P_NCP sneaked in, but is not introduced till 4/5,
   and tls_peer_info_ncp_ver() is not needed until 5/5).
 * Don't remove comment about key_id increment behaviour in init.c (but
   still add the extra comments in the .h files).

Signed-off-by: Steffan Karger <steffan@karger.me>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <1467149635-9726-1-git-send-email-steffan@karger.me>
URL: http://article.gmane.org/gmane.network.openvpn.devel/12007
Signed-off-by: Gert Doering <gert@greenie.muc.de>