Updated libressl to 2.5.1.

2.5.1 - Bug and security fixes, new features, documentation updates

* X509_cmp_time() now passes a malformed GeneralizedTime field as an
  error. Reported by Theofilos Petsios.

* Detect zero-length encrypted session data early, instead of when
  malloc(0) fails or the HMAC check fails. Noted independently by
  jsing@ and Kurt Cancemi.

* Check for and handle failure of HMAC_{Update,Final} or
  EVP_DecryptUpdate().

* Massive update and normalization of manpages, conversion to
  mandoc format. Many pages were rewritten for clarity and accuracy.
  Portable doc links are up-to-date with a new conversion tool.

* Curve25519 Key Exchange support.

* Support for alternate chains for certificate verification.

* Code cleanups, CBS conversions, further unification of DTLS/SSL
  handshake code, further ASN1 macro expansion and removal.

* Private symbol are now hidden in libssl and libcryto.

* Friendly certificate verification error messages in libtls, peer
  verification is now always enabled.

* Added OCSP stapling support to libtls and netcat.

* Added ocspcheck utility to validate a certificate against its OCSP
  responder and save the reply for stapling

* Enhanced regression tests and error handling for libtls.

* Added explicit constant and non-constant time BN functions,
  defaulting to constant time wherever possible.

* Moved many leaked implementation details in public structs behind
  opaque pointers.

* Added ticket support to libtls.

* Added support for setting the supported EC curves via
  SSL{_CTX}_set1_groups{_list}() - also provide defines for the previous
  SSL{_CTX}_set1_curves{_list} names. This also changes the default
  list of curves to be X25519, P-256 and P-384. All other curves must
          be manually enabled.

* Added -groups option to openssl(1) s_client for specifying the curves
          to be used in a colon-separated list.

* Merged client/server version negotiation code paths into one,
  reducing much duplicate code.

* Removed error function codes from libssl and libcrypto.

* Fixed an issue where a truncated packet could crash via an OOB read.

* Added SSL_OP_NO_CLIENT_RENEGOTIATION option that disallows
  client-initiated renegotiation. This is the default for libtls
  servers.

* Avoid a side-channel cache-timing attack that can leak the ECDSA
  private keys when signing. This is due to BN_mod_inverse() being
  used without the constant time flag being set. Reported by Cesar
  Pereida Garcia and Billy Brumley (Tampere University of Technology).
  The fix was developed by Cesar Pereida Garcia.

* iOS and MacOS compatibility updates from Simone Basso and Jacob
  Berkman.

(wiz)