Release 2.20.0

- [FEATURE] QUIC and HTTP/3 Internet Draft 30 support.
- [FEATURE] Unreliable Datagram Extension support.
- [FEATURE] Adaptive congestion controller.
- [BUGFIX] Do not send MAX_STREAM_DATA frames on crypto streams.
- [BUGFIX] Fail with CRYPTO_BUFFER_EXCEEDED when too much CRYPTO
  data comes in.
- [BUFFIX] Spin bit is now strictly per path; value is reset on
  DCID change.
- [BUGFIX] Check that max value of max_streams_uni and
  max_streams_bidi TPs is 2^60.
- [BUGFIX] Close IETF mini conn immediately if crypto session
  cannot be initialized.
- Deprecate ID-28 (no browser uses it): it's no longer in the
  default versions list.
- New programs duck_server and duck_client that implement the
  experimental siduck-00 protocol.  They quack!
- IETF crypto streams: don't limit ourselves from sending.
- Command-line programs: turn off QL loss bits if -G is used, as
  Wireshark cannot decrypt QUIC packets when this extension is used.
- Turn all h3 framing unit tests back on.
- Fix malo initialization when compiled in no-pool mode.

bin/test_cert.c

@@ -17,15 +17,36 @@
 #include "test_cert.h"
 
 
+static char s_alpn[0x100];
+
+int
+add_alpn (const char *alpn)
+{
+    size_t alpn_len, all_len;
+
+    alpn_len = strlen(alpn);
+    if (alpn_len > 255)
+        return -1;
+
+    all_len = strlen(s_alpn);
+    if (all_len + 1 + alpn_len + 1 > sizeof(s_alpn))
+        return -1;
+
+    s_alpn[all_len] = alpn_len;
+    memcpy(&s_alpn[all_len + 1], alpn, alpn_len);
+    s_alpn[all_len + 1 + alpn_len] = '\0';
+    return 0;
+}
+
+
 static int
 select_alpn (SSL *ssl, const unsigned char **out, unsigned char *outlen,
                     const unsigned char *in, unsigned int inlen, void *arg)
 {
-    const unsigned char alpn[] = "\x5h3-27\x5h3-28\x5h3-29";
     int r;
 
     r = SSL_select_next_proto((unsigned char **) out, outlen, in, inlen,
-                                                            alpn, sizeof(alpn));
+                                    (unsigned char *) s_alpn, strlen(s_alpn));
     if (r == OPENSSL_NPN_NEGOTIATED)
         return SSL_TLSEXT_ERR_OK;
     else