Set SSL_OP_LEGACY_SERVER_CONNECT when peeking at servers

[rousskov]

Squid TLS Server Hello parser does not treat legacy servers specially,
but enabling legacy server support in OpenSSL allows OpenSSL to advance
enough in its Server Hello processing to provide SslBump code with the
server certificate (that Squid then validates). Successful certificate
validation, in turn, may result in Squid splicing the connection, even
if OpenSSL detected other errors:

noteNegotiationError: hold TLS write on FD 15 despite
SQUID_TLS_ERR_CONNECT+TLS_LIB_ERR=2000068+TLS_IO_ERR=1

This change assumes that admins should not expect a peeking Squid to
automatically enforce a particular set of handshake conditions (e.g.,
"no legacy TLS servers"). Peeking is interpreted as "get as much
handshake information as possible without breaking things" rather than
"automatically validate handshake, even if it risks breaking things". A
peeking Squid still validates the received origin certificate (where
available). If that assumption is proven wrong, we will need to make the
choice configurable.

TODO: When staring, apply tls_outgoing_options.

[rousskov]

Equivalent v5-based changes were successfully tested in production.

There is a mailing list thread related to this PR at https://lists.squid-cache.org/pipermail/squid-users/2024-June/026732.html.

[yadij]

There is a CVE involved here, so while this appears "safe enough" at casual reading, I believe we would be better overall implementing more restricted support - that would be good also for the stare case, not just peek.

Which is https://www.rfc-editor.org/rfc/rfc5746 section 3.4 :

   o  The client MUST include either an empty "renegotiation_info"
      extension, or the TLS_EMPTY_RENEGOTIATION_INFO_SCSV signaling
      cipher suite value in the ClientHello.  Including both is NOT
      RECOMMENDED.

... so if both of those are absent from details we can safely set SSL_OP_LEGACY_SERVER_CONNECT. Otherwise leave OpenSSL doing its default thing, the client wants whatever validation it can get.

Also, consider doing this in applyTlsDetailsToSSL() with the other client feature pass-thru.