More KNF.
Be selective as to when ChangeCipherSpec messages will be accepted.
Without this an early ChangeCipherSpec message would result in session
keys being generated, along with the Finished hash for the handshake,
using an empty master secret.

For a detailed analysis see:

  https://www.imperialviolet.org/2014/06/05/earlyccs.html

This is a fix for CVE-2014-0224, from OpenSSL.

This issue was reported to OpenSSL by KIKUCHI Masashi. Unfortunately the
recent OpenSSL commit was the first we were made aware of the issue.

ok deraadt@ sthen@
Ensure that we do not process a ChangeCipherSpec with an empty master
secret. This is an additional safeguard against early ChangeCipherSpec
handling.

From OpenSSL.

ok deraadt@
ssl_sess_cert_new() can return NULL. Fix two cases where the return value
is unchecked, which would result in a later null pointer dereference.

While here, RSA_free, DH_free and EC_KEY_free all have implicit NULL
checks, so avoid repeating them here.

ok beck@
Avoid a buffer overflow that can be triggered by sending specially crafted
DTLS fragments.

Fix for CVE-2014-0195, from OpenSSL.

Reported to OpenSSL by Juri Aedla.

ok deraadt@ beck@
Ensure that sess_cert is not NULL before trying to use it.

Fixes CVE-2014-3470, from OpenSSL.

ok deraadt@
Do not recurse when a 'Hello Request' message is received while getting
DTLS fragments. A stream of 'Hello Request' messages will result in
infinite recursion, eventually crashing the DTLS client or server.

Fixes CVE-2014-0221, from OpenSSL.

Reported to OpenSSL by Imre Rad.
s/assember/assembler/ before someone gets offended.  At the last
hackathon, just saying 'ass ember' was enough to start giggles.
Unfortunately far more offensive stuff remains in here...
More KNF.
More KNF.
The DH_free, EC_KEY_free, EVP_PKEY_free and RSA_free functions all have
implicit NULL checks, so there is no point ensuring that the pointer is
non-NULL before calling them.
ssl3_release_{read,write}_buffer() handle being called with NULL buffers,
so do not bother checking before calling.
BIO_free has an implicit NULL check, so do not bother checking for NULL
before calling it.
ssl3_free_digest_list() has its own NULL check.
Remove another NULL check before a BIO_free().
malloc() result does not need a cast.
ok miod
Further clean up of context handling in tls1_change_cipher_state().

Rather than doing a complex dance to figure out if we should reuse the
cipher context and clean it later on, just free it and allocate a new one.
This simplifies the code path, especially in the write case where special
handling is required for DTLS.

Also, calling EVP_CIPHER_CTX_init() for a newly created cipher context is
unnecessary, since EVP_CIPHER_CTX_new() already does this (not to mention
that it was already missing from the write case).
Rename variables to make it clear that these are only used in the export
code. Additionally, these need to be cleaned in the export case.

Based on Adam Langley's chromium patches.
Remove pointless casts - no binary change.
Move the export label initialisation into the export handling code, since
this is the only place where these variables are used.