Tighten session ticket handling

Tighten client-side session ticket handling during renegotiation:
ensure that the client only accepts a session ticket if the server sends
the extension anew in the ServerHello. Previously, a TLS client would
reuse the old extension state and thus accept a session ticket if one was
announced in the initial ServerHello.

Patch-by: Emilia Kasper <emilia@openssl.org>
Use only unsigned arithmetic in constant-time operations

Based on a patch by: Samuel Neves <sneves@dei.uc.pt>
Fix freeing of a garbage pointer in ec_wNAF_mul()
Correct timestamp output when clock_precision_digits > 0

Found by Michal Bozon.
Fix cross reference table generator.

If the hash or public key algorithm is "undef" the signature type
will receive special handling and shouldn't be included in the
cross reference table.

Patch by: Dr. Stephen Henson <steve@openssl.org>
Reset s->tlsext_ticket_expected in ssl_scan_serverhello_tlsext.

This ensures that it's zeroed even if the SSL object is reused
(as in ssltest.c). It also ensures that it applies to DTLS, too.

Patch by: Emilia Kasper <emilia@openssl.org>
Ensure SSL3_FLAGS_CCS_OK (or d1->change_cipher_spec_ok for DTLS) is reset

once the ChangeCipherSpec message is received. Previously, the server would
set the flag once at SSL3_ST_SR_CERT_VRFY and again at SSL3_ST_SR_FINISHED.
This would allow a second CCS to arrive and would corrupt the server state.

(Because the first CCS would latch the correct keys and subsequent CCS
messages would have to be encrypted, a MitM attacker cannot exploit this,
though.)

Thanks to Joeri de Ruiter for reporting this issue.

Patch by: Emilia Kasper <emilia@openssl.org>
Do not resume a session if the negotiated protocol version does not
match the session's version (server).

See also BoringSSL's commit bdf5e72f50e25f0e45e825c156168766d8442dde.

Patch by: David Benjamin <davidben@chromium.org>
Fixed memory leak due to incorrect freeing of DTLS reassembly bit mask

Patch by: Matt Caswell <matt@openssl.org>
Replace BUF_strndup with strndup, and finally remove all openssl BUF_str* functions
Avoid a NULL pointer dereference that can be triggered by
SSL3_RT_HANDSHAKE replays.

Reported by Markus Stenberg <markus.stenberg at iki.fi> - thanks!
Patch by: Joel Sing
Avoid a NULL dereference in the DTLS client that can be triggered by a
crafted server response used in conjunction with an anonymous DH or
anonymous ECDH ciphersuite.

Fixes CVE-2014-3510.

Reported by Felix Groebert of the Google Security Team.