More KNF.
Be selective as to when ChangeCipherSpec messages will be accepted.
Without this an early ChangeCipherSpec message would result in session
keys being generated, along with the Finished hash for the handshake,
using an empty master secret.

For a detailed analysis see:

  https://www.imperialviolet.org/2014/06/05/earlyccs.html

This is a fix for CVE-2014-0224, from OpenSSL.

This issue was reported to OpenSSL by KIKUCHI Masashi. Unfortunately the
recent OpenSSL commit was the first we were made aware of the issue.

ok deraadt@ sthen@
Ensure that we do not process a ChangeCipherSpec with an empty master
secret. This is an additional safeguard against early ChangeCipherSpec
handling.

From OpenSSL.

ok deraadt@
ssl_sess_cert_new() can return NULL. Fix two cases where the return value
is unchecked, which would result in a later null pointer dereference.

While here, RSA_free, DH_free and EC_KEY_free all have implicit NULL
checks, so avoid repeating them here.

ok beck@
fix type string conversion warning

ASN1_STRING_data returns an unsigned char *, but strlcat's second
parameter is a const char *
remove unused static datastructures

Neither of these is used anywhere within their object files.
Check output of write() to stdout
add missing stdint. include for uint32_t, etc.
replace malloc(strlen())/strlcpy with strdup

 It is strange to use the size of the source buffer to copy to dest,
 even if it is correct based on the malloc call above.
remove typecasts on password_callback

Rather than casting password_callback to the correct function pointer
signature at every call site, change it to match the signature instead.