Introduce and use dtls12_handshake_msg.

Add struct dtls12_handshake_msg and various related functions, which
allow for the construction of DTLS handshake messages and associated
fragments.

Use this on the DTLS write path for sending handshake message fragments.
This means that we no longer modify the init buffer, which also fixes a
bug where the message callback is called with a corrupted handshake
message when multiple fragments have been sent.

We also now correctly track fragment offsets when sending a handshake
message that results in multiple calls to dtls1_do_write_handshake_message().

This is the first step towards further untangling of the write path in
the legacy TLS stack.

ok kenjiro@ tb@

1 files changed, 6 insertions, 1 deletions

diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 69db8a0df4..fa546b381c 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_lib.c,v 1.65 2024/07/23 14:40:53 jsing Exp $ */
+/* $OpenBSD: d1_lib.c,v 1.66 2026/05/16 08:20:41 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -179,6 +179,8 @@ dtls1_free(SSL *s)
         pqueue_free(s->d1->sent_messages);
         pqueue_free(s->d1->buffered_app_data.q);
 
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+
         freezero(s->d1, sizeof(*s->d1));
         s->d1 = NULL;
 }
@@ -199,6 +201,9 @@ dtls1_clear(SSL *s)
                 buffered_app_data = s->d1->buffered_app_data.q;
                 mtu = s->d1->mtu;
 
+                dtls12_handshake_msg_free(s->d1->hs_msg);
+                s->d1->hs_msg = NULL;
+
                 dtls1_clear_queues(s);
 
                 memset(s->d1, 0, sizeof(*s->d1));