Move DTLS change cipher spec handling to its own function.

When a TLSv1.2 change cipher spec message has been built, call a separate
function that can handle the DTLS specific processing rather than including
this in the TLS code.

ok kenjiro@ tb@

4 files changed, 22 insertions, 14 deletions

diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index 0a0a80dad9..1e87d9e652 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_both.c,v 1.95 2026/06/06 15:22:25 jsing Exp $ */
+/* $OpenBSD: d1_both.c,v 1.96 2026/06/06 15:24:26 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -1164,6 +1164,19 @@ dtls1_get_message_header(CBS *header, struct hm_header_st *msg_hdr)
 }
 
 int
+dtls12_ccs_built(SSL *s)
+{
+        s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
+
+        dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
+            s->d1->handshake_write_seq, 0, 0);
+
+        dtls1_buffer_message(s, 1);
+
+        return 1;
+}
+
+int
 dtls12_handshake_msg_built(SSL *s)
 {
         unsigned long len;
diff --git a/src/lib/libssl/dtls_local.h b/src/lib/libssl/dtls_local.h
index 9da48d1739..9939928b38 100644
--- a/src/lib/libssl/dtls_local.h
+++ b/src/lib/libssl/dtls_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dtls_local.h,v 1.7 2026/06/06 15:22:25 jsing Exp $ */
+/* $OpenBSD: dtls_local.h,v 1.8 2026/06/06 15:24:26 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -222,6 +222,7 @@ long dtls1_ctrl(SSL *s, int cmd, long larg, void *parg);
 int dtls1_get_message(SSL *s, int st1, int stn, int mt, long max);
 int dtls1_get_record(SSL *s);
 
+int dtls12_ccs_built(SSL *s);
 int dtls12_handshake_msg_built(SSL *s);
 __END_HIDDEN_DECLS
 
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index b59ffa0eff..c7db7257b5 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.172 2026/05/31 14:34:44 jsing Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.173 2026/06/06 15:24:26 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2258,11 +2258,8 @@ ssl3_send_client_change_cipher_spec(SSL *s)
                 s->init_off = 0;
 
                 if (SSL_is_dtls(s)) {
-                        s->d1->handshake_write_seq =
-                            s->d1->next_handshake_write_seq;
-                        dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
-                            s->d1->handshake_write_seq, 0, 0);
-                        dtls1_buffer_message(s, 1);
+                        if (!dtls12_ccs_built(s))
+                                goto err;
                 }
 
                 s->s3->hs.state = SSL3_ST_CW_CHANGE_B;
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index f9c4ef918a..73bdeacce0 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.169 2026/05/31 14:34:44 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.170 2026/06/06 15:24:26 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2321,11 +2321,8 @@ ssl3_send_server_change_cipher_spec(SSL *s)
                 s->init_off = 0;
 
                 if (SSL_is_dtls(s)) {
-                        s->d1->handshake_write_seq =
-                            s->d1->next_handshake_write_seq;
-                        dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
-                            s->d1->handshake_write_seq, 0, 0);
-                        dtls1_buffer_message(s, 1);
+                        if (!dtls12_ccs_built(s))
+                                goto err;
                 }
 
                 s->s3->hs.state = SSL3_ST_SW_CHANGE_B;