Clean up sequence number and message header handling.

dtls1_set_message_header() is only called in one place - inline the write
handshake sequence number handling. Rename dtls1_set_message_header_int()
to dtls1_set_message_header().

The dtls12_write_ccs() code does not use handshake sequence numbers (since
they're not handshake messages) - stop pretending that it does.

ok kenjiro@ tb@

2 files changed, 13 insertions, 26 deletions

diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index d3742cbd12..57390112c9 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_both.c,v 1.97 2026/06/06 15:28:14 jsing Exp $ */
+/* $OpenBSD: d1_both.c,v 1.98 2026/07/16 14:37:21 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -941,7 +941,7 @@ dtls1_retransmit_message(SSL *s, hm_fragment *frag)
             frag->msg_header.msg_len + header_length);
         s->init_num = frag->msg_header.msg_len + header_length;
 
-        dtls1_set_message_header_int(s, frag->msg_header.type,
+        dtls1_set_message_header(s, frag->msg_header.type,
             frag->msg_header.msg_len, frag->msg_header.seq, 0,
             frag->msg_header.frag_len);
 
@@ -1057,21 +1057,6 @@ dtls1_clear_record_buffer(SSL *s)
 
 void
 dtls1_set_message_header(SSL *s, unsigned char mt, unsigned long len,
-    unsigned long frag_off, unsigned long frag_len)
-{
-        /* Don't change sequence numbers while listening */
-        if (frag_off == 0 && !s->d1->listen) {
-                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
-                s->d1->next_handshake_write_seq++;
-        }
-
-        dtls1_set_message_header_int(s, mt, len, s->d1->handshake_write_seq,
-            frag_off, frag_len);
-}
-
-/* don't actually do the writing, wait till the MTU has been retrieved */
-void
-dtls1_set_message_header_int(SSL *s, unsigned char mt, unsigned long len,
     unsigned short seq_num, unsigned long frag_off, unsigned long frag_len)
 {
         struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
@@ -1166,10 +1151,7 @@ dtls1_get_message_header(CBS *header, struct hm_header_st *msg_hdr)
 int
 dtls12_ccs_built(SSL *s)
 {
-        s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
-
-        dtls1_set_message_header_int(s, SSL3_MT_CCS, 0,
-            s->d1->handshake_write_seq, 0, 0);
+        dtls1_set_message_header(s, SSL3_MT_CCS, 0, 0, 0, 0);
 
         if (!dtls1_buffer_message(s, 1))
                 return 0;
@@ -1195,7 +1177,14 @@ dtls12_handshake_msg_built(SSL *s)
 
         len = s->init_num - DTLS1_HM_HEADER_LENGTH;
 
-        dtls1_set_message_header(s, msg_type, len, 0, len);
+        /* Do not change sequence numbers while listening. */
+        if (!s->d1->listen) {
+                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
+                s->d1->next_handshake_write_seq++;
+        }
+
+        dtls1_set_message_header(s, msg_type, len, s->d1->handshake_write_seq,
+            0, len);
 
         if (!dtls1_buffer_message(s, 0))
                 return 0;
diff --git a/src/lib/libssl/dtls_local.h b/src/lib/libssl/dtls_local.h
index 9939928b38..c1ac35055a 100644
--- a/src/lib/libssl/dtls_local.h
+++ b/src/lib/libssl/dtls_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dtls_local.h,v 1.8 2026/06/06 15:24:26 jsing Exp $ */
+/* $OpenBSD: dtls_local.h,v 1.9 2026/07/16 14:37:21 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -186,9 +186,7 @@ struct dtls1_state_st {
 
 int dtls1_do_write(SSL *s, int type);
 int dtls1_read_bytes(SSL *s, int type, unsigned char *buf, int len, int peek);
-void dtls1_set_message_header(SSL *s, unsigned char mt, unsigned long len,
-    unsigned long frag_off, unsigned long frag_len);
-void dtls1_set_message_header_int(SSL *s, unsigned char mt,
+void dtls1_set_message_header(SSL *s, unsigned char mt,
     unsigned long len, unsigned short seq_num, unsigned long frag_off,
     unsigned long frag_len);