6 files changed, 363 insertions, 77 deletions

diff --git a/src/lib/libssl/Makefile b/src/lib/libssl/Makefile
index 7e423b0b43..0d5934508a 100644
--- a/src/lib/libssl/Makefile
+++ b/src/lib/libssl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.86 2026/04/03 07:26:20 jsing Exp $
+# $OpenBSD: Makefile,v 1.87 2026/05/16 08:20:41 jsing Exp $
 
 .include <bsd.own.mk>
 .ifndef NOMAN
@@ -43,6 +43,7 @@ SRCS= \
         d1_lib.c \
         d1_pkt.c \
         d1_srtp.c \
+        dtls12_handshake_msg.c \
         pqueue.c \
         s3_cbc.c \
         s3_lib.c \
diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index de915fa4b2..2af307f594 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_both.c,v 1.93 2026/05/06 15:06:35 jsing Exp $ */
+/* $OpenBSD: d1_both.c,v 1.94 2026/05/16 08:20:41 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -205,12 +205,48 @@ dtls1_hm_fragment_free(hm_fragment *frag)
 }
 
 static int
+dtls12_create_handshake_msg(SSL *s)
+{
+        CBB cbb;
+
+        OPENSSL_assert(s->init_off == 0);
+        OPENSSL_assert(s->init_num == (int)s->d1->w_msg_hdr.msg_len +
+            DTLS1_HM_HEADER_LENGTH);
+
+        /* Skip over the existing header. */
+        s->init_off += DTLS1_HM_HEADER_LENGTH;
+        s->init_num -= DTLS1_HM_HEADER_LENGTH;
+
+        if (s->d1->hs_msg != NULL)
+                goto err;
+
+        if ((s->d1->hs_msg = dtls12_handshake_msg_new()) == NULL)
+                goto err;
+        if (!dtls12_handshake_msg_start(s->d1->hs_msg, &cbb,
+            s->d1->w_msg_hdr.type, s->d1->w_msg_hdr.seq))
+                goto err;
+        if (!CBB_add_bytes(&cbb, &s->init_buf->data[s->init_off],
+            s->init_num))
+                goto err;
+        if (!dtls12_handshake_msg_finish(s->d1->hs_msg))
+                goto err;
+
+        return 1;
+
+ err:
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+        s->d1->hs_msg = NULL;
+
+        return 0;
+}
+
+static int
 dtls1_do_write_handshake_message(SSL *s)
 {
-        int ret;
-        int curr_mtu;
-        unsigned int len, frag_off;
+        int curr_mtu, written;
         size_t overhead;
+        CBS cbs;
+        int ret;
 
         /* AHA!  Figure out the MTU, and stick to the right size */
         if (s->d1->mtu < dtls1_min_mtu() &&
@@ -234,15 +270,15 @@ dtls1_do_write_handshake_message(SSL *s)
         OPENSSL_assert(s->d1->mtu >= dtls1_min_mtu());
         /* should have something reasonable now */
 
-        if (s->init_off == 0)
-                OPENSSL_assert(s->init_num ==
-                    (int)s->d1->w_msg_hdr.msg_len + DTLS1_HM_HEADER_LENGTH);
+        if (s->d1->hs_msg == NULL) {
+                if (!dtls12_create_handshake_msg(s))
+                        return -1;
+        }
 
         if (!tls12_record_layer_write_overhead(s->rl, &overhead))
                 return -1;
 
-        frag_off = 0;
-        while (s->init_num > 0) {
+        do {
                 curr_mtu = s->d1->mtu - BIO_wpending(SSL_get_wbio(s)) -
                     DTLS1_RT_HEADER_LENGTH - overhead;
 
@@ -255,35 +291,14 @@ dtls1_do_write_handshake_message(SSL *s)
                             overhead;
                 }
 
-                if (s->init_num > curr_mtu)
-                        len = curr_mtu;
-                else
-                        len = s->init_num;
-
-                if (s->init_off != 0) {
-                        OPENSSL_assert(s->init_off > DTLS1_HM_HEADER_LENGTH);
-                        s->init_off -= DTLS1_HM_HEADER_LENGTH;
-                        s->init_num += DTLS1_HM_HEADER_LENGTH;
-
-                        if (s->init_num > curr_mtu)
-                                len = curr_mtu;
-                        else
-                                len = s->init_num;
-                }
-
-                OPENSSL_assert(len >= DTLS1_HM_HEADER_LENGTH);
-
-                s->d1->w_msg_hdr.frag_off = frag_off;
-                s->d1->w_msg_hdr.frag_len = len - DTLS1_HM_HEADER_LENGTH;
+                OPENSSL_assert(curr_mtu >= DTLS1_HM_HEADER_LENGTH);
 
-                if (!dtls1_write_message_header(&s->d1->w_msg_hdr,
-                    s->d1->w_msg_hdr.frag_off, s->d1->w_msg_hdr.frag_len,
-                    (unsigned char *)&s->init_buf->data[s->init_off]))
+                if (!dtls12_handshake_msg_fragment_build(s->d1->hs_msg,
+                    curr_mtu - DTLS1_HM_HEADER_LENGTH, &cbs))
                         return -1;
 
-                ret = dtls1_write_bytes(s, SSL3_RT_HANDSHAKE,
-                    &s->init_buf->data[s->init_off], len);
-                if (ret < 0) {
+                if ((written = dtls1_write_bytes(s, SSL3_RT_HANDSHAKE,
+                    CBS_data(&cbs), CBS_len(&cbs))) < 0) {
                         /*
                          * Might need to update MTU here, but we don't know
                          * which previous packet caused the failure -- so
@@ -293,7 +308,7 @@ dtls1_do_write_handshake_message(SSL *s)
                          */
                         if (BIO_ctrl(SSL_get_wbio(s),
                             BIO_CTRL_DGRAM_MTU_EXCEEDED, 0, NULL) <= 0)
-                                return (-1);
+                                return -1;
 
                         s->d1->mtu = BIO_ctrl(SSL_get_wbio(s),
                             BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
@@ -306,49 +321,34 @@ dtls1_do_write_handshake_message(SSL *s)
                  * handshake message got sent.  but why would
                  * this happen?
                  */
-                OPENSSL_assert(len == (unsigned int)ret);
+                OPENSSL_assert(CBS_len(&cbs) == (size_t)written);
 
-                if (!s->d1->retransmitting) {
-                        /*
-                         * Should not be done for 'Hello Request's,
-                         * but in that case we'll ignore the result
-                         * anyway
-                         */
-                        unsigned char *p = (unsigned char *)&s->init_buf->data[s->init_off];
-                        const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
-                        int xlen;
-
-                        if (frag_off == 0) {
-                                /*
-                                 * Reconstruct message header is if it
-                                 * is being sent in single fragment
-                                 */
-                                if (!dtls1_write_message_header(msg_hdr,
-                                    0, msg_hdr->msg_len, p))
-                                        return (-1);
-                                xlen = ret;
-                        } else {
-                                p += DTLS1_HM_HEADER_LENGTH;
-                                xlen = ret - DTLS1_HM_HEADER_LENGTH;
-                        }
-
-                        tls1_transcript_record(s, p, xlen);
-                }
+                if (!dtls12_handshake_msg_fragment_next(s->d1->hs_msg))
+                        return -1;
 
-                if (ret == s->init_num) {
-                        ssl_msg_callback(s, 1, SSL3_RT_HANDSHAKE,
-                            s->init_buf->data, s->init_off + s->init_num);
+        } while (dtls12_handshake_msg_fragment_pending(s->d1->hs_msg));
 
-                        s->init_off = 0;
-                        s->init_num = 0;
+        dtls12_handshake_msg_data(s->d1->hs_msg, &cbs);
 
-                        return (1);
-                }
-                s->init_off += ret;
-                s->init_num -= ret;
-                frag_off += (ret -= DTLS1_HM_HEADER_LENGTH);
+        if (!s->d1->retransmitting) {
+                /*
+                 * The TLS transcript is based on each handshake message being
+                 * sent as a single fragment - see RFC 6347 section 4.2.6. This
+                 * should not be called for a HelloRequest, however the result
+                 * will be ignored.
+                 */
+                tls1_transcript_record(s, CBS_data(&cbs), CBS_len(&cbs));
         }
-        return (0);
+
+        ssl_msg_callback(s, 1, SSL3_RT_HANDSHAKE, CBS_data(&cbs), CBS_len(&cbs));
+
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+        s->d1->hs_msg = NULL;
+
+        s->init_off = 0;
+        s->init_num = 0;
+
+        return 1;
 }
 
 static int
diff --git a/src/lib/libssl/d1_lib.c b/src/lib/libssl/d1_lib.c
index 69db8a0df4..fa546b381c 100644
--- a/src/lib/libssl/d1_lib.c
+++ b/src/lib/libssl/d1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: d1_lib.c,v 1.65 2024/07/23 14:40:53 jsing Exp $ */
+/* $OpenBSD: d1_lib.c,v 1.66 2026/05/16 08:20:41 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -179,6 +179,8 @@ dtls1_free(SSL *s)
         pqueue_free(s->d1->sent_messages);
         pqueue_free(s->d1->buffered_app_data.q);
 
+        dtls12_handshake_msg_free(s->d1->hs_msg);
+
         freezero(s->d1, sizeof(*s->d1));
         s->d1 = NULL;
 }
@@ -199,6 +201,9 @@ dtls1_clear(SSL *s)
                 buffered_app_data = s->d1->buffered_app_data.q;
                 mtu = s->d1->mtu;
 
+                dtls12_handshake_msg_free(s->d1->hs_msg);
+                s->d1->hs_msg = NULL;
+
                 dtls1_clear_queues(s);
 
                 memset(s->d1, 0, sizeof(*s->d1));
diff --git a/src/lib/libssl/dtls12_handshake_msg.c b/src/lib/libssl/dtls12_handshake_msg.c
new file mode 100644
index 0000000000..7874aa8598
--- /dev/null
+++ b/src/lib/libssl/dtls12_handshake_msg.c
@@ -0,0 +1,231 @@
+/* $OpenBSD: dtls12_handshake_msg.c,v 1.1 2026/05/16 08:20:41 jsing Exp $ */
+/*
+ * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "bytestring.h"
+#include "dtls12_internal.h"
+
+#define DTLS12_HANDSHAKE_MSG_HEADER_LEN                 12
+#define DTLS12_HANDSHAKE_MSG_INITIAL_LEN                256
+
+#define DTLS12_HANDSHAKE_MSG_FRAGMENT_LENGTH_OFFSET     9
+
+struct dtls12_handshake_msg {
+        uint8_t msg_type;
+        uint32_t msg_len;
+        uint16_t msg_seq;
+
+        uint32_t fragment_offset;
+        uint32_t fragment_len;
+        uint8_t *fragment_data;
+        size_t fragment_data_len;
+        int fragment_pending;
+
+        uint8_t *data;
+        size_t data_len;
+
+        CBS cbs;
+        CBB cbb;
+};
+
+struct dtls12_handshake_msg *
+dtls12_handshake_msg_new(void)
+{
+        struct dtls12_handshake_msg *msg = NULL;
+
+        if ((msg = calloc(1, sizeof(struct dtls12_handshake_msg))) == NULL)
+                return NULL;
+
+        return msg;
+}
+
+void
+dtls12_handshake_msg_free(struct dtls12_handshake_msg *msg)
+{
+        if (msg == NULL)
+                return;
+
+        CBB_cleanup(&msg->cbb);
+
+        freezero(msg->data, msg->data_len);
+        freezero(msg->fragment_data, msg->fragment_data_len);
+
+        freezero(msg, sizeof(struct dtls12_handshake_msg));
+}
+
+void
+dtls12_handshake_msg_data(struct dtls12_handshake_msg *msg, CBS *cbs)
+{
+        CBS_init(cbs, msg->data, msg->data_len);
+}
+
+uint8_t
+dtls12_handshake_msg_type(struct dtls12_handshake_msg *msg)
+{
+        return msg->msg_type;
+}
+
+int
+dtls12_handshake_msg_content(struct dtls12_handshake_msg *msg, CBS *cbs)
+{
+        dtls12_handshake_msg_data(msg, cbs);
+
+        return CBS_skip(cbs, DTLS12_HANDSHAKE_MSG_HEADER_LEN);
+}
+
+int
+dtls12_handshake_msg_start(struct dtls12_handshake_msg *msg, CBB *body,
+    uint8_t msg_type, size_t msg_seq)
+{
+        msg->msg_type = msg_type;
+        msg->msg_seq = msg_seq;
+
+        msg->msg_len = 0;
+        msg->fragment_offset = 0;
+
+        if (!CBB_init(&msg->cbb, DTLS12_HANDSHAKE_MSG_INITIAL_LEN))
+                return 0;
+        if (!CBB_add_u8(&msg->cbb, msg->msg_type))
+                return 0;
+        if (!CBB_add_u24(&msg->cbb, msg->msg_len))
+                return 0;
+        if (!CBB_add_u16(&msg->cbb, msg->msg_seq))
+                return 0;
+        if (!CBB_add_u24(&msg->cbb, msg->fragment_offset))
+                return 0;
+        if (!CBB_add_u24_length_prefixed(&msg->cbb, body))
+                return 0;
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_finish(struct dtls12_handshake_msg *msg)
+{
+        CBS cbs;
+
+        if (!CBB_finish(&msg->cbb, &msg->data, &msg->data_len))
+                return 0;
+
+        /* Update message length to match fragment length. */
+        CBS_init(&cbs, msg->data, msg->data_len);
+        if (!CBS_skip(&cbs, DTLS12_HANDSHAKE_MSG_FRAGMENT_LENGTH_OFFSET))
+                return 0;
+        if (!CBS_get_u24(&cbs, &msg->msg_len))
+                return 0;
+
+        if (!CBB_init_fixed(&msg->cbb, msg->data, msg->data_len))
+                return 0;
+        if (!CBB_add_u8(&msg->cbb, msg->msg_type))
+                return 0;
+        if (!CBB_add_u24(&msg->cbb, msg->msg_len))
+                return 0;
+        if (!CBB_finish(&msg->cbb, NULL, NULL))
+                return 0;
+
+        dtls12_handshake_msg_fragment_reset(msg);
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_fragment_reset(struct dtls12_handshake_msg *msg)
+{
+        freezero(msg->fragment_data, msg->fragment_data_len);
+        msg->fragment_data = NULL;
+        msg->fragment_data_len = 0;
+
+        msg->fragment_offset = 0;
+        msg->fragment_pending = 1;
+
+        return dtls12_handshake_msg_content(msg, &msg->cbs);
+}
+
+int
+dtls12_handshake_msg_fragment_build(struct dtls12_handshake_msg *msg,
+    size_t max_fragment_len, CBS *cbs)
+{
+        CBB body;
+
+        CBS_init(cbs, NULL, 0);
+
+        if (msg->fragment_offset > msg->msg_len)
+                return 0;
+        if (msg->msg_len - msg->fragment_offset > CBS_len(&msg->cbs))
+                return 0;
+
+        freezero(msg->fragment_data, msg->fragment_data_len);
+        msg->fragment_data = NULL;
+        msg->fragment_data_len = 0;
+
+        if ((msg->fragment_len = CBS_len(&msg->cbs)) > max_fragment_len)
+                msg->fragment_len = max_fragment_len;
+
+        /* Build the fragment. */
+        if (!CBB_init(&msg->cbb, DTLS12_HANDSHAKE_MSG_INITIAL_LEN))
+                goto err;
+        if (!CBB_add_u8(&msg->cbb, msg->msg_type))
+                goto err;
+        if (!CBB_add_u24(&msg->cbb, msg->msg_len))
+                goto err;
+        if (!CBB_add_u16(&msg->cbb, msg->msg_seq))
+                goto err;
+        if (!CBB_add_u24(&msg->cbb, msg->fragment_offset))
+                goto err;
+        if (!CBB_add_u24_length_prefixed(&msg->cbb, &body))
+                goto err;
+        if (!CBB_add_bytes(&body, CBS_data(&msg->cbs), msg->fragment_len))
+                goto err;
+        if (!CBB_finish(&msg->cbb, &msg->fragment_data, &msg->fragment_data_len))
+                goto err;
+
+        CBS_init(cbs, msg->fragment_data, msg->fragment_data_len);
+
+        return 1;
+
+ err:
+        CBB_cleanup(&msg->cbb);
+
+        return 0;
+}
+
+int
+dtls12_handshake_msg_fragment_next(struct dtls12_handshake_msg *msg)
+{
+        if (msg->fragment_offset > msg->msg_len)
+                return 0;
+        if (msg->msg_len - msg->fragment_offset < msg->fragment_len)
+                return 0;
+
+        if (!CBS_skip(&msg->cbs, msg->fragment_len))
+                return 0;
+
+        msg->fragment_offset += msg->fragment_len;
+
+        msg->fragment_pending = (CBS_len(&msg->cbs) > 0);
+
+        return 1;
+}
+
+int
+dtls12_handshake_msg_fragment_pending(struct dtls12_handshake_msg *msg)
+{
+        return msg->fragment_pending;
+}
diff --git a/src/lib/libssl/dtls12_internal.h b/src/lib/libssl/dtls12_internal.h
new file mode 100644
index 0000000000..f3fa9b7490
--- /dev/null
+++ b/src/lib/libssl/dtls12_internal.h
@@ -0,0 +1,46 @@
+/* $OpenBSD: dtls12_internal.h,v 1.1 2026/05/16 08:20:41 jsing Exp $ */
+/*
+ * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_DTLS12_INTERNAL_H
+#define HEADER_DTLS12_INTERNAL_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "bytestring.h"
+
+__BEGIN_HIDDEN_DECLS
+
+struct dtls12_handshake_msg;
+
+struct dtls12_handshake_msg *dtls12_handshake_msg_new(void);
+void dtls12_handshake_msg_free(struct dtls12_handshake_msg *msg);
+void dtls12_handshake_msg_data(struct dtls12_handshake_msg *msg, CBS *cbs);
+uint8_t dtls12_handshake_msg_type(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_content(struct dtls12_handshake_msg *msg, CBS *cbs);
+int dtls12_handshake_msg_start(struct dtls12_handshake_msg *msg, CBB *body,
+    uint8_t msg_type, size_t msg_seq);
+int dtls12_handshake_msg_finish(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_fragment_build(struct dtls12_handshake_msg *msg,
+    size_t max_fragment_len, CBS *cbs);
+int dtls12_handshake_msg_fragment_next(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_fragment_pending(struct dtls12_handshake_msg *msg);
+int dtls12_handshake_msg_fragment_reset(struct dtls12_handshake_msg *msg);
+
+__END_HIDDEN_DECLS
+
+#endif
diff --git a/src/lib/libssl/dtls_local.h b/src/lib/libssl/dtls_local.h
index 5a85bba607..8691663eb3 100644
--- a/src/lib/libssl/dtls_local.h
+++ b/src/lib/libssl/dtls_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dtls_local.h,v 1.4 2026/05/06 15:06:35 jsing Exp $ */
+/* $OpenBSD: dtls_local.h,v 1.5 2026/05/16 08:20:41 jsing Exp $ */
 /*
  * DTLS implementation written by Nagendra Modadugu
  * (nagendra@cs.stanford.edu) for the OpenSSL project 2005.
@@ -65,6 +65,7 @@
 #include <openssl/dtls1.h>
 
 #include "ssl_local.h"
+#include "dtls12_internal.h"
 #include "tls_content.h"
 
 __BEGIN_HIDDEN_DECLS
@@ -179,6 +180,8 @@ struct dtls1_state_st {
 
         unsigned int retransmitting;
         unsigned int change_cipher_spec_ok;
+
+        struct dtls12_handshake_msg *hs_msg;
 };
 
 int dtls1_do_write(SSL *s, int type);