openssl/sme8/openssl-fips-0.9.8e-dtls-fixes.patch

diff -up openssl-fips-0.9.8f-dev/ssl/dtls1.h.dtls-fixes openssl-fips-0.9.8f-dev/ssl/dtls1.h
--- openssl-fips-0.9.8f-dev/ssl/dtls1.h.dtls-fixes      2008-07-15 21:01:29.000000000 +0200
+++ openssl-fips-0.9.8f-dev/ssl/dtls1.h 2008-07-15 21:01:29.000000000 +0200
@@ -67,9 +67,8 @@
 extern "C" {
 #endif
 
-#define DTLS1_VERSION                  0x0100
-#define DTLS1_VERSION_MAJOR            0x01
-#define DTLS1_VERSION_MINOR            0x00
+#define DTLS1_VERSION                  0xFEFF
+#define DTLS1_BAD_VER                  0x0100
 
 #define DTLS1_AD_MISSING_HANDSHAKE_MESSAGE    110
 
@@ -83,7 +82,7 @@ extern "C" {
 #define DTLS1_HM_BAD_FRAGMENT                   -2
 #define DTLS1_HM_FRAGMENT_RETRY                 -3
 
-#define DTLS1_CCS_HEADER_LENGTH                  3
+#define DTLS1_CCS_HEADER_LENGTH                  1
 
 #define DTLS1_AL_HEADER_LENGTH                   7
 
diff -up openssl-fips-0.9.8f-dev/ssl/d1_lib.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/d1_lib.c
--- openssl-fips-0.9.8f-dev/ssl/d1_lib.c.dtls-fixes     2007-01-21 17:07:25.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/d1_lib.c        2008-07-15 21:01:29.000000000 +0200
@@ -188,3 +188,23 @@ void dtls1_clear(SSL *s)
        ssl3_clear(s);
        s->version=DTLS1_VERSION;
        }
+
+/*
+ * As it's impossible to use stream ciphers in "datagram" mode, this
+ * simple filter is designed to disengage them in DTLS. Unfortunately
+ * there is no universal way to identify stream SSL_CIPHER, so we have
+ * to explicitly list their SSL_* codes. Currently RC4 is the only one
+ * available, but if new ones emerge, they will have to be added...
+ */
+SSL_CIPHER *dtls1_get_cipher(unsigned int u)
+       {
+       SSL_CIPHER *ciph = ssl3_get_cipher(u);
+
+       if (ciph != NULL)
+               {
+               if ((ciph->algorithms&SSL_ENC_MASK) == SSL_RC4)
+                       return NULL;
+               }
+
+       return ciph;
+       }
diff -up openssl-fips-0.9.8f-dev/ssl/d1_srvr.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/d1_srvr.c
--- openssl-fips-0.9.8f-dev/ssl/d1_srvr.c.dtls-fixes    2007-09-19 02:02:49.000000000 +0200
+++ openssl-fips-0.9.8f-dev/ssl/d1_srvr.c       2008-07-15 21:01:29.000000000 +0200
@@ -285,6 +285,10 @@ int dtls1_accept(SSL *s)
                        s->d1->send_cookie = 0;
                        s->state=SSL3_ST_SW_FLUSH;
                        s->s3->tmp.next_state=SSL3_ST_SR_CLNT_HELLO_A;
+
+                       /* HelloVerifyRequests resets Finished MAC */
+                       if (s->client_version != DTLS1_BAD_VER)
+                               ssl3_init_finished_mac(s);
                        break;
                        
                case SSL3_ST_SW_SRVR_HELLO_A:
@@ -620,10 +624,13 @@ int dtls1_send_hello_verify_request(SSL 
                buf = (unsigned char *)s->init_buf->data;
 
                msg = p = &(buf[DTLS1_HM_HEADER_LENGTH]);
-               *(p++) = s->version >> 8;
-               *(p++) = s->version & 0xFF;
+               if (s->client_version == DTLS1_BAD_VER)
+                       *(p++) = DTLS1_BAD_VER>>8,
+                       *(p++) = DTLS1_BAD_VER&0xff;
+               else
+                       *(p++) = s->version >> 8,
+                       *(p++) = s->version & 0xFF;
 
-               *(p++) = (unsigned char) s->d1->cookie_len;
         if ( s->ctx->app_gen_cookie_cb != NULL &&
             s->ctx->app_gen_cookie_cb(s, s->d1->cookie, 
                 &(s->d1->cookie_len)) == 0)
@@ -634,6 +641,7 @@ int dtls1_send_hello_verify_request(SSL 
         /* else the cookie is assumed to have 
          * been initialized by the application */
 
+               *(p++) = (unsigned char) s->d1->cookie_len;
                memcpy(p, s->d1->cookie, s->d1->cookie_len);
                p += s->d1->cookie_len;
                msg_len = p - msg;
@@ -672,8 +680,12 @@ int dtls1_send_server_hello(SSL *s)
                /* Do the message type and length last */
                d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);
 
-               *(p++)=s->version>>8;
-               *(p++)=s->version&0xff;
+               if (s->client_version == DTLS1_BAD_VER)
+                       *(p++)=DTLS1_BAD_VER>>8,
+                       *(p++)=DTLS1_BAD_VER&0xff;
+               else
+                       *(p++)=s->version>>8,
+                       *(p++)=s->version&0xff;
 
                /* Random stuff */
                memcpy(p,s->s3->server_random,SSL3_RANDOM_SIZE);
diff -up openssl-fips-0.9.8f-dev/ssl/s3_srvr.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/s3_srvr.c
--- openssl-fips-0.9.8f-dev/ssl/s3_srvr.c.dtls-fixes    2007-03-22 01:39:14.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/s3_srvr.c       2008-07-15 21:01:29.000000000 +0200
@@ -699,7 +699,8 @@ int ssl3_get_client_hello(SSL *s)
        s->client_version=(((int)p[0])<<8)|(int)p[1];
        p+=2;
 
-       if (s->client_version < s->version)
+       if ((s->version == DTLS1_VERSION && s->client_version > s->version) ||
+           (s->version != DTLS1_VERSION && s->client_version < s->version))
                {
                SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO, SSL_R_WRONG_VERSION_NUMBER);
                if ((s->client_version>>8) == SSL3_VERSION_MAJOR) 
@@ -750,7 +751,7 @@ int ssl3_get_client_hello(SSL *s)
 
        p+=j;
 
-       if (SSL_version(s) == DTLS1_VERSION)
+       if (s->version == DTLS1_VERSION)
                {
                /* cookie stuff */
                cookie_len = *(p++);
@@ -1713,8 +1714,9 @@ int ssl3_get_client_key_exchange(SSL *s)
                        rsa=pkey->pkey.rsa;
                        }
 
-               /* TLS */
-               if (s->version > SSL3_VERSION)
+               /* TLS and [incidentally] DTLS, including pre-0.9.8f */
+               if (s->version > SSL3_VERSION &&
+                   s->client_version != DTLS1_BAD_VER)
                        {
                        n2s(p,i);
                        if (n != i+2)
diff -up openssl-fips-0.9.8f-dev/ssl/ssl_locl.h.dtls-fixes openssl-fips-0.9.8f-dev/ssl/ssl_locl.h
--- openssl-fips-0.9.8f-dev/ssl/ssl_locl.h.dtls-fixes   2008-07-15 21:01:29.000000000 +0200
+++ openssl-fips-0.9.8f-dev/ssl/ssl_locl.h      2008-07-15 21:01:29.000000000 +0200
@@ -680,7 +680,7 @@ SSL_METHOD *func_name(void)  \
                ssl3_put_cipher_by_char, \
                ssl3_pending, \
                ssl3_num_ciphers, \
-               ssl3_get_cipher, \
+               dtls1_get_cipher, \
                s_get_meth, \
                dtls1_default_timeout, \
                &DTLSv1_enc_data, \
@@ -845,6 +845,8 @@ void dtls1_get_message_header(unsigned c
 void dtls1_get_ccs_header(unsigned char *data, struct ccs_header_st *ccs_hdr);
 void dtls1_reset_seq_numbers(SSL *s, int rw);
 long dtls1_default_timeout(void);
+SSL_CIPHER *dtls1_get_cipher(unsigned int u);
+
 
 
 /* some client-only functions */
diff -up openssl-fips-0.9.8f-dev/ssl/t1_enc.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/t1_enc.c
--- openssl-fips-0.9.8f-dev/ssl/t1_enc.c.dtls-fixes     2007-03-22 01:39:15.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/t1_enc.c        2008-07-15 21:01:29.000000000 +0200
@@ -740,15 +740,35 @@ int tls1_mac(SSL *ssl, unsigned char *md
        md_size=EVP_MD_size(hash);
 
        buf[0]=rec->type;
-       buf[1]=TLS1_VERSION_MAJOR;
-       buf[2]=TLS1_VERSION_MINOR;
+       if (ssl->version == DTLS1_VERSION && ssl->client_version == DTLS1_BAD_VER)
+               {
+               buf[1]=TLS1_VERSION_MAJOR;
+               buf[2]=TLS1_VERSION_MINOR;
+               }
+       else    {
+               buf[1]=(unsigned char)(ssl->version>>8);
+               buf[2]=(unsigned char)(ssl->version);
+               }
+
        buf[3]=rec->length>>8;
        buf[4]=rec->length&0xff;
 
        /* I should fix this up TLS TLS TLS TLS TLS XXXXXXXX */
        HMAC_CTX_init(&hmac);
        HMAC_Init_ex(&hmac,mac_sec,EVP_MD_size(hash),hash,NULL);
-       HMAC_Update(&hmac,seq,8);
+
+       if (ssl->version == DTLS1_VERSION && ssl->client_version != DTLS1_BAD_VER)
+               {
+               unsigned char dtlsseq[8],*p=dtlsseq;
+
+               s2n(send?ssl->d1->w_epoch:ssl->d1->r_epoch, p);
+               memcpy (p,&seq[2],6);
+
+               HMAC_Update(&hmac,dtlsseq,8);
+               }
+       else
+               HMAC_Update(&hmac,seq,8);
+
        HMAC_Update(&hmac,buf,5);
        HMAC_Update(&hmac,rec->input,rec->length);
        HMAC_Final(&hmac,md,&md_size);
@@ -765,8 +785,8 @@ printf("rec=");
 {unsigned int z; for (z=0; z<rec->length; z++) printf("%02X ",buf[z]); printf("\n"); }
 #endif
 
-    if ( SSL_version(ssl) != DTLS1_VERSION)
-           {
+       if ( SSL_version(ssl) != DTLS1_VERSION)
+               {
                for (i=7; i>=0; i--)
                        {
                        ++seq[i];
diff -up openssl-fips-0.9.8f-dev/ssl/ssl.h.dtls-fixes openssl-fips-0.9.8f-dev/ssl/ssl.h
--- openssl-fips-0.9.8f-dev/ssl/ssl.h.dtls-fixes        2008-07-15 21:01:29.000000000 +0200
+++ openssl-fips-0.9.8f-dev/ssl/ssl.h   2008-07-15 21:01:29.000000000 +0200
@@ -1554,6 +1554,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_F_DTLS1_GET_MESSAGE_FRAGMENT                253
 #define SSL_F_DTLS1_GET_RECORD                          254
 #define SSL_F_DTLS1_OUTPUT_CERT_CHAIN                   255
+#define SSL_F_DTLS1_PREPROCESS_FRAGMENT                         277
 #define SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE          256
 #define SSL_F_DTLS1_PROCESS_RECORD                      257
 #define SSL_F_DTLS1_READ_BYTES                          258
diff -up openssl-fips-0.9.8f-dev/ssl/d1_pkt.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/d1_pkt.c
--- openssl-fips-0.9.8f-dev/ssl/d1_pkt.c.dtls-fixes     2006-11-29 15:45:13.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/d1_pkt.c        2008-07-15 21:01:29.000000000 +0200
@@ -120,6 +120,7 @@
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
 #include <openssl/pqueue.h>
+#include <openssl/rand.h>
 
 static int have_handshake_fragment(SSL *s, int type, unsigned char *buf, 
        int len, int peek);
@@ -486,9 +487,9 @@ int dtls1_get_record(SSL *s)
        SSL3_RECORD *rr;
        SSL_SESSION *sess;
        unsigned char *p;
-       short version;
+       unsigned short version;
        DTLS1_BITMAP *bitmap;
-    unsigned int is_next_epoch;
+       unsigned int is_next_epoch;
 
        rr= &(s->s3->rrec);
        sess=s->session;
@@ -524,7 +525,7 @@ again:
                ssl_minor= *(p++);
                version=(ssl_major<<8)|ssl_minor;
 
-        /* sequence number is 64 bits, with top 2 bytes = epoch */ 
+               /* sequence number is 64 bits, with top 2 bytes = epoch */ 
                n2s(p,rr->epoch);
 
                memcpy(&(s->s3->read_sequence[2]), p, 6);
@@ -535,7 +536,7 @@ again:
                /* Lets check version */
                if (!s->first_packet)
                        {
-                       if (version != s->version)
+                       if (version != s->version && version != DTLS1_BAD_VER)
                                {
                                SSLerr(SSL_F_DTLS1_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
                                /* Send back error using their
@@ -546,7 +547,8 @@ again:
                                }
                        }
 
-               if ((version & 0xff00) != (DTLS1_VERSION & 0xff00))
+               if ((version & 0xff00) != (DTLS1_VERSION & 0xff00) &&
+                   (version & 0xff00) != (DTLS1_BAD_VER & 0xff00))
                        {
                        SSLerr(SSL_F_DTLS1_GET_RECORD,SSL_R_WRONG_VERSION_NUMBER);
                        goto err;
@@ -559,6 +561,7 @@ again:
                        goto f_err;
                        }
 
+               s->client_version = version;
                /* now s->rstate == SSL_ST_READ_BODY */
                }
 
@@ -973,47 +976,40 @@ start:
                }
 
        if (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC)
-        {
-        struct ccs_header_st ccs_hdr;
+               {
+               struct ccs_header_st ccs_hdr;
 
                dtls1_get_ccs_header(rr->data, &ccs_hdr);
 
-               if ( ccs_hdr.seq == s->d1->handshake_read_seq)
+               /* 'Change Cipher Spec' is just a single byte, so we know
+                * exactly what the record payload has to look like */
+               /* XDTLS: check that epoch is consistent */
+               if (    (s->client_version == DTLS1_BAD_VER && rr->length != 3) ||
+                       (s->client_version != DTLS1_BAD_VER && rr->length != DTLS1_CCS_HEADER_LENGTH) || 
+                       (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
                        {
-                       /* 'Change Cipher Spec' is just a single byte, so we know
-                        * exactly what the record payload has to look like */
-                       /* XDTLS: check that epoch is consistent */
-                       if (    (rr->length != DTLS1_CCS_HEADER_LENGTH) || 
-                               (rr->off != 0) || (rr->data[0] != SSL3_MT_CCS))
-                               {
-                               i=SSL_AD_ILLEGAL_PARAMETER;
-                               SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
-                               goto err;
-                               }
-                       
-                       rr->length=0;
-                       
-                       if (s->msg_callback)
-                               s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, 
-                                       rr->data, 1, s, s->msg_callback_arg);
-                       
-                       s->s3->change_cipher_spec=1;
-                       if (!ssl3_do_change_cipher_spec(s))
-                               goto err;
-                       
-                       /* do this whenever CCS is processed */
-                       dtls1_reset_seq_numbers(s, SSL3_CC_READ);
-                       
-                       /* handshake read seq is reset upon handshake completion */
-                       s->d1->handshake_read_seq++;
-                       
-                       goto start;
-                       }
-               else
-                       {
-                       rr->length = 0;
-                       goto start;
+                       i=SSL_AD_ILLEGAL_PARAMETER;
+                       SSLerr(SSL_F_DTLS1_READ_BYTES,SSL_R_BAD_CHANGE_CIPHER_SPEC);
+                       goto err;
                        }
+
+               rr->length=0;
+
+               if (s->msg_callback)
+                       s->msg_callback(0, s->version, SSL3_RT_CHANGE_CIPHER_SPEC, 
+                               rr->data, 1, s, s->msg_callback_arg);
+
+               s->s3->change_cipher_spec=1;
+               if (!ssl3_do_change_cipher_spec(s))
+                       goto err;
+
+               /* do this whenever CCS is processed */
+               dtls1_reset_seq_numbers(s, SSL3_CC_READ);
+
+               if (s->client_version == DTLS1_BAD_VER)
+                       s->d1->handshake_read_seq++;
+
+               goto start;
                }
 
        /* Unexpected handshake message (Client Hello, or protocol violation) */
@@ -1341,8 +1337,12 @@ int do_dtls1_write(SSL *s, int type, con
        *(p++)=type&0xff;
        wr->type=type;
 
-       *(p++)=(s->version>>8);
-       *(p++)=s->version&0xff;
+       if (s->client_version == DTLS1_BAD_VER)
+               *(p++) = DTLS1_BAD_VER>>8,
+               *(p++) = DTLS1_BAD_VER&0xff;
+       else
+               *(p++)=(s->version>>8),
+               *(p++)=s->version&0xff;
 
        /* field where we are to write out packet epoch, seq num and len */
        pseq=p; 
@@ -1397,8 +1397,14 @@ int do_dtls1_write(SSL *s, int type, con
 
 
        /* ssl3_enc can only have an error on read */
-       wr->length += bs;  /* bs != 0 in case of CBC.  The enc fn provides
-                                               * the randomness */ 
+       if (bs) /* bs != 0 in case of CBC */
+               {
+               RAND_pseudo_bytes(p,bs);
+               /* master IV and last CBC residue stand for
+                * the rest of randomness */
+               wr->length += bs;
+               }
+
        s->method->ssl3_enc->enc(s,1);
 
        /* record length after mac and block padding */
diff -up openssl-fips-0.9.8f-dev/ssl/ssl_err.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/ssl_err.c
--- openssl-fips-0.9.8f-dev/ssl/ssl_err.c.dtls-fixes    2006-11-21 21:14:46.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/ssl_err.c       2008-07-15 21:01:29.000000000 +0200
@@ -87,6 +87,7 @@ static ERR_STRING_DATA SSL_str_functs[]=
 {ERR_FUNC(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT),   "DTLS1_GET_MESSAGE_FRAGMENT"},
 {ERR_FUNC(SSL_F_DTLS1_GET_RECORD),     "DTLS1_GET_RECORD"},
 {ERR_FUNC(SSL_F_DTLS1_OUTPUT_CERT_CHAIN),      "DTLS1_OUTPUT_CERT_CHAIN"},
+{ERR_FUNC(SSL_F_DTLS1_PREPROCESS_FRAGMENT),    "DTLS1_PREPROCESS_FRAGMENT"},
 {ERR_FUNC(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE),     "DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE"},
 {ERR_FUNC(SSL_F_DTLS1_PROCESS_RECORD), "DTLS1_PROCESS_RECORD"},
 {ERR_FUNC(SSL_F_DTLS1_READ_BYTES),     "DTLS1_READ_BYTES"},
diff -up openssl-fips-0.9.8f-dev/ssl/s3_clnt.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/s3_clnt.c
--- openssl-fips-0.9.8f-dev/ssl/s3_clnt.c.dtls-fixes    2007-03-22 01:39:14.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/s3_clnt.c       2008-07-15 21:08:43.000000000 +0200
@@ -1847,6 +1847,13 @@ int ssl3_send_client_key_exchange(SSL *s
                        {
                        DH *dh_srvr,*dh_clnt;
 
+                        if (s->session->sess_cert == NULL) 
+                                {
+                                ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
+                                SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+                                goto err;
+                                }
+
                        if (s->session->sess_cert->peer_dh_tmp != NULL)
                                dh_srvr=s->session->sess_cert->peer_dh_tmp;
                        else
diff -up openssl-fips-0.9.8f-dev/ssl/d1_both.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/d1_both.c
--- openssl-fips-0.9.8f-dev/ssl/d1_both.c.dtls-fixes    2007-06-22 14:17:52.000000000 +0200
+++ openssl-fips-0.9.8f-dev/ssl/d1_both.c       2008-07-15 21:01:29.000000000 +0200
@@ -138,38 +138,40 @@ static void dtls1_set_message_header_int
        unsigned long frag_len);
 static int dtls1_retransmit_buffered_messages(SSL *s);
 static long dtls1_get_message_fragment(SSL *s, int st1, int stn, 
-    long max, int *ok);
-static void dtls1_process_handshake_fragment(SSL *s, int frag_len);
+       long max, int *ok);
 
 static hm_fragment *
 dtls1_hm_fragment_new(unsigned long frag_len)
-    {
-    hm_fragment *frag = NULL;
-    unsigned char *buf = NULL;
+       {
+       hm_fragment *frag = NULL;
+       unsigned char *buf = NULL;
 
-    frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
-    if ( frag == NULL)
-        return NULL;
+       frag = (hm_fragment *)OPENSSL_malloc(sizeof(hm_fragment));
+       if ( frag == NULL)
+               return NULL;
 
-    buf = (unsigned char *)OPENSSL_malloc(frag_len 
-        + DTLS1_HM_HEADER_LENGTH);
-    if ( buf == NULL)
-        {
-        OPENSSL_free(frag);
-        return NULL;
-        }
-    
-    frag->fragment = buf;
+       if (frag_len)
+               {
+               buf = (unsigned char *)OPENSSL_malloc(frag_len);
+               if ( buf == NULL)
+                       {
+                       OPENSSL_free(frag);
+                       return NULL;
+                       }
+               }
 
-    return frag;
-    }
+       /* zero length fragment gets zero frag->fragment */
+       frag->fragment = buf;
+
+       return frag;
+       }
 
 static void
 dtls1_hm_fragment_free(hm_fragment *frag)
-    {
-    OPENSSL_free(frag->fragment);
-    OPENSSL_free(frag);
-    }
+       {
+       if (frag->fragment) OPENSSL_free(frag->fragment);
+       OPENSSL_free(frag);
+       }
 
 /* send s->init_buf in records of type 'type' (SSL3_RT_HANDSHAKE or SSL3_RT_CHANGE_CIPHER_SPEC) */
 int dtls1_do_write(SSL *s, int type)
@@ -180,7 +182,7 @@ int dtls1_do_write(SSL *s, int type)
 
        /* AHA!  Figure out the MTU, and stick to the right size */
        if ( ! (SSL_get_options(s) & SSL_OP_NO_QUERY_MTU))
-        {
+               {
                s->d1->mtu = 
                        BIO_ctrl(SSL_get_wbio(s), BIO_CTRL_DGRAM_QUERY_MTU, 0, NULL);
 
@@ -207,7 +209,7 @@ int dtls1_do_write(SSL *s, int type)
                mtu = curr_mtu;
        else if ( ( ret = BIO_flush(SSL_get_wbio(s))) <= 0)
                return ret;
-               
+
        if ( BIO_wpending(SSL_get_wbio(s)) + s->init_num >= mtu)
                {
                ret = BIO_flush(SSL_get_wbio(s));
@@ -254,11 +256,11 @@ int dtls1_do_write(SSL *s, int type)
                                s->init_off -= DTLS1_HM_HEADER_LENGTH;
                                s->init_num += DTLS1_HM_HEADER_LENGTH;
 
-                /* write atleast DTLS1_HM_HEADER_LENGTH bytes */
+                               /* write atleast DTLS1_HM_HEADER_LENGTH bytes */
                                if ( len <= DTLS1_HM_HEADER_LENGTH)  
                                        len += DTLS1_HM_HEADER_LENGTH;
                                }
-                       
+
                        dtls1_fix_message_header(s, frag_off, 
                                len - DTLS1_HM_HEADER_LENGTH);
 
@@ -286,18 +288,40 @@ int dtls1_do_write(SSL *s, int type)
                        }
                else
                        {
-                       
+
                        /* bad if this assert fails, only part of the handshake
                         * message got sent.  but why would this happen? */
-                       OPENSSL_assert(len == (unsigned int)ret); 
-                       
+                       OPENSSL_assert(len == (unsigned int)ret);
+
                        if (type == SSL3_RT_HANDSHAKE && ! s->d1->retransmitting)
+                               {
                                /* should not be done for 'Hello Request's, but in that case
                                 * we'll ignore the result anyway */
-                               ssl3_finish_mac(s, 
-                                       (unsigned char *)&s->init_buf->data[s->init_off + 
-                                               DTLS1_HM_HEADER_LENGTH], ret - DTLS1_HM_HEADER_LENGTH);
-                       
+                               unsigned char *p = &s->init_buf->data[s->init_off];
+                               const struct hm_header_st *msg_hdr = &s->d1->w_msg_hdr;
+                               int len;
+
+                               if (frag_off == 0 && s->client_version != DTLS1_BAD_VER)
+                                       {
+                                       /* reconstruct message header is if it
+                                        * is being sent in single fragment */
+                                       *p++ = msg_hdr->type;
+                                       l2n3(msg_hdr->msg_len,p);
+                                       s2n (msg_hdr->seq,p);
+                                       l2n3(0,p);
+                                       l2n3(msg_hdr->msg_len,p);
+                                       p  -= DTLS1_HM_HEADER_LENGTH;
+                                       len = ret;
+                                       }
+                               else
+                                       {
+                                       p  += DTLS1_HM_HEADER_LENGTH;
+                                       len = ret - DTLS1_HM_HEADER_LENGTH;
+                                       }
+
+                               ssl3_finish_mac(s, p, len);
+                               }
+
                        if (ret == s->init_num)
                                {
                                if (s->msg_callback)
@@ -307,7 +331,7 @@ int dtls1_do_write(SSL *s, int type)
 
                                s->init_off = 0;  /* done writing this message */
                                s->init_num = 0;
-                               
+
                                return(1);
                                }
                        s->init_off+=ret;
@@ -327,6 +351,7 @@ int dtls1_do_write(SSL *s, int type)
 long dtls1_get_message(SSL *s, int st1, int stn, int mt, long max, int *ok)
        {
        int i, al;
+       struct hm_header_st *msg_hdr;
 
        /* s3->tmp is used to store messages that are unexpected, caused
         * by the absence of an optional handshake message */
@@ -344,25 +369,56 @@ long dtls1_get_message(SSL *s, int st1, 
                s->init_num = (int)s->s3->tmp.message_size;
                return s->init_num;
                }
-       
+
+       msg_hdr = &s->d1->r_msg_hdr;
        do
                {
-               if ( s->d1->r_msg_hdr.frag_off == 0)
+               if ( msg_hdr->frag_off == 0)
                        {
                        /* s->d1->r_message_header.msg_len = 0; */
-                       memset(&(s->d1->r_msg_hdr), 0x00, sizeof(struct hm_header_st));
+                       memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
                        }
 
                i = dtls1_get_message_fragment(s, st1, stn, max, ok);
                if ( i == DTLS1_HM_BAD_FRAGMENT ||
-            i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */
+                       i == DTLS1_HM_FRAGMENT_RETRY)  /* bad fragment received */
                        continue;
                else if ( i <= 0 && !*ok)
                        return i;
 
-               if (s->d1->r_msg_hdr.msg_len == (unsigned int)s->init_num - DTLS1_HM_HEADER_LENGTH)
+               /* Note that s->init_sum is used as a counter summing
+                * up fragments' lengths: as soon as they sum up to
+                * handshake packet length, we assume we have got all
+                * the fragments. Overlapping fragments would cause
+                * premature termination, so we don't expect overlaps.
+                * Well, handling overlaps would require something more
+                * drastic. Indeed, as it is now there is no way to
+                * tell if out-of-order fragment from the middle was
+                * the last. '>=' is the best/least we can do to control
+                * the potential damage caused by malformed overlaps. */
+               if ((unsigned int)s->init_num >= msg_hdr->msg_len)
                        {
-                       memset(&(s->d1->r_msg_hdr), 0x00, sizeof(struct hm_header_st));
+                       unsigned char *p = s->init_buf->data;
+                       unsigned long msg_len = msg_hdr->msg_len;
+
+                       /* reconstruct message header as if it was
+                        * sent in single fragment */
+                       *(p++) = msg_hdr->type;
+                       l2n3(msg_len,p);
+                       s2n (msg_hdr->seq,p);
+                       l2n3(0,p);
+                       l2n3(msg_len,p);
+                       if (s->client_version != DTLS1_BAD_VER)
+                               p       -= DTLS1_HM_HEADER_LENGTH,
+                               msg_len += DTLS1_HM_HEADER_LENGTH;
+
+                       ssl3_finish_mac(s, p, msg_len);
+                       if (s->msg_callback)
+                               s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
+                                       p, msg_len,
+                                       s, s->msg_callback_arg);
+
+                       memset(msg_hdr, 0x00, sizeof(struct hm_header_st));
 
                        s->d1->handshake_read_seq++;
                        /* we just read a handshake message from the other side:
@@ -379,11 +435,11 @@ long dtls1_get_message(SSL *s, int st1, 
                         * first data  segment, but is there a better way?  */
                        dtls1_clear_record_buffer(s);
 
-            s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
-                       return s->init_num - DTLS1_HM_HEADER_LENGTH;
+                       s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
+                       return s->init_num;
                        }
                else
-                       s->d1->r_msg_hdr.frag_off = i;
+                       msg_hdr->frag_off = i;
                } while(1) ;
 
 f_err:
@@ -393,161 +449,183 @@ f_err:
        }
 
 
-static int
-dtls1_retrieve_buffered_fragment(SSL *s, unsigned long *copied)
-    {
-    /* (0) check whether the desired fragment is available
-     * if so:
-     * (1) copy over the fragment to s->init_buf->data[]
-     * (2) update s->init_num
-     */
-    pitem *item;
-    hm_fragment *frag;
-    unsigned long overlap;
-    unsigned char *p;
-
-    item = pqueue_peek(s->d1->buffered_messages);
-    if ( item == NULL)
-        return 0;
+static int dtls1_preprocess_fragment(SSL *s,struct hm_header_st *msg_hdr,int max)
+       {
+       size_t frag_off,frag_len,msg_len;
 
-    frag = (hm_fragment *)item->data;
-    
-    if ( s->d1->handshake_read_seq == frag->msg_header.seq &&
-        frag->msg_header.frag_off <= (unsigned int)s->init_num - DTLS1_HM_HEADER_LENGTH)
-        {
-        pqueue_pop(s->d1->buffered_messages);
-        overlap = s->init_num - DTLS1_HM_HEADER_LENGTH 
-            - frag->msg_header.frag_off;
-
-        p = frag->fragment;
-
-        memcpy(&s->init_buf->data[s->init_num],
-            p + DTLS1_HM_HEADER_LENGTH + overlap,
-            frag->msg_header.frag_len - overlap);
-    
-        OPENSSL_free(frag->fragment);
-        OPENSSL_free(frag);
-        pitem_free(item);
+       msg_len  = msg_hdr->msg_len;
+       frag_off = msg_hdr->frag_off;
+       frag_len = msg_hdr->frag_len;
 
-        *copied = frag->msg_header.frag_len - overlap;
-        return *copied;
-        }
-    else
-        return 0;
-    }
+       /* sanity checking */
+       if ( (frag_off+frag_len) > msg_len)
+               {
+               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+               return SSL_AD_ILLEGAL_PARAMETER;
+               }
 
+       if ( (frag_off+frag_len) > (unsigned long)max)
+               {
+               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+               return SSL_AD_ILLEGAL_PARAMETER;
+               }
 
-static int
-dtls1_buffer_handshake_fragment(SSL *s, struct hm_header_st* msg_hdr)
-{
-    hm_fragment *frag = NULL;
-    pitem *item = NULL;
-       PQ_64BIT seq64;
+       if ( s->d1->r_msg_hdr.frag_off == 0) /* first fragment */
+               {
+               /* msg_len is limited to 2^24, but is effectively checked
+                * against max above */
+               if (!BUF_MEM_grow_clean(s->init_buf,(int)msg_len+DTLS1_HM_HEADER_LENGTH))
+                       {
+                       SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,ERR_R_BUF_LIB);
+                       return SSL_AD_INTERNAL_ERROR;
+                       }
 
-    frag = dtls1_hm_fragment_new(msg_hdr->frag_len);
-    if ( frag == NULL)
-        goto err;
+               s->s3->tmp.message_size  = msg_len;
+               s->d1->r_msg_hdr.msg_len = msg_len;
+               s->s3->tmp.message_type  = msg_hdr->type;
+               s->d1->r_msg_hdr.type    = msg_hdr->type;
+               s->d1->r_msg_hdr.seq     = msg_hdr->seq;
+               }
+       else if (msg_len != s->d1->r_msg_hdr.msg_len)
+               {
+               /* They must be playing with us! BTW, failure to enforce
+                * upper limit would open possibility for buffer overrun. */
+               SSLerr(SSL_F_DTLS1_PREPROCESS_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+               return SSL_AD_ILLEGAL_PARAMETER;
+               }
 
-    memcpy(frag->fragment, &(s->init_buf->data[s->init_num]),
-        msg_hdr->frag_len + DTLS1_HM_HEADER_LENGTH);
+       return 0; /* no error */
+       }
 
-    memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
 
-    pq_64bit_init(&seq64);
-    pq_64bit_assign_word(&seq64, msg_hdr->seq);
+static int
+dtls1_retrieve_buffered_fragment(SSL *s, long max, int *ok)
+       {
+       /* (0) check whether the desired fragment is available
+        * if so:
+        * (1) copy over the fragment to s->init_buf->data[]
+        * (2) update s->init_num
+        */
+       pitem *item;
+       hm_fragment *frag;
+       int al;
 
-    item = pitem_new(seq64, frag);
-    if ( item == NULL)
-        goto err;
+       *ok = 0;
+       item = pqueue_peek(s->d1->buffered_messages);
+       if ( item == NULL)
+               return 0;
 
-    pq_64bit_free(&seq64);
+       frag = (hm_fragment *)item->data;
 
-    pqueue_insert(s->d1->buffered_messages, item);
-    return 1;
+       if ( s->d1->handshake_read_seq == frag->msg_header.seq)
+               {
+               pqueue_pop(s->d1->buffered_messages);
 
-err:
-    if ( frag != NULL) dtls1_hm_fragment_free(frag);
-    if ( item != NULL) OPENSSL_free(item);
-    return 0;
-}
+               al=dtls1_preprocess_fragment(s,&frag->msg_header,max);
 
+               if (al==0) /* no alert */
+                       {
+                       unsigned char *p = s->init_buf->data+DTLS1_HM_HEADER_LENGTH;
+                       memcpy(&p[frag->msg_header.frag_off],
+                               frag->fragment,frag->msg_header.frag_len);
+                       }
 
-static void
-dtls1_process_handshake_fragment(SSL *s, int frag_len)
-    {
-    unsigned char *p;
+               dtls1_hm_fragment_free(frag);
+               pitem_free(item);
 
-    p = (unsigned char *)s->init_buf->data;
+               if (al==0)
+                       {
+                       *ok = 1;
+                       return frag->msg_header.frag_len;
+                       }
 
-       ssl3_finish_mac(s, &p[s->init_num - frag_len], frag_len);
-    }
+               ssl3_send_alert(s,SSL3_AL_FATAL,al);
+               s->init_num = 0;
+               *ok = 0;
+               return -1;
+               }
+       else
+               return 0;
+       }
 
 
 static int
-dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st *msg_hdr, int *ok)
-    {
-    int i;
-    unsigned char *p;
-
-    /* make sure there's enough room to read this fragment */
-    if ( (int)msg_hdr->frag_len && !BUF_MEM_grow_clean(s->init_buf, 
-             (int)msg_hdr->frag_len + DTLS1_HM_HEADER_LENGTH + s->init_num))
-        {
-        SSLerr(SSL_F_DTLS1_PROCESS_OUT_OF_SEQ_MESSAGE,ERR_R_BUF_LIB);
-        goto err;
-        }
+dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+{
+       int i=-1;
+       hm_fragment *frag = NULL;
+       pitem *item = NULL;
+       PQ_64BIT seq64;
+       unsigned long frag_len = msg_hdr->frag_len;
 
-    p = (unsigned char *)s->init_buf->data;
+       if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
+               goto err;
 
-    /* read the body of the fragment (header has already been read */
-    if ( msg_hdr->frag_len > 0)
+       if (msg_hdr->seq <= s->d1->handshake_read_seq)
                {
-               i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
-            &p[s->init_num], 
-            msg_hdr->frag_len,0);
-               if (i <= 0)
+               unsigned char devnull [256];
+
+               while (frag_len)
                        {
-                       *ok = 0;
-                       return i;
+                       i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                               devnull,
+                               frag_len>sizeof(devnull)?sizeof(devnull):frag_len,0);
+                       if (i<=0) goto err;
+                       frag_len -= i;
                        }
                }
 
-    if ( msg_hdr->seq > s->d1->handshake_read_seq)
-        dtls1_buffer_handshake_fragment(s, msg_hdr);
-    else
-        OPENSSL_assert(msg_hdr->seq < s->d1->handshake_read_seq);
+       frag = dtls1_hm_fragment_new(frag_len);
+       if ( frag == NULL)
+               goto err;
+
+       memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
+
+       if (frag_len)
+               {
+               /* read the body of the fragment (header has already been read */
+               i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+                       frag->fragment,frag_len,0);
+               if (i<=0 || i!=frag_len)
+                       goto err;
+               }
+
+       pq_64bit_init(&seq64);
+       pq_64bit_assign_word(&seq64, msg_hdr->seq);
+
+       item = pitem_new(seq64, frag);
+       pq_64bit_free(&seq64);
+       if ( item == NULL)
+               goto err;
+
+       pqueue_insert(s->d1->buffered_messages, item);
+       return DTLS1_HM_FRAGMENT_RETRY;
 
-    return DTLS1_HM_FRAGMENT_RETRY;
 err:
-    *ok = 0;
-    return -1;
-    }
+       if ( frag != NULL) dtls1_hm_fragment_free(frag);
+       if ( item != NULL) OPENSSL_free(item);
+       *ok = 0;
+       return i;
+       }
 
 
 static long
 dtls1_get_message_fragment(SSL *s, int st1, int stn, long max, int *ok)
        {
-       unsigned char *p;
+       unsigned char wire[DTLS1_HM_HEADER_LENGTH];
        unsigned long l, frag_off, frag_len;
        int i,al;
        struct hm_header_st msg_hdr;
-    unsigned long overlap;
-    
-    /* see if we have the required fragment already */
-    if (dtls1_retrieve_buffered_fragment(s, &l))
-    {
-        /* compute MAC, remove fragment headers */
-        dtls1_process_handshake_fragment(s, l);
-        s->init_msg = s->init_buf->data + DTLS1_HM_HEADER_LENGTH;
-        s->state = stn;
-        return 1;
-    }
 
-    /* get a handshake fragment from the record layer */
-       p = (unsigned char *)s->init_buf->data;
+       /* see if we have the required fragment already */
+       if ((frag_len = dtls1_retrieve_buffered_fragment(s,max,ok)) || *ok)
+               {
+               if (*ok)        s->init_num += frag_len;
+               return frag_len;
+               }
 
-    /* read handshake message header */
-       i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,&p[s->init_num],
+       /* read handshake message header */
+       i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,wire,
                DTLS1_HM_HEADER_LENGTH, 0);
        if (i <= 0)     /* nbio, or an error */
                {
@@ -555,130 +633,61 @@ dtls1_get_message_fragment(SSL *s, int s
                *ok = 0;
                return i;
                }
-
        OPENSSL_assert(i == DTLS1_HM_HEADER_LENGTH);
 
-       p += s->init_num;
-    /* parse the message fragment header */
-    
-    dtls1_get_message_header(p, &msg_hdr);
+       /* parse the message fragment header */
+       dtls1_get_message_header(wire, &msg_hdr);
 
-    /* 
-     * if this is a future (or stale) message it gets buffered
-     * (or dropped)--no further processing at this time 
-     */
-    if ( msg_hdr.seq != s->d1->handshake_read_seq)
-        return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
+       /* 
+        * if this is a future (or stale) message it gets buffered
+        * (or dropped)--no further processing at this time 
+        */
+       if ( msg_hdr.seq != s->d1->handshake_read_seq)
+               return dtls1_process_out_of_seq_message(s, &msg_hdr, ok);
 
-    l = msg_hdr.msg_len;
-    frag_off = msg_hdr.frag_off;
+       l = msg_hdr.msg_len;
+       frag_off = msg_hdr.frag_off;
        frag_len = msg_hdr.frag_len;
 
-    /* sanity checking */
-    if ( frag_off + frag_len > l)
-        {
-        al=SSL_AD_ILLEGAL_PARAMETER;
-        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
-        goto f_err;
-        }
-
        if (!s->server && s->d1->r_msg_hdr.frag_off == 0 &&
-        p[0] == SSL3_MT_HELLO_REQUEST)
-        {
-        /* The server may always send 'Hello Request' messages --
-         * we are doing a handshake anyway now, so ignore them
-         * if their format is correct. Does not count for
-         * 'Finished' MAC. */
-        if (p[1] == 0 && p[2] == 0 &&p[3] == 0)
-            {
-            if (s->msg_callback)
-                s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, 
-                    p, DTLS1_HM_HEADER_LENGTH, s, 
-                    s->msg_callback_arg);
-            
-            s->init_num = 0;
-            return dtls1_get_message_fragment(s, st1, stn,
-                max, ok);
-            }
-        else /* Incorrectly formated Hello request */
-            {
-            al=SSL_AD_UNEXPECTED_MESSAGE;
-            SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);
-            goto f_err;
-            }
-        }
-
-    /* XDTLS: do a sanity check on the fragment */
-
-    s->init_num += i;
-
-       if ( s->d1->r_msg_hdr.frag_off == 0) /* first fragment */
+               wire[0] == SSL3_MT_HELLO_REQUEST)
                {
-               /* BUF_MEM_grow takes an 'int' parameter */
-               if (l > (INT_MAX-DTLS1_HM_HEADER_LENGTH)) 
+               /* The server may always send 'Hello Request' messages --
+                * we are doing a handshake anyway now, so ignore them
+                * if their format is correct. Does not count for
+                * 'Finished' MAC. */
+               if (wire[1] == 0 && wire[2] == 0 && wire[3] == 0)
                        {
-                       al=SSL_AD_ILLEGAL_PARAMETER;
-                       SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
-                       goto f_err;
-                       }
-               if (l && !BUF_MEM_grow_clean(s->init_buf,(int)l
-                       + DTLS1_HM_HEADER_LENGTH))
-                       {
-                       SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,ERR_R_BUF_LIB);
-                       goto err;
+                       if (s->msg_callback)
+                               s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, 
+                                       wire, DTLS1_HM_HEADER_LENGTH, s, 
+                                       s->msg_callback_arg);
+                       
+                       s->init_num = 0;
+                       return dtls1_get_message_fragment(s, st1, stn,
+                               max, ok);
                        }
-        /* Only do this test when we're reading the expected message.
-         * Stale messages will be dropped and future messages will be buffered */
-        if ( l > (unsigned long)max)
+               else /* Incorrectly formated Hello request */
                        {
-                       al=SSL_AD_ILLEGAL_PARAMETER;
-                       SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
+                       al=SSL_AD_UNEXPECTED_MESSAGE;
+                       SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);
                        goto f_err;
                        }
-
-               s->s3->tmp.message_size=l;
                }
 
-    if ( frag_len > (unsigned long)max)
-        {
-        al=SSL_AD_ILLEGAL_PARAMETER;
-        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
-        goto f_err;
-        }
-    if ( frag_len + s->init_num > (INT_MAX - DTLS1_HM_HEADER_LENGTH))
-        {
-        al=SSL_AD_ILLEGAL_PARAMETER;
-        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_EXCESSIVE_MESSAGE_SIZE);
-        goto f_err;
-        }
-
-    if ( frag_len & !BUF_MEM_grow_clean(s->init_buf, (int)frag_len 
-             + DTLS1_HM_HEADER_LENGTH + s->init_num))
-        {
-        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,ERR_R_BUF_LIB);
-        goto err;
-        }
-
-       if ( s->d1->r_msg_hdr.frag_off == 0)
-               {
-               s->s3->tmp.message_type = msg_hdr.type;
-               s->d1->r_msg_hdr.type = msg_hdr.type;
-               s->d1->r_msg_hdr.msg_len = l;
-               /* s->d1->r_msg_hdr.seq = seq_num; */
-               }
+       if ((al=dtls1_preprocess_fragment(s,&msg_hdr,max)))
+               goto f_err;
 
        /* XDTLS:  ressurect this when restart is in place */
        s->state=stn;
-       
-       /* next state (stn) */
-       p = (unsigned char *)s->init_buf->data;
 
        if ( frag_len > 0)
                {
+               unsigned char *p=s->init_buf->data+DTLS1_HM_HEADER_LENGTH;
+
                i=s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
-            &p[s->init_num], 
-            frag_len,0);
-        /* XDTLS:  fix this--message fragments cannot span multiple packets */
+                       &p[frag_off],frag_len,0);
+               /* XDTLS:  fix this--message fragments cannot span multiple packets */
                if (i <= 0)
                        {
                        s->rwstate=SSL_READING;
@@ -689,70 +698,23 @@ dtls1_get_message_fragment(SSL *s, int s
        else
                i = 0;
 
-    /* XDTLS:  an incorrectly formatted fragment should cause the 
-     * handshake to fail */
+       /* XDTLS:  an incorrectly formatted fragment should cause the 
+        * handshake to fail */
        OPENSSL_assert(i == (int)frag_len);
 
-#if 0
-    /* Successfully read a fragment.
-     * It may be (1) out of order, or
-     *           (2) it's a repeat, in which case we dump it
-     *           (3) the one we are expecting next (maybe with overlap)
-     * If it is next one, it may overlap with previously read bytes
-     */
+       *ok = 1;
 
-    /* case (1): buffer the future fragment 
-     * (we can treat fragments from a future message the same
-     * as future fragments from the message being currently read, since
-     * they are sematically simply out of order.
-     */
-    if ( msg_hdr.seq > s->d1->handshake_read_seq ||
-        frag_off > s->init_num - DTLS1_HM_HEADER_LENGTH)
-    {
-        dtls1_buffer_handshake_fragment(s, &msg_hdr);
-        return DTLS1_HM_FRAGMENT_RETRY;
-    }
-
-    /* case (2):  drop the entire fragment, and try again */
-    if ( msg_hdr.seq < s->d1->handshake_read_seq ||
-        frag_off + frag_len < s->init_num - DTLS1_HM_HEADER_LENGTH)
-        {
-        s->init_num -= DTLS1_HM_HEADER_LENGTH;
-        return DTLS1_HM_FRAGMENT_RETRY;
-        }
-#endif
-
-    /* case (3): received a immediately useful fragment.  Determine the 
-     * possible overlap and copy the fragment.
-     */
-    overlap = (s->init_num - DTLS1_HM_HEADER_LENGTH) - frag_off;
-        
-    /* retain the header for the first fragment */
-    if ( s->init_num > DTLS1_HM_HEADER_LENGTH)
-        {
-        memmove(&(s->init_buf->data[s->init_num]),
-            &(s->init_buf->data[s->init_num + DTLS1_HM_HEADER_LENGTH + overlap]),
-            frag_len - overlap);
-
-        s->init_num += frag_len - overlap;
-        }
-    else
-        s->init_num += frag_len;
-
-    dtls1_process_handshake_fragment(s, frag_len - overlap);
-
-       if (s->msg_callback)
-               s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data, 
-                       (size_t)s->init_num, s, 
-                       s->msg_callback_arg);
-       *ok=1;
-
-       return s->init_num;
+       /* Note that s->init_num is *not* used as current offset in
+        * s->init_buf->data, but as a counter summing up fragments'
+        * lengths: as soon as they sum up to handshake packet
+        * length, we assume we have got all the fragments. */
+       s->init_num += frag_len;
+       return frag_len;
 
 f_err:
        ssl3_send_alert(s,SSL3_AL_FATAL,al);
-    s->init_num = 0;
-err:
+       s->init_num = 0;
+
        *ok=0;
        return(-1);
        }
@@ -790,7 +752,7 @@ int dtls1_send_finished(SSL *s, int a, i
 
                /* buffer the message to handle re-xmits */
                dtls1_buffer_message(s, 0);
-               
+
                s->state=b;
                }
 
@@ -815,10 +777,15 @@ int dtls1_send_change_cipher_spec(SSL *s
                p=(unsigned char *)s->init_buf->data;
                *p++=SSL3_MT_CCS;
                s->d1->handshake_write_seq = s->d1->next_handshake_write_seq;
-               s->d1->next_handshake_write_seq++;
-               s2n(s->d1->handshake_write_seq,p);
-
                s->init_num=DTLS1_CCS_HEADER_LENGTH;
+
+               if (s->client_version == DTLS1_BAD_VER)
+                       {
+                       s->d1->next_handshake_write_seq++;
+                       s2n(s->d1->handshake_write_seq,p);
+                       s->init_num+=2;
+                       }
+
                s->init_off=0;
 
                dtls1_set_message_header_int(s, SSL3_MT_CCS, 0, 
@@ -1044,6 +1011,7 @@ dtls1_buffer_message(SSL *s, int is_ccs)
     pitem *item;
     hm_fragment *frag;
        PQ_64BIT seq64;
+       unsigned int epoch = s->d1->w_epoch;
 
     /* this function is called immediately after a message has 
      * been serialized */
@@ -1056,7 +1024,8 @@ dtls1_buffer_message(SSL *s, int is_ccs)
     if ( is_ccs)
         {
         OPENSSL_assert(s->d1->w_msg_hdr.msg_len + 
-            DTLS1_CCS_HEADER_LENGTH == (unsigned int)s->init_num);
+            DTLS1_CCS_HEADER_LENGTH <= (unsigned int)s->init_num);
+       epoch++;
         }
     else
         {
@@ -1072,7 +1041,7 @@ dtls1_buffer_message(SSL *s, int is_ccs)
     frag->msg_header.is_ccs = is_ccs;
 
     pq_64bit_init(&seq64);
-    pq_64bit_assign_word(&seq64, frag->msg_header.seq);
+    pq_64bit_assign_word(&seq64, epoch<<16 | frag->msg_header.seq);
 
     item = pitem_new(seq64, frag);
     pq_64bit_free(&seq64);
@@ -1259,5 +1228,4 @@ dtls1_get_ccs_header(unsigned char *data
     memset(ccs_hdr, 0x00, sizeof(struct ccs_header_st));
     
     ccs_hdr->type = *(data++);
-    n2s(data, ccs_hdr->seq);
 }
diff -up openssl-fips-0.9.8f-dev/ssl/d1_clnt.c.dtls-fixes openssl-fips-0.9.8f-dev/ssl/d1_clnt.c
--- openssl-fips-0.9.8f-dev/ssl/d1_clnt.c.dtls-fixes    2005-12-05 18:32:19.000000000 +0100
+++ openssl-fips-0.9.8f-dev/ssl/d1_clnt.c       2008-07-15 21:01:29.000000000 +0200
@@ -214,17 +214,21 @@ int dtls1_connect(SSL *s)
 
                        /* don't push the buffering BIO quite yet */
 
-                       ssl3_init_finished_mac(s);
-
                        s->state=SSL3_ST_CW_CLNT_HELLO_A;
                        s->ctx->stats.sess_connect++;
                        s->init_num=0;
+                       /* mark client_random uninitialized */
+                       memset(s->s3->client_random,0,sizeof(s->s3->client_random));
                        break;
 
                case SSL3_ST_CW_CLNT_HELLO_A:
                case SSL3_ST_CW_CLNT_HELLO_B:
 
                        s->shutdown=0;
+
+                       /* every DTLS ClientHello resets Finished MAC */
+                       ssl3_init_finished_mac(s);
+
                        ret=dtls1_client_hello(s);
                        if (ret <= 0) goto end;
 
@@ -422,6 +426,9 @@ int dtls1_connect(SSL *s)
                                s->s3->tmp.next_state=SSL3_ST_CR_FINISHED_A;
                                }
                        s->init_num=0;
+                       /* mark client_random uninitialized */
+                       memset (s->s3->client_random,0,sizeof(s->s3->client_random));
+
                        break;
 
                case SSL3_ST_CR_FINISHED_A:
@@ -544,9 +551,15 @@ int dtls1_client_hello(SSL *s)
                /* else use the pre-loaded session */
 
                p=s->s3->client_random;
-               Time=(unsigned long)time(NULL);                 /* Time */
-               l2n(Time,p);
-               RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-sizeof(Time));
+               /* if client_random is initialized, reuse it, we are
+                * required to use same upon reply to HelloVerify */
+               for (i=0;p[i]=='\0' && i<sizeof(s->s3->client_random);i++) ;
+               if (i==sizeof(s->s3->client_random))
+                       {
+                       Time=(unsigned long)time(NULL); /* Time */
+                       l2n(Time,p);
+                       RAND_pseudo_bytes(p,SSL3_RANDOM_SIZE-4);
+                       }
 
                /* Do the message type and length last */
                d=p= &(buf[DTLS1_HM_HEADER_LENGTH]);