Commit 3703e9d791 for openssl.org

commit 3703e9d7911acba31b97aaeaa5b319acce428dba
Author: Ryan Hooper <ryanh@openssl.foundation>
Date:   Wed Aug 12 15:12:37 2026 -0400

    DTLS 1.3 Fix TLSProxy DTLS retransmission in valgrind CI

    Valgrind slows execution down, causing DTLS retransmission timers to fire
    during otherwise normal handshakes. The client retransmits its ClientHello
    before the server responds, and TLSProxy recorded the duplicate into
    message_list unconditionally. This shifted every subsequent message index
    by one, breaking three DTLS 1.3 subtests:

    70-test_tls13alerts.t: alert_filter corrupted message_list[1] expecting
    the ServerHello, but found the retransmitted ClientHello instead. The
    real ServerHello passed through uncorrupted, the handshake succeeded,
    and Message->fail() returned false.

    70-test_tls13messages.t / 70-test_tls13kexmodes.t: checkhandshake.pm
    walks message_list sequentially comparing each .mt to an expected
    sequence. The extra ClientHello at position 0 shifted all five
    subsequent checks.

    Fix by deduplicating message_list in DTLS mode using (sender, msgseq) as
    the key. Retransmitted DTLS handshake messages always carry the same
    message sequence number as the original, so duplicates are naturally
    discarded. HelloRetryRequest is unaffected becasue the retried ClientHello
    gets an incremented msgseq. The seen_msgseq hash is reset by clearClient
    so there is no state leakage between subtests.

    Assisted-by: Claude:claude-sonnet-4-6
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Matt Caswell <matt@openssl.foundation>
    Merge-date: Thu Aug 20 09:55:42 2026
    Merged-from: https://github.com/openssl/openssl/pull/32340

diff --git a/util/perl/TLSProxy/Proxy.pm b/util/perl/TLSProxy/Proxy.pm
index aba80f28f8..7db4039d8d 100644
--- a/util/perl/TLSProxy/Proxy.pm
+++ b/util/perl/TLSProxy/Proxy.pm
@@ -137,6 +137,7 @@ sub init
         partial => ["", ""],
         record_list => [],
         message_list => [],
+        seen_msgseq => {},
     };

     return bless $self, $class;
@@ -160,6 +161,7 @@ sub clearClient
     $self->{partial} = ["", ""];
     $self->{record_list} = [];
     $self->{message_list} = [];
+    $self->{seen_msgseq} = {};
     $self->{clientflags} = "";
     $self->{sessionfile} = undef;
     $self->{clientpid} = 0;
@@ -720,7 +722,15 @@ sub process_packet

     $self->{partial}[$serverissender] = $ret[2];
     push @{$self->{record_list}}, @{$ret[0]};
-    push @{$self->{message_list}}, @{$ret[1]};
+    if ($self->{isdtls}) {
+        foreach my $msg (@{$ret[1]}) {
+            my $key = $msg->server . ":" . $msg->msgseq;
+            push @{$self->{message_list}}, $msg
+                unless $self->{seen_msgseq}{$key}++;
+        }
+    } else {
+        push @{$self->{message_list}}, @{$ret[1]};
+    }

     print "\n";