wip

Author: julek-wolfssl

src/internal.c

@@ -25985,6 +25985,10 @@ static int CheckTLS13AEADSendLimit(WOLFSSL* ssl)
     }
 #ifdef WOLFSSL_DTLS13
     if (ssl->options.dtls) {
+        if (ssl->dtls13EncryptEpoch == NULL) {
+            WOLFSSL_MSG("DTLS 1.3 encrypt epoch not set");
+            return BAD_STATE_E;
+        }
         seq = ssl->dtls13EncryptEpoch->nextSeqNumber;
     }
     else

src/ssl.c

@@ -807,6 +807,31 @@ static int DupSSL(WOLFSSL* dup, WOLFSSL* ssl)
     /* dup side now owns encrypt/write ciphers */
     XMEMSET(&ssl->encrypt, 0, sizeof(Ciphers));
 
+#ifdef WOLFSSL_DTLS13
+    if (ssl->options.dtls && IsAtLeastTLSv1_3(ssl->version)) {
+        /* Copy epoch array (contains only value types — safe to memcpy). */
+        XMEMCPY(dup->dtls13Epochs, ssl->dtls13Epochs, sizeof(ssl->dtls13Epochs));
+
+        /* Re-point dtls13EncryptEpoch into dup's own epoch array. */
+        if (ssl->dtls13EncryptEpoch != NULL) {
+            dup->dtls13EncryptEpoch =
+                &dup->dtls13Epochs[ssl->dtls13EncryptEpoch - ssl->dtls13Epochs];
+        }
+        /* dtls13DecryptEpoch is not needed by the write-only side; leave NULL. */
+
+        /* Copy current write epoch number (checked in Dtls13SendMessage). */
+        dup->dtls13Epoch = ssl->dtls13Epoch;
+
+        /* Transfer record-number encryption cipher ownership to dup.
+         * FreeCiphers() frees the aes/chacha pointer, so sharing it would
+         * cause a double-free; use the same ownership-transfer pattern as
+         * for ssl->encrypt above. */
+        XMEMCPY(&dup->dtlsRecordNumberEncrypt, &ssl->dtlsRecordNumberEncrypt,
+                sizeof(RecordNumberCiphers));
+        XMEMSET(&ssl->dtlsRecordNumberEncrypt, 0, sizeof(RecordNumberCiphers));
+    }
+#endif /* WOLFSSL_DTLS13 */
+
     dup->IOCB_WriteCtx = ssl->IOCB_WriteCtx;
     dup->CBIOSend = ssl->CBIOSend;
 #ifdef OPENSSL_EXTRA

tests/api.c

@@ -32023,9 +32023,11 @@ static int test_write_dup(void)
     } methods[] = {
 #ifndef WOLFSSL_NO_TLS12
         {wolfTLSv1_2_client_method, wolfTLSv1_2_server_method, "TLS 1.2", WOLFSSL_TLSV1_2},
+        {wolfDTLSv1_2_client_method, wolfDTLSv1_2_server_method, "DTLS 1.2", WOLFSSL_TLSV1_2},
 #endif
 #ifdef WOLFSSL_TLS13
         {wolfTLSv1_3_client_method, wolfTLSv1_3_server_method, "TLS 1.3", WOLFSSL_TLSV1_3},
+        {wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method, "TLS 1.3", WOLFSSL_TLSV1_3},
 #endif
     };
     struct {