]> git.ipfire.org Git - thirdparty/haproxy.git/commit
MEDIUM: ssl: implement a workaround for the OpenSSL heartbleed attack
authorWilly Tarreau <w@1wt.eu>
Fri, 25 Apr 2014 18:02:39 +0000 (20:02 +0200)
committerWilly Tarreau <w@1wt.eu>
Fri, 25 Apr 2014 18:06:33 +0000 (20:06 +0200)
commitf51c6989b008a4293e2fa0a18c10290499bf020a
treecdc59956152dbb9e767c5719fd95628ea7ece863
parent29f037d872198a75880e0816f40b15f4144956dc
MEDIUM: ssl: implement a workaround for the OpenSSL heartbleed attack

Using the previous callback, it's trivial to block the heartbeat attack,
first we control the message length, then we emit an SSL error if it is
out of bounds. A special log is emitted, indicating that a heartbleed
attack was stopped so that they are not confused with other failures.

That way, haproxy can protect itself even when running on an unpatched
SSL stack. Tests performed with openssl-1.0.1c indicate a total success.
include/proto/connection.h
include/types/connection.h
src/ssl_sock.c