Check for invalid TLS handshake

If the system has a vulnerable version of OpenSSL, and the
admin has told us to allow it, we want to catch and stop
the problem.

diff --git a/src/include/tls-h b/src/include/tls-h
index aea0bac..ccfb5fd 100644 (file)
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -138,6 +138,7 @@ typedef struct _tls_session_t {
        unsigned int    (*record_minus)(record_t *buf, void *ptr,
                                        unsigned int size);
 
+       bool            invalid_hb_used;
 
        /*
         * Framed-MTU attribute in RADIUS,

diff --git a/src/main/cb.c b/src/main/cb.c
index 3f544bc..effe4e7 100644 (file)
--- a/src/main/cb.c
+++ b/src/main/cb.c
@@ -107,6 +107,23 @@ void cbtls_msg(int write_p, int msg_version, int content_type,
                state->info.handshake_type = ((unsigned char const *)buf)[0];
                state->info.alert_level = 0x00;
                state->info.alert_description = 0x00;
+
+#ifdef SSL3_RT_HEARTBEAT
+       } else if (content_type == TLS1_RT_HEARTBEAT) {
+               uint8_t *p = buf;
+
+               if ((len >= 3) && (p[0] == 1)) {
+                       size_t payload_len;
+
+                       payload_len = (p[1] << 8) | p[2];
+
+                       if ((payload_len + 3) > len) {
+                               state->invalid_hb_used = true;
+                               ERROR("OpenSSL Heartbeat attack detected.  Closing connection");
+                               return;
+                       }
+               }
+#endif
        }
        tls_session_information(state);
 }

diff --git a/src/main/tls.c b/src/main/tls.c
index 61a6444..4ec72aa 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -374,6 +374,8 @@ int tls_handshake_recv(REQUEST *request, tls_session_t *ssn)
 {
        int err;
 
+       if (ssn->invalid_hb_used) return 0;
+
        err = BIO_write(ssn->into_ssl, ssn->dirty_in.data, ssn->dirty_in.used);
        if (err != (int) ssn->dirty_in.used) {
                RDEBUG("Failed writing %d to SSL BIO: %d", ssn->dirty_in.used,