Regarding the priority to upgrade servers, I want to confirm this, as I read in https://tools.ietf.org/html/rfc6520 chapter 3:
However, a HeartbeatRequest message SHOULD NOT be sent during
handshakes. If a handshake is initiated while a HeartbeatRequest is
still in flight, the sending peer MUST stop the DTLS retransmission
timer for it. The receiving peer SHOULD discard the message
silently, if it arrives during the handshake. In case of DTLS,
HeartbeatRequest messages from older epochs SHOULD be discarded.
Am I correct to think that, if a server only accepts SSL connections from known clients, no one else can exploit the bug during the handshake?
My understanding is that the message should be dropped and that the server does not answer.