8

Sorry if it is very open ended. All the news about the Heartbleed exploit has been flooding Google, and I can't figure out what it does. Is it fine to recompile?

12

If you compilte OpenSSL with -DOPENSSL_NO_HEARTBEATS then you get an OpenSSL library and tools which can do anything that "normal" OpenSSL can do, except for the support of the SSL/TLS extension called "Heartbeat". That extension is described in RFC 6520. It is a pretty recent extension.

As with all extensions, its use in any given SSL connections is subject to a negotiation which occurs in the early steps of the handshake. Basically, the extension may be used only if the client claims that it supports it and wants to use it (in the ClientHello) and the server responds that it supports it and is OK with using it (in the ServerHello). If your SSL library was compiled without Heartbeat support, then it will not advertise Heartbeat support; if it is involved in a handshake where that extension appears, it will handle it as an "unknown extension", i.e. ignore it altogether.

Apart from that, your newly-compiled OpenSSL will behave just like the previous one, and things will work. What will break is if a specific application insists on using the Heartbeat extension: that extension will try to activate the extension and use it, and it will not work.

Looking at the OpenSSL source code, it appears that the SSL_heartbeat() function (used to send a "beat" by an Heartbeat-aware application) is a macro, which invokes the generic SSL_ctrl() function with some numeric parameters. This implies that if an application really wants to use that functionality, and you provide it with your no-heartbeat OpenSSL library, then there will be no link error; the code will run; but any beat-sending call will result in an error status. How the application will react depends on the application. In fact, from the application point of view, things will be as if the peer did not support Heartbeat.

Fortunately, this extension is very recent, and there must not be many application which are aware of Heartbeat, let alone use it. Chances are that your recompiled OpenSSL will not break anything at all, so the answer to your question is: yes, it is quite probably fine to recompile.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.