0

I am trying to see the heartbleed bug in action with my OpenSSL server application.

My server uses the OpenSSL library - openssl-1.0.1b

I successfully connect with s_client (openssl-1.0.1b) to my server. The SSL Handshake is through.

Now, I type 'B' to send in a encrypted Heartbeat to the server. But the server closes the connection with Alert. The s_client dumps the following info:

HEARTBEATING

TLS 1.0 [length 0025], HeartbeatRequest

SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:s3_pkt.c:1256:SSL alert number 20

However if I were to type in some other data, it gets treated as application data and is processed by my server.

And another thing to note is that the same s_client successsfully exchanges heartbeats with www.yahoo.com

Why could my server not accept heartbeat message even though in server hello it mentioned that it supports that extension?

Edit(Update)

One thing that I hadn't realized was that the SSL library was actually TurboSSL, Cavium's port of OpenSSL to use the hardware accelarator. With this I see the error that I mentioned.

When I use the plain OpenSSl library, it worked fine!. Heartbeats were being sent from server.

  • Have you checked whether the heartbeat functionality is enabled by default in the server you are talking about ? – Arun Apr 22 '14 at 10:19
  • @Arun,the OpenSSL library is used as is. By default heartbeat is enabled, ins't? And also, in the server hello, server does indicate that it is OK for doing heartbeat exchanges. – Prabhu Apr 22 '14 at 10:21
  • @Arun. Sorry. My statement is not entirely true. I use TurboSSL which is essentially OpenSSl extended t use the Cavium accelerator. – Prabhu Apr 22 '14 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.