I am trying to see the heartbleed bug in action with my OpenSSL server application.
My server uses the OpenSSL library - openssl-1.0.1b
I successfully connect with s_client (openssl-1.0.1b) to my server. The SSL Handshake is through.
Now, I type 'B' to send in a encrypted Heartbeat to the server. But the server closes the connection with Alert. The s_client dumps the following info:
TLS 1.0 [length 0025], HeartbeatRequest
SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:s3_pkt.c:1256:SSL alert number 20
However if I were to type in some other data, it gets treated as application data and is processed by my server.
And another thing to note is that the same s_client successsfully exchanges heartbeats with www.yahoo.com
Why could my server not accept heartbeat message even though in server hello it mentioned that it supports that extension?
One thing that I hadn't realized was that the SSL library was actually TurboSSL, Cavium's port of OpenSSL to use the hardware accelarator. With this I see the error that I mentioned.
When I use the plain OpenSSl library, it worked fine!. Heartbeats were being sent from server.