Skip to content

Instantly share code, notes, and snippets.

@kmosher
Last active August 29, 2015 13:58
Show Gist options
  • Save kmosher/10313697 to your computer and use it in GitHub Desktop.
Save kmosher/10313697 to your computer and use it in GitHub Desktop.
Add heartbleed attack logging to nginx
diff --git a/nginx-1.5.8/src/event/ngx_event_openssl.c b/nginx-1.5.8/src/event/ngx_event_openssl.c
index ee66713..1ea58e1 100644
--- a/nginx-1.5.8/src/event/ngx_event_openssl.c
+++ b/nginx-1.5.8/src/event/ngx_event_openssl.c
@@ -18,6 +18,9 @@ typedef struct {
static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store);
static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where,
int ret);
+static void ngx_ssl_msg_callback(
+ int write_p, int version, int content_type,
+ const void *buf, size_t len, SSL *ssl, void *log);
static void ngx_ssl_handshake_handler(ngx_event_t *ev);
static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n);
static void ngx_ssl_write_handler(ngx_event_t *wev);
@@ -244,6 +247,8 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
SSL_CTX_set_read_ahead(ssl->ctx, 1);
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
+ SSL_CTX_set_msg_callback(ssl->ctx, ngx_ssl_msg_callback);
+ SSL_CTX_set_msg_callback_arg(ssl->ctx, ssl->log);
return NGX_OK;
}
@@ -532,6 +537,22 @@ ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
return 1;
}
+static void ngx_ssl_msg_callback(
+ int write_p, int version, int content_type,
+ const void *buf, size_t len, ngx_ssl_conn_t *ssl, void *log)
+{
+ if (write_p == 0 && content_type == TLS1_RT_HEARTBEAT) {
+ unsigned char *p = buf;
+ unsigned int payload;
+
+ payload = (((unsigned int)(p[1])) << 8) | ((unsigned int)(p[2]));
+ if (1 + 2 + payload + 16 > len) {
+ ngx_log_error(NGX_LOG_ALERT, ((ngx_log_t*)log), 0, "Heartbleed attack detected");
+ }
+ }
+
+}
+
static void
ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret)
@CharlesIII
Copy link

Is this compatible with the current mainline version 1.5.13? Or perhaps with the current stable, 1.4.7? If not, do you knoq what I would need to change? Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment