Last active
August 29, 2015 13:58
-
-
Save kmosher/10313697 to your computer and use it in GitHub Desktop.
Add heartbleed attack logging to nginx
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
diff --git a/nginx-1.5.8/src/event/ngx_event_openssl.c b/nginx-1.5.8/src/event/ngx_event_openssl.c | |
index ee66713..1ea58e1 100644 | |
--- a/nginx-1.5.8/src/event/ngx_event_openssl.c | |
+++ b/nginx-1.5.8/src/event/ngx_event_openssl.c | |
@@ -18,6 +18,9 @@ typedef struct { | |
static int ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store); | |
static void ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, | |
int ret); | |
+static void ngx_ssl_msg_callback( | |
+ int write_p, int version, int content_type, | |
+ const void *buf, size_t len, SSL *ssl, void *log); | |
static void ngx_ssl_handshake_handler(ngx_event_t *ev); | |
static ngx_int_t ngx_ssl_handle_recv(ngx_connection_t *c, int n); | |
static void ngx_ssl_write_handler(ngx_event_t *wev); | |
@@ -244,6 +247,8 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) | |
SSL_CTX_set_read_ahead(ssl->ctx, 1); | |
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); | |
+ SSL_CTX_set_msg_callback(ssl->ctx, ngx_ssl_msg_callback); | |
+ SSL_CTX_set_msg_callback_arg(ssl->ctx, ssl->log); | |
return NGX_OK; | |
} | |
@@ -532,6 +537,22 @@ ngx_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store) | |
return 1; | |
} | |
+static void ngx_ssl_msg_callback( | |
+ int write_p, int version, int content_type, | |
+ const void *buf, size_t len, ngx_ssl_conn_t *ssl, void *log) | |
+{ | |
+ if (write_p == 0 && content_type == TLS1_RT_HEARTBEAT) { | |
+ unsigned char *p = buf; | |
+ unsigned int payload; | |
+ | |
+ payload = (((unsigned int)(p[1])) << 8) | ((unsigned int)(p[2])); | |
+ if (1 + 2 + payload + 16 > len) { | |
+ ngx_log_error(NGX_LOG_ALERT, ((ngx_log_t*)log), 0, "Heartbleed attack detected"); | |
+ } | |
+ } | |
+ | |
+} | |
+ | |
static void | |
ngx_ssl_info_callback(const ngx_ssl_conn_t *ssl_conn, int where, int ret) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Is this compatible with the current mainline version 1.5.13? Or perhaps with the current stable, 1.4.7? If not, do you knoq what I would need to change? Thanks!