tree 2106b91b15a9dbea7db08c7b749b17528270edd5
parent 84815006a0a00ab00f0371c43685f09f6b5df8d8
author Willy Tarreau <w@1wt.eu> 1398462262 +0200
committer Willy Tarreau <w@1wt.eu> 1398462501 +0200
encoding latin1

BUG/MINOR: ssl: really block OpenSSL's response to heartbleed attack

Recent commit f51c698 ("MEDIUM: ssl: implement a workaround for the
OpenSSL heartbleed attack") did not always work well, because OpenSSL
is fun enough for not testing errors before sending data... So the
output sometimes contained some data.

The OpenSSL code relies on the max_send_segment value to limit the
packet length. The code ensures that a value of zero will result in
no single byte leaking. So we're forcing this instead and that
definitely fixes the issue. Note that we need to set it the hard
way since the regular API checks for valid values.