tree 718551f039c7157ad3bd1be67d8142b95cae25a8
parent 223cfb038763c72f57f463a84e486c65d391106d
author Alex Klyubin <klyubin@google.com> 1397524536 -0700
committer Bill Yi <byi@google.com> 1403039984 -0700

CTS test for Heartbleed vulnerability in SSLSocket.

This tests for the Heartbleed vulnerability (CVE-2014-0160) in
OpenSSL by testing client- and server-mode SSLSocket which is
supposed to be backed by OpenSSL by default.

This test spawns an SSLSocket client, SSLServerSocket server, and a
Man-in-The-Middle (MiTM). The client connects to the MiTM which then
connects to the server, and starts forwarding all TLS records between
the client and the server, injecting a malformed HeartbeatRequest
when appropriate. The test passes only if no HeartbeatResponse is
emitted and the TLS handshake either succeeds (heartbeats supported)
or fails with fatal alert unexpected_message (heartbeats not
supported).

Bug: 13906893

(cherry picked from commit db119d1d2ca219091860c68fe7f1892484cb29b2)

Change-Id: Ied9050e299c6725c08bca73703803735393c4324