Ios Clients Not Vulnerable To Heartbleed What Does The Source Say

Apple’s language in their assertion that they are not vulnerable to heartbleed on iOS are troubling as they specifically say (via ReCode), “IOS and OS X never incorporated the vulnerable software…”  However, not incorporating the vulnerable OpenSSL software is merely one way that their customers could have been made vulnerable.  What about the Apple SSL/TLS implementation?  Has anyone checked it?  Did they incorporate RFC 6520 for heartbeat support?  I couldn’t find anything Google so figured I would share what I found.

Since the Apple SSL library code is open sourced, we can actually look at the code.  And based on my read of the code, Apple doesn’t even implement the heartbeat extension. https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslHandshake.h doesn’t even define the heartbeat helloextension code 15 in the data structure:

/\* Hello Extensions per RFC 3546 \*/
typedef enum
{
 SSL\_HE\_ServerName = 0,
 SSL\_HE\_MaxFragmentLength = 1,
 SSL\_HE\_ClientCertificateURL = 2,
 SSL\_HE\_TrustedCAKeys = 3,
 SSL\_HE\_TruncatedHMAC = 4,
 SSL\_HE\_StatusReguest = 5,

 /\* ECDSA, RFC 4492 \*/
 SSL\_HE\_EllipticCurves  = 10,
 SSL\_HE\_EC\_PointFormats = 11,

    /\* TLS 1.2 \*/
    SSL\_HE\_SignatureAlgorithms = 13,

    /\* RFC 5746 \*/
    SSL\_HE\_SecureRenegotation = 0xff01,

 /\*
  \* This one is suggested but not formally defined in
  \* I.D.salowey-tls-ticket-07
  \*/
 SSL\_HE\_SessionTicket = 35
} SSLHelloExtensionType;

Then in the implementation https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslHandshakeHello.c, they actually only support one extension, SSL_HE_SecureRenegotation. All others return an error code.

     switch (extType) {
            case SSL\_HE\_SecureRenegotation:
                if(got\_secure\_renegotiation)
                    return errSSLProtocol;            /\* Fail if we already processed one \*/
                got\_secure\_renegotiation = true;
                SSLProcessServerHelloExtension\_SecureRenegotiation(ctx, extLen, p);
                break;
            default:
                /\*
                 Do nothing for other extensions. Per RFC 5246, we should (MUST) error
                 if we received extensions we didnt specify in the Client Hello.
                 Client should also abort handshake if multiple extensions of the same
                 type are found
                 \*/
                break;
        }
```So, it appears from the library code that they would not be vulnerable to this bug at all.