Repository: nginx/nginx
File: src/http/ngx_http_upstream.c (C)

Code before:
     * in the "http" section to inherit it to all servers
     */

    if (prev->hide_headers_hash.buckets == NULL
        && conf->hide_headers == prev->hide_headers
        && conf->pass_headers == prev->pass_headers)
    {
        prev->hide_headers_hash = conf->hide_headers_hash;
    }

    return NGX_OK;
}


#if (NGX_HTTP_SSL)

ngx_int_t
ngx_http_upstream_preserve_ssl_passwords(ngx_conf_t *cf,
    ngx_http_upstream_conf_t *conf, ngx_http_upstream_conf_t *prev)
{
    ngx_uint_t  preserve;

    if ((conf->ssl_certificate == NULL
         || conf->ssl_certificate->lengths == NULL)
        && (conf->ssl_certificate_key == NULL
            || conf->ssl_certificate_key->lengths == NULL))
    {
        return NGX_OK;
    }

    if (conf->ssl_passwords == prev->ssl_passwords
        && conf->ssl_passwords != NULL)
    {
        if (conf->ssl_passwords->pool != cf->temp_pool) {
            return NGX_OK;
        }

        preserve = 1;

    } else {
        preserve = 0;
    }

    conf->ssl_passwords = ngx_ssl_preserve_passwords(cf, conf->ssl_passwords);
    if (conf->ssl_passwords == NULL) {
        return NGX_ERROR;
    }

    /*
     * special handling to keep a preserved ssl_passwords copy
     * in the previous configuration to inherit it to all children

Review comment (suggestion):
I wonder why you changed the condition from #458, see https://github.com/nginx/nginx/pull/458/commits/9689ff2658e94f02c0822d8e2a9c2ff73064540d. I think that condition was correct, but this one skips a few cases. That condition came directly from runtime.

In particular, if ssl_certificate is an empty string and ssl_certificate_keys has variables, we don't have to preserve passwords. Also, if there's no ssl_certificate at all, but again, ssl_certificate_key is defined and has variables, we don't have to preserve passwords as well, but will in this case. Similarly, if there's no ssl_certificate_key, but ssl_certificate is specified with variables, there's no point in preserving passwords since an error will be generated later in `ngx_http_proxy_set_ssl()`.

Code after:
     * in the "http" section to inherit it to all servers
     */

    if (prev->hide_headers_hash.buckets == NULL
        && conf->hide_headers == prev->hide_headers
        && conf->pass_headers == prev->pass_headers)
    {
        prev->hide_headers_hash = conf->hide_headers_hash;
    }

    return NGX_OK;
}


#if (NGX_HTTP_SSL)

ngx_int_t
ngx_http_upstream_merge_ssl_passwords(ngx_conf_t *cf,
    ngx_http_upstream_conf_t *conf, ngx_http_upstream_conf_t *prev)
{
    ngx_uint_t  preserve;

    ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);

    if (conf->ssl_certificate == NULL
        || conf->ssl_certificate->value.len == 0
        || conf->ssl_certificate_key == NULL)
    {
        return NGX_OK;
    }

    if (conf->ssl_certificate->lengths == NULL
        && conf->ssl_certificate_key->lengths == NULL)
    {
        if (conf->ssl_passwords && conf->ssl_passwords->pool == NULL) {
            /* un-preserve empty password list */
            conf->ssl_passwords = NULL;
        }

        return NGX_OK;
    }

    if (conf->ssl_passwords && conf->ssl_passwords->pool != cf->temp_pool) {
        /* already preserved */
        return NGX_OK;
    }

    preserve = (conf->ssl_passwords == prev->ssl_passwords) ? 1 : 0;

    conf->ssl_passwords = ngx_ssl_preserve_passwords(cf, conf->ssl_passwords);
    if (conf->ssl_passwords == NULL) {