Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
    char   *inner_sni = NULL, *outer_sni = NULL; 
    char    buf[PATH_MAX];

    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    switch (echrv) {
    case SSL_ECH_STATUS_NOT_TRIED:
        snprintf(buf,PATH_MAX, "not attempted");
        break;
    case SSL_ECH_STATUS_FAILED:
        snprintf(buf, PATH_MAX, "tried but failed");
        break;
    case SSL_ECH_STATUS_BAD_NAME:
        snprintf(buf, PATH_MAX, "worked but bad name");
        break;
    case SSL_ECH_STATUS_SUCCESS:
        snprintf(buf, PATH_MAX, "success");
        break;
    case SSL_ECH_STATUS_GREASE:
        snprintf(buf, PATH_MAX, "GREASEd ECH");
        break;
    case SSL_ECH_STATUS_BACKEND:
        snprintf(buf, PATH_MAX, "Backend/inner ECH");
        break;
    default:
        snprintf(buf, PATH_MAX, "error getting ECH status");
        break;
    }
    OPENSSL_free(inner_sni);
    OPENSSL_free(outer_sni);
    s->len = ngx_strlen(buf);
    s->data = ngx_pnalloc(pool, s->len);
    ngx_memcpy(s->data, buf, s->len);
    return NGX_OK;
}

ngx_int_t
ngx_ssl_get_ech_inner_sni(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    int    echrv = SSL_ECH_STATUS_NOT_TRIED;
    char  *inner_sni, *outer_sni;
       
    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    if (echrv == SSL_ECH_STATUS_SUCCESS && inner_sni) {
        s->len = strlen(inner_sni);
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, inner_sni, s->len);
    } else {
        s->len = ngx_strlen("NONE");
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, "NONE", s->len);
    }

Review comment (bug):
I'm not sure `PATH_MAX` is related to these values. Moreover, I suggest short upper-case status strings (`NOT_TRIED`, `FAILED` etc), see `ngx_ssl_get_client_verify()` for example.

Code after:

    if (key[0].expire == 0) {

        /* initialize the current key */

        if (RAND_bytes(buf, 80) != 1) {
            ngx_ssl_error(NGX_LOG_ALERT, log, 0, "RAND_bytes() failed");
            ngx_shmtx_unlock(&shpool->mutex);
            return NGX_ERROR;
        }

        key[0].shared = 1;
        key[0].expire = expire;
        key[0].size = 80;
        ngx_memcpy(key[0].name, buf, 16);
        ngx_memcpy(key[0].hmac_key, buf + 16, 32);
        ngx_memcpy(key[0].aes_key, buf + 48, 32);

        ngx_explicit_memzero(&buf, 80);

        ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0,
                       "ssl ticket key: \"%*xs\"",
                       (size_t) 16, key[0].name);

        /*
         * copy the current key to the next key, as initialization of
         * the previous key will replace the current key with the next
         * key
         */

        key[2] = key[0];
    }

    if (key[1].expire < now) {

        /*
         * if the previous key is no longer needed (or not initialized),
         * replace it with the current key, replace the current key with
         * the next key, and generate new next key
         */

        key[1] = key[0];
        key[0] = key[2];

        if (RAND_bytes(buf, 80) != 1) {
            ngx_ssl_error(NGX_LOG_ALERT, log, 0, "RAND_bytes() failed");
            ngx_shmtx_unlock(&shpool->mutex);
            return NGX_ERROR;
        }

        key[2].shared = 1;