ronantakizawa/codereview-bench huggingface dataset:
Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
    zstream.zalloc = ngx_ssl_cert_compression_alloc;
    zstream.zfree = ngx_ssl_cert_compression_free;
    zstream.opaque = pool;

    rc = 0;

    tmp.len = compressBound(in_len);
    tmp.data = ngx_palloc(pool, tmp.len);
    if (tmp.data == NULL) {
        goto done;
    }

    zstream.next_in = (u_char *) in;
    zstream.avail_in = in_len;
    zstream.next_out = tmp.data;
    zstream.avail_out = tmp.len;

    rc = deflateInit(&zstream, Z_DEFAULT_COMPRESSION);

    if (rc != Z_OK) {
        ngx_log_error(NGX_LOG_ALERT, c->log, 0, "deflateInit() failed: %d", rc);
        goto done;
    }

    rc = deflate(&zstream, Z_FINISH);

    if (rc != Z_STREAM_END) {
        ngx_log_error(NGX_LOG_ALERT, c->log, 0,
                      "deflate(Z_FINISH) failed: %d", rc);
        goto done;
    }

    tmp.len -= zstream.avail_out;

    rc = deflateEnd(&zstream);

    if (rc != Z_OK) {
        ngx_log_error(NGX_LOG_ALERT, c->log, 0, "deflateEnd() failed: %d", rc);
        goto done;
    }

    p = ngx_alloc(sizeof(ngx_str_t) + tmp.len, c->log);
    if (p == NULL) {
        goto done;
    }

    comp = (ngx_str_t *) p;

    comp->len = tmp.len;
    comp->data = p + sizeof(ngx_str_t);


Review comment (performance):
As the result of compression is cached and certificates are usually small (few kb), I think it would be better to use `Z_BEST_COMPRESSION`.

Code after:
    n = sk_X509_num(chain);

    for (i = 0; i < n; i++) {
        x509 = sk_X509_value(chain, i);

        if (X509_STORE_add_cert(store, x509) != 1) {

            if (ngx_ssl_cert_already_in_hash()) {
                continue;
            }

            ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                          "X509_STORE_add_cert(\"%s\") failed", cert->data);
            sk_X509_NAME_pop_free(list, X509_NAME_free);
            sk_X509_pop_free(chain, X509_free);
            return NGX_ERROR;
        }

        name = X509_get_subject_name(x509);
        if (name == NULL) {
            ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                          "X509_get_subject_name(\"%s\") failed", cert->data);
            sk_X509_NAME_pop_free(list, X509_NAME_free);
            sk_X509_pop_free(chain, X509_free);
            return NGX_ERROR;
        }

        name = X509_NAME_dup(name);
        if (name == NULL) {
            sk_X509_NAME_pop_free(list, X509_NAME_free);
            sk_X509_pop_free(chain, X509_free);
            return NGX_ERROR;
        }

#ifdef OPENSSL_IS_BORINGSSL
        if (sk_X509_NAME_find(list, NULL, name) > 0) {
#else
        if (sk_X509_NAME_find(list, name) >= 0) {
#endif
            X509_NAME_free(name);
            continue;
        }

        if (sk_X509_NAME_push(list, name) == 0) {
            sk_X509_NAME_pop_free(list, X509_NAME_free);
            sk_X509_pop_free(chain, X509_free);
            X509_NAME_free(name);
            return NGX_ERROR;
        }
    }
Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
    }

    EVP_PKEY_free(pkey);

    return NGX_OK;
}


ngx_int_t
ngx_ssl_certificate_compression(ngx_conf_t *cf, ngx_ssl_t *ssl,
    ngx_uint_t enable)
{
    if (!enable) {
        return NGX_OK;
    }

#ifdef SSL_OP_NO_RX_CERTIFICATE_COMPRESSION

    if (SSL_CTX_compress_certs(ssl->ctx, 0) != 0) {
        SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TX_CERTIFICATE_COMPRESSION);
    }

#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" ignored, not supported");

#endif

    return NGX_OK;
}


ngx_int_t
ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
    ngx_uint_t prefer_server_ciphers)
{
    if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                      "SSL_CTX_set_cipher_list(\"%V\") failed",
                      ciphers);
        return NGX_ERROR;
    }

    if (prefer_server_ciphers) {
        SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
    }

    return NGX_OK;
}


Review comment (suggestion):
A similar function `ngx_ssl_early_data()` has different text:
```C
    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,                                     
                  "\"ssl_early_data\" is not supported on this platform, "       
                  "ignored"); 
```
The same text exists in `ngx_ssl_session_ticket_keys()`, but the example above looks more relevant.

Code after:
    }

    EVP_PKEY_free(pkey);

    return NGX_OK;
}


ngx_int_t
ngx_ssl_certificate_compression(ngx_conf_t *cf, ngx_ssl_t *ssl,
    ngx_uint_t enable)
{
    if (!enable) {
        return NGX_OK;
    }

#ifdef SSL_OP_NO_TX_CERTIFICATE_COMPRESSION

    if (SSL_CTX_compress_certs(ssl->ctx, 0) == 0) {
        ngx_ssl_error(NGX_LOG_WARN, ssl->log, 0,
                      "SSL_CTX_compress_certs() failed, ignored");
        return NGX_OK;
    }

    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TX_CERTIFICATE_COMPRESSION);

#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" is not supported "
                  "on this platform, ignored");

#endif

    return NGX_OK;
}


ngx_int_t
ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
    ngx_uint_t prefer_server_ciphers)
{
    if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                      "SSL_CTX_set_cipher_list(\"%V\") failed",
                      ciphers);
        return NGX_ERROR;
    }

    if (prefer_server_ciphers) {
        SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" ignored, not supported");

#endif

    return NGX_OK;
}


ngx_int_t
ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
    ngx_uint_t prefer_server_ciphers)
{
    if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                      "SSL_CTX_set_cipher_list(\"%V\") failed",
                      ciphers);
        return NGX_ERROR;
    }

    if (prefer_server_ciphers) {
        SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
    }

    return NGX_OK;
}


ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
    ngx_int_t depth)
{
    int                   n, i;
    char                 *err;
    X509                 *x509;
    X509_NAME            *name;
    X509_STORE           *store;
    STACK_OF(X509)       *chain;
    STACK_OF(X509_NAME)  *list;

    SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);

    SSL_CTX_set_verify_depth(ssl->ctx, depth);

    if (cert->len == 0) {
        return NGX_OK;
    }

    list = sk_X509_NAME_new(ngx_ssl_cmp_x509_name);

Review comment (suggestion):
Why not disable tx compression in the `if (!enable) {...}` block above instead of disabling it for all new ssl context and enabling it back here. Also, seems like enabling tx compression is completely safe anyway.

Code after:
    }

    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TX_CERTIFICATE_COMPRESSION);

#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" is not supported "
                  "on this platform, ignored");

#endif

    return NGX_OK;
}


ngx_int_t
ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
    ngx_uint_t prefer_server_ciphers)
{
    if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                      "SSL_CTX_set_cipher_list(\"%V\") failed",
                      ciphers);
        return NGX_ERROR;
    }

    if (prefer_server_ciphers) {
        SSL_CTX_set_options(ssl->ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
    }

    return NGX_OK;
}


ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
    ngx_int_t depth)
{
    int                   n, i;
    char                 *err;
    X509                 *x509;
    X509_NAME            *name;
    X509_STORE           *store;
    STACK_OF(X509)       *chain;
    STACK_OF(X509_NAME)  *list;

    SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);

    SSL_CTX_set_verify_depth(ssl->ctx, depth);
Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
        {
            ERR_clear_error();
            mask = NGX_SSL_CACHE_INVALIDATE;
            goto retry;
        }

        ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
                      "SSL_use_PrivateKey(\"%s\") failed", key->data);
        return NGX_ERROR;
    }

    EVP_PKEY_free(pkey);

    return NGX_OK;
}


ngx_int_t
ngx_ssl_certificate_compression(ngx_conf_t *cf, ngx_ssl_t *ssl,
    ngx_uint_t enable)
{
    if (!enable) {
        return NGX_OK;
    }

#ifdef SSL_OP_NO_RX_CERTIFICATE_COMPRESSION

    if (SSL_CTX_compress_certs(ssl->ctx, 0) != 0) {
        SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TX_CERTIFICATE_COMPRESSION);
    }

#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" is not supported "
                  "on this platform, ignored");

#endif

    return NGX_OK;
}


ngx_int_t
ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
    ngx_uint_t prefer_server_ciphers)
{
    if (SSL_CTX_set_cipher_list(ssl->ctx, (char *) ciphers->data) == 0) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                      "SSL_CTX_set_cipher_list(\"%V\") failed",
                      ciphers);

Review comment (suggestion):
In the previous patch the other macro `SSL_OP_NO_TX_CERTIFICATE_COMPRESSION` was used . While for these purposes they are equally suitable, I suggest using the same macro. Moreover, this block itself uses the TX macro 2 lines below.

Code after:
        {
            ERR_clear_error();
            mask = NGX_SSL_CACHE_INVALIDATE;
            goto retry;
        }

        ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
                      "SSL_use_PrivateKey(\"%s\") failed", key->data);
        return NGX_ERROR;
    }

    EVP_PKEY_free(pkey);

    return NGX_OK;
}


ngx_int_t
ngx_ssl_certificate_compression(ngx_conf_t *cf, ngx_ssl_t *ssl,
    ngx_uint_t enable)
{
    if (!enable) {
        return NGX_OK;
    }

#ifdef SSL_OP_NO_TX_CERTIFICATE_COMPRESSION

    if (SSL_CTX_compress_certs(ssl->ctx, 0) == 0) {
        ngx_ssl_error(NGX_LOG_WARN, ssl->log, 0,
                      "SSL_CTX_compress_certs() failed, ignored");
        return NGX_OK;
    }

    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TX_CERTIFICATE_COMPRESSION);

#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" is not supported "
                  "on this platform, ignored");

#endif

    return NGX_OK;
}


ngx_int_t
ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
    ngx_uint_t prefer_server_ciphers)
{
Repository: nginx/nginx
File: src/http/v2/ngx_http_v2.c (C)

Code before:
    }

    h->hash = ngx_hash(ngx_hash(ngx_hash('h', 'o'), 's'), 't');

    h->key.len = host.len;
    h->key.data = host.data;

    h->value.len = value->len;
    h->value.data = value->data;

    h->lowcase_key = host.data;

    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);

    hh = ngx_hash_find(&cmcf->headers_in_hash, h->hash,
                       h->lowcase_key, h->key.len);

    if (hh == NULL) {
        ngx_http_v2_close_stream(r->stream, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_ERROR;
    }

    if (hh->handler(r, h, hh->offset) != NGX_OK) {
        /*
         * request has been finalized already
         * in ngx_http_process_host()
         */
        return NGX_ABORT;
    }

    return NGX_OK;
}


static void
ngx_http_v2_run_request(ngx_http_request_t *r)
{
    ngx_str_t                  host;
    ngx_connection_t          *fc;
    ngx_http_v2_srv_conf_t    *h2scf;
    ngx_http_v2_connection_t  *h2c;

    fc = r->connection;

    h2scf = ngx_http_get_module_srv_conf(r, ngx_http_v2_module);

    if (!h2scf->enable && !r->http_connection->addr_conf->http2) {
        ngx_log_error(NGX_LOG_INFO, fc->log, 0,
                      "client attempted to request the server name "
                      "for which the negotiated protocol is disabled");


Review comment (bug):
One more change in this function could be returning `NGX_ERROR` instead of `NGX_ABORT` when `hh->handler()` failed, to make it similar to `ngx_http_v2_construct_cookie_header()`.

Code after:
    h = ngx_list_push(&r->headers_in.headers);
    if (h == NULL) {
        ngx_http_v2_close_stream(r->stream, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_ERROR;
    }

    h->hash = ngx_hash(ngx_hash(ngx_hash('h', 'o'), 's'), 't');

    h->key.len = host.len;
    h->key.data = host.data;

    h->value.len = r->host_end - r->host_start;
    h->value.data = r->host_start;

    h->lowcase_key = host.data;

    cmcf = ngx_http_get_module_main_conf(r, ngx_http_core_module);

    hh = ngx_hash_find(&cmcf->headers_in_hash, h->hash,
                       h->lowcase_key, h->key.len);

    if (hh == NULL) {
        ngx_http_v2_close_stream(r->stream, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_ERROR;
    }

    if (hh->handler(r, h, hh->offset) != NGX_OK) {
        /*
         * request has been finalized already
         * in ngx_http_process_host()
         */
        return NGX_ERROR;
    }

    return NGX_OK;
}


static void
ngx_http_v2_run_request(ngx_http_request_t *r)
{
    ngx_str_t                  host;
    ngx_connection_t          *fc;
    ngx_http_v2_srv_conf_t    *h2scf;
    ngx_http_v2_connection_t  *h2c;

    fc = r->connection;

    h2scf = ngx_http_get_module_srv_conf(r, ngx_http_v2_module);

    if (!h2scf->enable && !r->http_connection->addr_conf->http2) {
Repository: nginx/nginx
File: src/http/v2/ngx_http_v2.c (C)

Code before:
                      "client sent duplicate \":authority\" header");
        return NGX_DECLINED;
    }

    r->host_start = value->data;
    r->host_end = value->data + value->len;

    rc = ngx_http_validate_host(value, r->pool, 0);

    if (rc == NGX_DECLINED) {
        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                      "client sent invalid \":authority\" header");
        return NGX_DECLINED;
    }

    if (rc == NGX_ERROR) {
        return NGX_ERROR;
    }

    if (ngx_http_set_virtual_server(r, value) == NGX_ERROR) {
        return NGX_ERROR;
    }

    r->headers_in.server = *value;

    return NGX_OK;
}


static ngx_int_t
ngx_http_v2_construct_request_line(ngx_http_request_t *r)
{
    u_char  *p;

    static const u_char ending[] = " HTTP/2.0";

    if (r->method_name.len == 0
        || r->schema.len == 0
        || r->unparsed_uri.len == 0)
    {
        if (r->method_name.len == 0) {
            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                          "client sent no :method header");

        } else if (r->schema.len == 0) {
            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                          "client sent no :scheme header");

        } else {
            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                          "client sent no :path header");

Review comment (suggestion):
Here `NGX_ABORT` should be returned. A similar function `ngx_http_v2_parse_path()` also has a comment about it. Having a similar comment here cold be good.

Code after:
        return NGX_DECLINED;
    }

    r->host_start = value->data;
    r->host_end = value->data + value->len;

    rc = ngx_http_validate_host(value, r->pool, 0);

    if (rc == NGX_DECLINED) {
        ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                      "client sent invalid \":authority\" header");
        return NGX_DECLINED;
    }

    if (rc == NGX_ERROR) {
        ngx_http_v2_close_stream(r->stream, NGX_HTTP_INTERNAL_SERVER_ERROR);
        return NGX_ABORT;
    }

    if (ngx_http_set_virtual_server(r, value) == NGX_ERROR) {
        /*
         * request has been finalized already
         * in ngx_http_set_virtual_server()
         */
        return NGX_ABORT;
    }

    r->headers_in.server = *value;

    return NGX_OK;
}


static ngx_int_t
ngx_http_v2_construct_request_line(ngx_http_request_t *r)
{
    u_char  *p;

    static const u_char ending[] = " HTTP/2.0";

    if (r->method_name.len == 0
        || r->schema.len == 0
        || r->unparsed_uri.len == 0)
    {
        if (r->method_name.len == 0) {
            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                          "client sent no :method header");

        } else if (r->schema.len == 0) {
            ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
                          "client sent no :scheme header");
Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
#endif

    return NGX_OK;
}


#if (NGX_ZLIB && defined TLSEXT_cert_compression_zlib)

static int
ngx_ssl_cert_compression_callback(ngx_ssl_conn_t *ssl_conn, CBB *out,
    const uint8_t *in, size_t in_len)
{
    int                rc;
    u_char            *p;
    SSL_CTX           *ssl_ctx;
    z_stream           zstream;
    ngx_str_t         *comp, tmp;
    ngx_pool_t        *pool;
    ngx_connection_t  *c;

    ssl_ctx = SSL_get_SSL_CTX(ssl_conn);
    comp = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_certificate_comp_index);

    if (comp != NULL) {
        return CBB_add_bytes(out, comp->data, comp->len);
    }

    c = ngx_ssl_get_connection(ssl_conn);

    pool = ngx_create_pool(256, c->log);
    if (pool == NULL) {
        return 0;
    }

    pool->log = c->log;

    ngx_memzero(&zstream, sizeof(z_stream));

    zstream.zalloc = ngx_ssl_cert_compression_alloc;
    zstream.zfree = ngx_ssl_cert_compression_free;
    zstream.opaque = pool;

    rc = 0;

    tmp.len = compressBound(in_len);
    tmp.data = ngx_palloc(pool, tmp.len);
    if (tmp.data == NULL) {
        goto done;
    }

    zstream.next_in = (u_char *) in;

Review comment (suggestion):
This assumes that the compressed chain will never change during the SSL_CTX lifetime. I've confirmed the following with BoringSSL and AWS-LC:

* a single certificate/key pair is allowed on the context
* compression will not be negotiated for certificates set in the certificate callback

The former is a documented behavior, but I can't find what guarantees the latter.

Code after:


ngx_int_t
ngx_ssl_certificate_compression(ngx_conf_t *cf, ngx_ssl_t *ssl,
    ngx_uint_t enable)
{
    if (!enable) {
        return NGX_OK;
    }

#ifdef SSL_OP_NO_TX_CERTIFICATE_COMPRESSION

    if (SSL_CTX_compress_certs(ssl->ctx, 0) == 0) {
        ngx_ssl_error(NGX_LOG_WARN, ssl->log, 0,
                      "SSL_CTX_compress_certs() failed, ignored");
        return NGX_OK;
    }

    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TX_CERTIFICATE_COMPRESSION);

#elif (NGX_ZLIB && defined TLSEXT_cert_compression_zlib)

    if (SSL_CTX_add_cert_compression_alg(ssl->ctx, TLSEXT_cert_compression_zlib,
                                         ngx_ssl_cert_compression_callback,
                                         NULL)
        == 0)
    {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
                      "SSL_CTX_add_cert_compression_alg() failed");
        return NGX_ERROR;
    }

#else

    ngx_log_error(NGX_LOG_WARN, ssl->log, 0,
                  "\"ssl_certificate_compression\" is not supported "
                  "on this platform, ignored");

#endif

    return NGX_OK;
}


#if (NGX_ZLIB && defined TLSEXT_cert_compression_zlib)

static int
ngx_ssl_cert_compression_callback(ngx_ssl_conn_t *ssl_conn, CBB *out,
    const uint8_t *in, size_t in_len)
{
    int                rc;
Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
        ngx_memcpy(pwd->data, opwd[i].data, opwd[i].len);
    }

    return pwds;
}


static void
ngx_ssl_passwords_cleanup(void *data)
{
    ngx_array_t *passwords = data;

    ngx_str_t   *pwd;
    ngx_uint_t   i;

    pwd = passwords->elts;

    for (i = 0; i < passwords->nelts; i++) {
        ngx_explicit_memzero(pwd[i].data, pwd[i].len);
    }
}


#ifndef OPENSSL_NO_ECH
/* load key files called <name>.ech we find in the ssl_echkeydir directory */
static int load_echkeys(ngx_ssl_t *ssl, ngx_str_t *dirname)
{
    /* 1024 private key files (maxkeyfiles) is plenty */
    int              somekeyworked = 0, numkeys = 0, maxkeyfiles=1024;
    char            *den = NULL, *last4 = NULL;
    size_t           elen = dirname->len, nlen = 0;
    struct stat      thestat;
    ngx_dir_t        thedir;
    ngx_int_t        nrv = ngx_open_dir(dirname, &thedir);
    OSSL_ECHSTORE  * const es = OSSL_ECHSTORE_new(NULL, NULL);
    char             privname[PATH_MAX];

    if (es == NULL) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
            "load_echkeys, error allocating store" , __LINE__);
        return NGX_ERROR;
    }
    if (nrv != NGX_OK) {
        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
            "load_echkeys, error opening %s at %d", dirname->data, __LINE__);
        return NGX_ERROR;
    }
    for (;;) {
        nrv=ngx_read_dir(&thedir);
        if (nrv != NGX_OK) {
            break;

Review comment (suggestion):
All functions in this file have a prefix `ngx_ssl_`.

Also, we prefer `ngx_int_t` as the return type.

Code after:
                SSL_SESSION_set_timeout(sess, timeout - (now - time));
            }
        }
    }

#endif

    if ((where & SSL_CB_ACCEPT_LOOP) == SSL_CB_ACCEPT_LOOP) {
        c = ngx_ssl_get_connection((ngx_ssl_conn_t *) ssl_conn);

        if (!c->ssl->handshake_buffer_set) {
            /*
             * By default OpenSSL uses 4k buffer during a handshake,
             * which is too low for long certificate chains and might
             * result in extra round-trips.
             *
             * To adjust a buffer size we detect that buffering was added
             * to write side of the connection by comparing rbio and wbio.
             * If they are different, we assume that it's due to buffering
             * added to wbio, and set buffer size.
             */

            rbio = SSL_get_rbio(ssl_conn);
            wbio = SSL_get_wbio(ssl_conn);

            if (rbio != wbio) {
                (void) BIO_set_write_buffer_size(wbio, NGX_SSL_BUFSIZE);
                c->ssl->handshake_buffer_set = 1;
            }
        }
    }
}


static int
ngx_ssl_cmp_x509_name(const X509_NAME *const *a, const X509_NAME *const *b)
{
    return (X509_NAME_cmp(*a, *b));
}


ngx_array_t *
ngx_ssl_read_password_file(ngx_conf_t *cf, ngx_str_t *file)
{
    u_char              *p, *last, *end;
    size_t               len;
    ssize_t              n;
    ngx_fd_t             fd;
    ngx_str_t           *pwd;
    ngx_array_t         *passwords;
    ngx_pool_cleanup_t  *cln;