Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
ngx_ssl_get_ech_status(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    int    echrv = SSL_ECH_STATUS_NOT_TRIED;
    char  *inner_sni = NULL, *outer_sni = NULL, buf[PATH_MAX];

    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    switch (echrv) {
    case SSL_ECH_STATUS_NOT_TRIED:
        snprintf(buf,PATH_MAX, "NOT_TRIED");
        break;
    case SSL_ECH_STATUS_FAILED:
        snprintf(buf, PATH_MAX, "TRIED_BUT_FAILED");
        break;
    case SSL_ECH_STATUS_BAD_NAME:
        snprintf(buf, PATH_MAX, "WORKED_BAD_NAME");
        break;
    case SSL_ECH_STATUS_SUCCESS:
        snprintf(buf, PATH_MAX, "SUCCESS");
        break;
    case SSL_ECH_STATUS_GREASE:
        snprintf(buf, PATH_MAX, "GREASED");
        break;
    case SSL_ECH_STATUS_BACKEND:
        snprintf(buf, PATH_MAX, "INNER");
        break;
    default:
        snprintf(buf, PATH_MAX, "ERROR");
        break;
    }
    OPENSSL_free(inner_sni);
    OPENSSL_free(outer_sni);
    s->len = ngx_strlen(buf);
    s->data = ngx_pnalloc(pool, s->len);
    ngx_memcpy(s->data, buf, s->len);
    return NGX_OK;
}

ngx_int_t
ngx_ssl_get_ech_inner_sni(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    int    echrv = SSL_ECH_STATUS_NOT_TRIED;
    char  *inner_sni, *outer_sni;
       
    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    if (echrv == SSL_ECH_STATUS_SUCCESS && inner_sni) {
        s->len = strlen(inner_sni);
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, inner_sni, s->len);
    } else {
        s->len = ngx_strlen("NONE");
        s->data = ngx_pnalloc(pool, s->len);

Review comment (suggestion):
There's no `SSL_ECH_STATUS_NOT_CONFIGURED` here, which means that it will be reported as `ERROR`. Not sure if it's ok. We can return something like `NOT_CONFIGURED` here, in addition to `NOT_TRIED` above.

Code after:
            ngx_ssl_error(NGX_LOG_ALERT, log, 0, "RAND_bytes() failed");
            ngx_shmtx_unlock(&shpool->mutex);
            return NGX_ERROR;
        }

        key[0].shared = 1;
        key[0].expire = expire;
        key[0].size = 80;
        ngx_memcpy(key[0].name, buf, 16);
        ngx_memcpy(key[0].hmac_key, buf + 16, 32);
        ngx_memcpy(key[0].aes_key, buf + 48, 32);

        ngx_explicit_memzero(&buf, 80);

        ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0,
                       "ssl ticket key: \"%*xs\"",
                       (size_t) 16, key[0].name);

        /*
         * copy the current key to the next key, as initialization of
         * the previous key will replace the current key with the next
         * key
         */

        key[2] = key[0];
    }

    if (key[1].expire < now) {

        /*
         * if the previous key is no longer needed (or not initialized),
         * replace it with the current key, replace the current key with
         * the next key, and generate new next key
         */

        key[1] = key[0];
        key[0] = key[2];

        if (RAND_bytes(buf, 80) != 1) {
            ngx_ssl_error(NGX_LOG_ALERT, log, 0, "RAND_bytes() failed");
            ngx_shmtx_unlock(&shpool->mutex);
            return NGX_ERROR;
        }

        key[2].shared = 1;
        key[2].expire = 0;
        key[2].size = 80;
        ngx_memcpy(key[2].name, buf, 16);
        ngx_memcpy(key[2].hmac_key, buf + 16, 32);
        ngx_memcpy(key[2].aes_key, buf + 48, 32);