Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
ngx_ssl_get_protocol(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    s->data = (u_char *) SSL_get_version(c->ssl->connection);
    return NGX_OK;
}


ngx_int_t
ngx_ssl_get_cipher_name(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    s->data = (u_char *) SSL_get_cipher_name(c->ssl->connection);
    return NGX_OK;
}


#ifndef OPENSSL_NO_ECH
ngx_int_t
ngx_ssl_get_ech_status(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    int    echrv = SSL_ECH_STATUS_NOT_TRIED;
    char  *inner_sni = NULL, *outer_sni = NULL, buf[PATH_MAX];

    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    switch (echrv) {
    case SSL_ECH_STATUS_NOT_TRIED:
        snprintf(buf,PATH_MAX, "NOT_TRIED");
        break;
    case SSL_ECH_STATUS_FAILED:
        snprintf(buf, PATH_MAX, "TRIED_BUT_FAILED");
        break;
    case SSL_ECH_STATUS_BAD_NAME:
        snprintf(buf, PATH_MAX, "WORKED_BAD_NAME");
        break;
    case SSL_ECH_STATUS_SUCCESS:
        snprintf(buf, PATH_MAX, "SUCCESS");
        break;
    case SSL_ECH_STATUS_GREASE:
        snprintf(buf, PATH_MAX, "GREASED");
        break;
    case SSL_ECH_STATUS_BACKEND:
        snprintf(buf, PATH_MAX, "INNER");
        break;
    default:
        snprintf(buf, PATH_MAX, "ERROR");
        break;
    }
    OPENSSL_free(inner_sni);
    OPENSSL_free(outer_sni);
    s->len = ngx_strlen(buf);
    s->data = ngx_pnalloc(pool, s->len);
    ngx_memcpy(s->data, buf, s->len);

Review comment (suggestion):
Here and below there's no need to allocate the buffers and copy memory. The following is enough, see an example [here](https://github.com/nginx/nginx/blob/78d1ab5a2c00839a36ff6bac661d9785fce3c1a4/src/event/ngx_event_openssl.c#L6084):
```
ngx_str_set(s, "NOT_TRIED");
break;
```

Code after:
        return NGX_OK;
    }

    shm_zone = SSL_CTX_get_ex_data(ssl_ctx, ngx_ssl_session_cache_index);

    cache = shm_zone->data;
    shpool = (ngx_slab_pool_t *) shm_zone->shm.addr;

    ngx_shmtx_lock(&shpool->mutex);

    key = cache->ticket_keys;

    if (key[0].expire == 0) {

        /* initialize the current key */

        if (RAND_bytes(buf, 80) != 1) {
            ngx_ssl_error(NGX_LOG_ALERT, log, 0, "RAND_bytes() failed");
            ngx_shmtx_unlock(&shpool->mutex);
            return NGX_ERROR;
        }

        key[0].shared = 1;
        key[0].expire = expire;
        key[0].size = 80;
        ngx_memcpy(key[0].name, buf, 16);
        ngx_memcpy(key[0].hmac_key, buf + 16, 32);
        ngx_memcpy(key[0].aes_key, buf + 48, 32);

        ngx_explicit_memzero(&buf, 80);

        ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0,
                       "ssl ticket key: \"%*xs\"",
                       (size_t) 16, key[0].name);

        /*
         * copy the current key to the next key, as initialization of
         * the previous key will replace the current key with the next
         * key
         */

        key[2] = key[0];
    }

    if (key[1].expire < now) {

        /*
         * if the previous key is no longer needed (or not initialized),
         * replace it with the current key, replace the current key with
         * the next key, and generate new next key
         */