Repository: nginx/nginx
File: src/event/ngx_event_openssl.c (C)

Code before:
        snprintf(buf, PATH_MAX, "error getting ECH status");
        break;
    }
    OPENSSL_free(inner_sni);
    OPENSSL_free(outer_sni);
    s->len = ngx_strlen(buf);
    s->data = ngx_pnalloc(pool, s->len);
    ngx_memcpy(s->data, buf, s->len);
    return NGX_OK;
}

ngx_int_t
ngx_ssl_get_ech_inner_sni(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    int    echrv = SSL_ECH_STATUS_NOT_TRIED;
    char  *inner_sni, *outer_sni;
       
    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    if (echrv == SSL_ECH_STATUS_SUCCESS && inner_sni) {
        s->len = strlen(inner_sni);
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, inner_sni, s->len);
    } else {
        s->len = ngx_strlen("NONE");
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, "NONE", s->len);
    }
    OPENSSL_free(inner_sni);
    OPENSSL_free(outer_sni);
    return NGX_OK;
}

ngx_int_t
ngx_ssl_get_ech_outer_sni(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
    int    echrv = SSL_ECH_STATUS_NOT_TRIED;
    char  *inner_sni, *outer_sni;

    echrv = SSL_ech_get1_status(c->ssl->connection, &inner_sni, &outer_sni);
    if (echrv == SSL_ECH_STATUS_SUCCESS && outer_sni) {
        s->len = strlen(outer_sni);
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, outer_sni, s->len);
    } else {
        s->len = ngx_strlen("NONE");
        s->data = ngx_pnalloc(pool, s->len);
        ngx_memcpy(s->data, "NONE", s->len);
    }
    OPENSSL_free(inner_sni);
    OPENSSL_free(outer_sni);
    return NGX_OK;

Review comment (suggestion):
The `NONE` value can be confused with an actual SNI value, so I'd remove it. Let's return an empty string if the inner/outer SNI it's not available.

Code after:
        /*
         * copy the current key to the next key, as initialization of
         * the previous key will replace the current key with the next
         * key
         */

        key[2] = key[0];
    }

    if (key[1].expire < now) {

        /*
         * if the previous key is no longer needed (or not initialized),
         * replace it with the current key, replace the current key with
         * the next key, and generate new next key
         */

        key[1] = key[0];
        key[0] = key[2];

        if (RAND_bytes(buf, 80) != 1) {
            ngx_ssl_error(NGX_LOG_ALERT, log, 0, "RAND_bytes() failed");
            ngx_shmtx_unlock(&shpool->mutex);
            return NGX_ERROR;
        }

        key[2].shared = 1;
        key[2].expire = 0;
        key[2].size = 80;
        ngx_memcpy(key[2].name, buf, 16);
        ngx_memcpy(key[2].hmac_key, buf + 16, 32);
        ngx_memcpy(key[2].aes_key, buf + 48, 32);

        ngx_explicit_memzero(&buf, 80);

        ngx_log_debug2(NGX_LOG_DEBUG_EVENT, log, 0,
                       "ssl ticket key: \"%*xs\"",
                       (size_t) 16, key[2].name);
    }

    /*
     * update expiration of the current key: it is going to be needed
     * at least till the session being created expires
     */

    if (expire > key[0].expire) {
        key[0].expire = expire;
    }

    /* sync keys to the worker process memory */