Repository: nginx/nginx
File: src/http/ngx_http_upstream.c (C)

Code before:
    hash->temp_pool = NULL;

    if (ngx_hash_init(hash, hide_headers.elts, hide_headers.nelts) != NGX_OK) {
        return NGX_ERROR;
    }

    /*
     * special handling to preserve conf->hide_headers_hash
     * in the "http" section to inherit it to all servers
     */

    if (prev->hide_headers_hash.buckets == NULL
        && conf->hide_headers == prev->hide_headers
        && conf->pass_headers == prev->pass_headers)
    {
        prev->hide_headers_hash = conf->hide_headers_hash;
    }

    return NGX_OK;
}


#if (NGX_HTTP_SSL)

ngx_int_t
ngx_http_upstream_preserve_ssl_passwords(ngx_conf_t *cf,
    ngx_http_upstream_conf_t *conf, ngx_http_upstream_conf_t *prev)
{
    ngx_uint_t  preserve;

    if ((conf->ssl_certificate == NULL
         || conf->ssl_certificate->lengths == NULL)
        && (conf->ssl_certificate_key == NULL
            || conf->ssl_certificate_key->lengths == NULL))
    {
        return NGX_OK;
    }

    if (conf->ssl_passwords == prev->ssl_passwords
        && conf->ssl_passwords != NULL)
    {
        if (conf->ssl_passwords->pool != cf->temp_pool) {
            return NGX_OK;
        }

        preserve = 1;

    } else {
        preserve = 0;
    }


Review comment (suggestion):
I agree that having this function in ngx_http_upstream.c for all upstream modules reduces the amount of code compared to having a separate copy in each module. My only concern is that we currently don't do that in this part of nginx. Both `ngx_http_proxy_set_ssl()` and `ngx_http_proxy_merge_ssl()` as well as their friends are implemented in the respective modules. Having said that, these functions are not fully identical. Also, we do have common configuration-related functions in the upstream module: `ngx_http_upstream_bind_set_slot()` and `ngx_http_upstream_param_set_slot()`.

I'm not fully convinced this is the right way to do it, but I don't have strong arguments against it.

Also, this function could probably be moved to other ssl-reated functions under the existing `#if (NGX_HTTP_SSL)` block.

Code after:
    hash->temp_pool = NULL;

    if (ngx_hash_init(hash, hide_headers.elts, hide_headers.nelts) != NGX_OK) {
        return NGX_ERROR;
    }

    /*
     * special handling to preserve conf->hide_headers_hash
     * in the "http" section to inherit it to all servers
     */

    if (prev->hide_headers_hash.buckets == NULL
        && conf->hide_headers == prev->hide_headers
        && conf->pass_headers == prev->pass_headers)
    {
        prev->hide_headers_hash = conf->hide_headers_hash;
    }

    return NGX_OK;
}


#if (NGX_HTTP_SSL)

ngx_int_t
ngx_http_upstream_merge_ssl_passwords(ngx_conf_t *cf,
    ngx_http_upstream_conf_t *conf, ngx_http_upstream_conf_t *prev)
{
    ngx_uint_t  preserve;

    ngx_conf_merge_ptr_value(conf->ssl_passwords, prev->ssl_passwords, NULL);

    if (conf->ssl_certificate == NULL
        || conf->ssl_certificate->value.len == 0
        || conf->ssl_certificate_key == NULL)
    {
        return NGX_OK;
    }

    if (conf->ssl_certificate->lengths == NULL
        && conf->ssl_certificate_key->lengths == NULL)
    {
        if (conf->ssl_passwords && conf->ssl_passwords->pool == NULL) {
            /* un-preserve empty password list */
            conf->ssl_passwords = NULL;
        }

        return NGX_OK;
    }

    if (conf->ssl_passwords && conf->ssl_passwords->pool != cf->temp_pool) {