commit 874b5d4fea4a126ef4af2eb39e35da7e35bf3856
author Sergey Kandaurov <pluknet@nginx.com> Mon Sep 12 18:57:42 2016 +0300
committer Sergey Kandaurov <pluknet@nginx.com> Mon Sep 12 18:57:42 2016 +0300
tree e262523eb8fbbaa79dde04943c03256ae69afc5e
parent b35795f3d6f8c7c8b8edcfe6704f8a2083d21bdd

SSL: improved session ticket callback error handling.

Prodded by Guido Vranken.

src/event/ngx_event_openssl.c

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 440bb5a..1cbfdf2 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -2982,9 +2982,26 @@
                        ngx_hex_dump(buf, key[0].name, 16) - buf, buf,
                        SSL_session_reused(ssl_conn) ? "reused" : "new");
 
-        RAND_bytes(iv, EVP_CIPHER_iv_length(cipher));
-        EVP_EncryptInit_ex(ectx, cipher, NULL, key[0].aes_key, iv);
+        if (RAND_bytes(iv, EVP_CIPHER_iv_length(cipher)) != 1) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "RAND_bytes() failed");
+            return -1;
+        }
+
+        if (EVP_EncryptInit_ex(ectx, cipher, NULL, key[0].aes_key, iv) != 1) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
+                          "EVP_EncryptInit_ex() failed");
+            return -1;
+        }
+
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+        if (HMAC_Init_ex(hctx, key[0].hmac_key, 16, digest, NULL) != 1) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
+            return -1;
+        }
+#else
         HMAC_Init_ex(hctx, key[0].hmac_key, 16, digest, NULL);
+#endif
+
         ngx_memcpy(name, key[0].name, 16);
 
         return 1;
@@ -3011,8 +3028,20 @@
                        ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
                        (i == 0) ? " (default)" : "");
 
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+        if (HMAC_Init_ex(hctx, key[i].hmac_key, 16, digest, NULL) != 1) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
+            return -1;
+        }
+#else
         HMAC_Init_ex(hctx, key[i].hmac_key, 16, digest, NULL);
-        EVP_DecryptInit_ex(ectx, cipher, NULL, key[i].aes_key, iv);
+#endif
+
+        if (EVP_DecryptInit_ex(ectx, cipher, NULL, key[i].aes_key, iv) != 1) {
+            ngx_ssl_error(NGX_LOG_ALERT, c->log, 0,
+                          "EVP_DecryptInit_ex() failed");
+            return -1;
+        }
 
         return (i == 0) ? 1 : 2 /* renew */;
     }