commit e4c04f933b737ca49114058c12c5ab37d667f87d
author Sergey Kandaurov <pluknet@nginx.com> Wed Aug 04 21:27:51 2021 +0300
committer Sergey Kandaurov <pluknet@nginx.com> Wed Aug 04 21:27:51 2021 +0300
tree 256b61d575a61596a2ac4dee58e6c7ba99828c5f
parent a230ce20bb91ed980a93d7f3c104091516baca35

SSL: SSL_CTX_set_tmp_dh() error handling.

For example, it can fail due to weak DH parameters.

src/event/ngx_event_openssl.c

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 60cc358..2a0d005 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1376,7 +1376,13 @@
         return NGX_ERROR;
     }
 
-    SSL_CTX_set_tmp_dh(ssl->ctx, dh);
+    if (SSL_CTX_set_tmp_dh(ssl->ctx, dh) != 1) {
+        ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+                      "SSL_CTX_set_tmp_dh(\"%s\") failed", file->data);
+        DH_free(dh);
+        BIO_free(bio);
+        return NGX_ERROR;
+    }
 
     DH_free(dh);
     BIO_free(bio);