The "include" directive should be able to include multiple files if given a filename mask. Completes remaining changes introduced in da4ffd8. Closes: https://github.com/nginx/nginx/issues/1165
Previously, when alias was used in a location with Dav COPY or MOVE enabled, and the destination URI was shorter than the alias, integer underflow could happen in ngx_http_map_uri_to_path(), which could result in heap buffer overwrite, followed by a possible segfault. With some implementations of memcpy(), the segfault could be avoided and the overwrite could result in a change of the source or destination file names to be outside of the location root. Reported by Calif.io in collaboration with Claude and Anthropic Research.
Previously, a 32-bit overflow could happen while validating atom entries count. This allowed processing of an invalid atom with entrires beyond its boundaries with reads and writes outside of the allocated mp4 buffer. Reported by Prabhav Srinath (sprabhav7).
Previously, data validation checks did not cover the cases when the output contained empty buffers. Such buffers are considered illegal and produce "zero size buf in output" alerts. The change rejects the mp4 files which produce such alerts. Also, the change fixes possible buffer overread and overwrite that could happen while processing empty stco and co64 atoms, as reported by Pavel Kohout (Aisle Research) and Tim Becker.
Updates the proxy module to use HTTP/1.1 as the default protocol when communicating with upstream servers. This change unlocks features such as persistent connections and chunked transfer encoding. Configurations that require HTTP/1.0 can still override the protocol explicitly.
Keepalive is now automatically enabled in the "local" mode for upstreams defined in configuration files. Cached keepalive connections are no longer shared between different locations referencing the same explicit upstream unless keepalive is explicitly configured without the "local" parameter. To disable keepalive entirely, use keepalive 0; inside the upstream block. To allow sharing cached connections between locations, configure keepalive <max_cached>; without the "local" parameter.
The new "local" parameter prevents sharing cached keepalive connections between location blocks. Connections are now reused only within the same location.
Previously, ctx->out was not cleared in ngx_http_grpc_reinit_request(), which could cause queued HTTP/2 control frames (SETTINGS ACK, PING ACK, WINDOW_UPDATE) to be sent on next upstream. Additionally, ctx->in and ctx->busy needs to be cleared to avoid similar problems with buffered request body fixed in cd12dc4f1.
Previously, ctx->out was not cleared in ngx_http_proxy_v2_reinit_request(), which could cause stale HTTP/2 control frames (SETTINGS ACK, PING ACK, WINDOW_UPDATE) queued for the old upstream connection to be sent to a new upstream connection during a retry.