The new directives add_header_inherit and add_trailer_inherit allow to alter inheritance rules for the values specified in the add_header and add_trailer directives in a convenient way. The "merge" parameter enables appending the values from the previous level to the current level values. The "off" parameter cancels inheritance of the values from the previous configuration level, similar to add_header "" (2194e75bb). The "on" parameter (default) enables the standard inheritance behaviour, which is to inherit values from the previous level only if there are no directives on the current level. The inheritance rules themselves are inherited in a standard way. Thus, for example, "add_header_inherit merge;" specified at the top level will be inherited in all nested levels recursively unless redefined below.
Similar to map's volatile parameter, creates a non-cacheable geo variable.
Variables contain the IANA name of the signature scheme[1] used to sign the TLS handshake. Variables are only meaningful when using OpenSSL 3.5 and above, with older versions they are empty. Moreover, since this data isn't stored in a serialized session, variables are only available for new sessions. [1] https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml Requested by willmafh.
After f10bc5a763bb the address was set to NULL only when local address was not specified at all. In case complex value evaluated to an empty or invalid string, local address remained unchanged. Currenrly this is not a problem since the value is only set once. This change is a preparation for being able to change the local address after initial setting.
The change allows modules to use the CONNECT method with HTTP/1.1 requests. To do so, they need to set the "allow_connect" flag in the core server configuration.
The $request_port variable contains the port passed by the client in the request line (for HTTP/1.x) or ":authority" pseudo-header (for HTTP/2 and HTTP/3). If the request line contains no host, or ":authority" is missing, then $request_port is taken from the "Host" header, similar to the $host variable. The $is_request_port variable contains ":" if $request_port is non-empty, and is empty otherwise.
BoringSSL/AWS-LC provide two callbacks for each compression algorithm, which may be used to compress and decompress certificates in runtime. This change implements compression support with zlib, as enabled with the ssl_certificate_compression directive. Compressed certificates are stored in certificate exdata and reused in subsequent connections. Notably, AWS-LC saves an X509 pointer in SSL connection, which allows to use it from SSL_get_certificate() for caching purpose. In contrast, BoringSSL reconstructs X509 on-the-fly, though given that it doesn't support multiple certificates, always replacing previously configured certificates, we use the last configured one from ssl->certs, instead.