fix(security): prevent session hijack via cleanup OOM and stale credential reuse

[Copilot]

Two security vulnerabilities in the NTLM upstream module's session/connection cache allow an authenticated upstream session to be handed to the wrong client.

Finding 1 — Session hijack via cleanup handler registration failure (Critical)

ngx_pool_cleanup_add returning NULL was silently ignored: the upstream connection was still inserted into the cache with a client_connection pointer that nginx may later recycle for a different client. get_ntlm_peer matches purely on that pointer, so the new client inherits the old authenticated session (ABA pointer-reuse hijack).

Fix: on NULL return, undo the cache insertion (clear in_cache, null both connection pointers, return item to free list) and goto invalid. Log at NGX_LOG_ERR instead of NGX_LOG_DEBUG so the failure is visible in production.

if (cln == NULL) {
    ngx_log_error(NGX_LOG_ERR, pc->log, 0,
                  "ntlm: failed to allocate cleanup handler,"
                  " not caching upstream connection");
    item->in_cache = 0;
    item->peer_connection = NULL;
    item->client_connection = NULL;
    ngx_queue_remove(q);
    ngx_queue_insert_head(&hndp->conf->free, q);
    goto invalid;
}

Finding 2 — Stale credential reuse on an established connection (High)

When a subsequent request on the same keep-alive client TCP connection arrives with new NTLM/Negotiate credentials, the module previously ignored them and silently reused the existing authenticated upstream session.

Fix: in get_ntlm_peer, before committing to a cache hit, evict and close the old session when ntlm_init == 1 (new credentials present) and c->requests >= 2 (handshake complete). The >= 2 threshold is intentional: the NTLM Type-3 message must reuse the same upstream TCP connection as the Type-1 exchange (c->requests == 1 at that point); only post-handshake re-authentication attempts are rejected.

if (hndp->ntlm_init && c->requests >= 2) {
    item->in_cache = 0;
    item->peer_connection = NULL;
    ngx_queue_remove(q);
    ngx_queue_insert_head(&hndp->conf->free, q);
    ngx_http_upstream_ntlm_close(c);
    break;  /* fall through → NGX_OK → fresh upstream connection */
}

Test

Adds TEST 5 to t/001-sanity.t: three pipelined requests on one client TCP connection — NTLM token_A, no auth, NTLM token_B — asserting the third response carries X-NGX-NTLM-AUTH: token_B, not token_A.