- Dec 14, 2019
-
-
Audrey Eschright authored
PR-URL: https://github.com/nodejs/node/pull/30904 Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Jiawen Geng <technicalcute@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Daijiro Wachi <daijiro.wachi@gmail.com>
-
- Oct 10, 2019
-
-
Beth Griggs authored
PR-URL: https://github.com/nodejs/node/pull/29617
-
- Oct 09, 2019
-
-
Beth Griggs authored
Node.js 8 is due to go End-of-Life on 31st December 2019. Notable changes: - **deps**: upgrade openssl sources to 1.0.2s (Sam Roberts) [#28230](https://github.com/nodejs/node/pull/28230) PR-URL: https://github.com/nodejs/node/pull/29617
-
- Sep 25, 2019
-
-
Anna Henningsen authored
Don’t start reading more input data if we’re still busy writing output. This was overlooked in 8a4a1931. Fixes: https://github.com/nodejs/node/issues/29353 Fixes: https://github.com/nodejs/node/issues/29393 PR-URL: https://github.com/nodejs/node/pull/29399 Backport-PR-URL: https://github.com/nodejs/node/pull/29618 Reviewed-By:
David Carlier <devnexen@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com>
-
Anna Henningsen authored
Do not crash when the session is no longer available. Fixes: https://github.com/nodejs/node/issues/29457 PR-URL: https://github.com/nodejs/node/pull/29459 Backport-PR-URL: https://github.com/nodejs/node/pull/29618 Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
Minwoo Jung <minwoo@nodesource.com> Reviewed-By:
-
- Sep 20, 2019
-
-
João Reis authored
When CMD is used to launch a process and CMD is killed too quickly, the process can stay behind running in suspended state, never completing. This only happens in Windows Server 2008R2. Refs: https://github.com/nodejs/build/issues/1829 PR-URL: https://github.com/nodejs/node/pull/28723 Reviewed-By:
Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By:
-
Matteo Collina authored
socket.parser can be undefined under unknown circumstances. This is a fix for a bug I cannot reproduce but it is affecting people. Fixes: https://github.com/nodejs/node/issues/26366 PR-URL: https://github.com/nodejs/node/pull/26402 Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 Backport-PR-URL: https://github.com/nodejs/node/pull/28230 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 Backport-PR-URL: https://github.com/nodejs/node/pull/28230 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 Backport-PR-URL: https://github.com/nodejs/node/pull/28230 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 Backport-PR-URL: https://github.com/nodejs/node/pull/28230 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Sam Roberts authored
PR-URL: https://github.com/nodejs/node/pull/28230 Reviewed-By:
-
Sam Roberts authored
PR-URL: https://github.com/nodejs/node/pull/28230 Reviewed-By:
-
Luigi Pinca authored
Prevent the `'error'` event from being emitted multiple times if `writable.destroy()` is called with an error before the `_destroy()` callback is called. Emit the first error, discard all others. PR-URL: https://github.com/nodejs/node/pull/26057 Backport-PR-URL: https://github.com/nodejs/node/pull/28000 Fixes: https://github.com/nodejs/node/issues/26015 Reviewed-By:
-
- Sep 19, 2019
-
-
Sam Roberts authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: (none) Certificates removed: - Certinomis - Root CA PR-URL: https://github.com/nodejs/node/pull/28808 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Ben Noordhuis authored
This is a partial backport of commit f1a3968a ("tls: expose built-in root certificates") from the master branch. The original commit adds a new API, this commit just backports the non-visible changes to ease backporting follow-up commits. PR-URL: https://github.com/nodejs/node/pull/26415 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com>
-
Sam Roberts authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - emSign Root CA - G1 - emSign ECC Root CA - G3 - emSign Root CA - C1 - emSign ECC Root CA - C3 - Hongkong Post Root CA 3 PR-URL: https://github.com/nodejs/node/pull/27374 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - GlobalSign Root CA - R6 - OISTE WISeKey Global Root GC CA - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - UCA Global G2 Root - UCA Extended Validation Root - Certigna Root CA Certificates removed: - Visa eCommerce Root - TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5 - Certplus Root CA G1 - Certplus Root CA G2 - OpenTrust Root CA G1 - OpenTrust Root CA G2 - OpenTrust Root CA G3 PR-URL: https://github.com/nodejs/node/pull/25113 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
This is the certdata.txt[0] from NSS 3.45, released on 2019-07-05. This is the version of NSS that will ship in Firefox 69 on 2019-09-03. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_45_RTM/lib/ckfw/builtins/certdata.txt PR-URL: https://github.com/nodejs/node/pull/28808 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
This is the certdata.txt[0] from NSS 3.43, released on 2019-03-15. This is the version of NSS that will ship in Firefox 67 on 2019-03-19. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_43_RTM/lib/ckfw/builtins/certdata.txt PR-URL: https://github.com/nodejs/node/pull/27374 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
This is the certdata.txt[0] from NSS 3.41, released on 2018-12-03. This is the version of NSS that will ship in Firefox 65 on 2018-12-11. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_41_RTM/lib/ckfw/builtins/certdata.txt PR-URL: https://github.com/nodejs/node/pull/25113 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Michaël Zasso authored
Original commit message: [turbofan] Fix NumberFloor typing. Bug: chromium:841117 Change-Id: I1e83dfc82f87d0b49d3cca96290ae1d738e37d20 Reviewed-on: https://chromium-review.googlesource.com/1051228 Reviewed-by:Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#53083} Refs: https://github.com/v8/v8/commit/d520ebb9a85b73b2a6505e133a7cc940c7d2adbd Fixes: https://github.com/nodejs/node/issues/22810 PR-URL: https://github.com/nodejs/node/pull/27358 Reviewed-By:
Refael Ackermann (רפאל פלחי) <refack@gmail.com> Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
-
Sam Roberts authored
One skipped test remains, it creates very large Buffer objects, triggering the AIX OOM to kill node and its parent processes. See: https://github.com/nodejs/build/issues/1849#issuecomment-514414165 PR-URL: https://github.com/nodejs/node/pull/29054 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
-
Sam Roberts authored
Assumption that if memory can be malloc()ed it can be used is not true on AIX. Later access of the allocated pages can trigger SIGKILL if there are insufficient VM pages. Use psdanger() to better estimate available memory. Fixes: https://github.com/nodejs/build/issues/1849 More info: - https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/generalprogramming/sys_mem_alloc.html - https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/p_bostechref/psdanger.html Related to: - https://github.com/nodejs/build/issues/1820#issuecomment-505998851 - https://github.com/nodejs/node/pull/28469 - https://github.com/nodejs/node/pull/28516 PR-URL: https://github.com/nodejs/node/pull/28857 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
-
Ben Noordhuis authored
Some pty tests persistently hung on the AIX CI buildbots. Fix that by adding a helper script that properly sets up the pty before spawning the script under test. On investigation I discovered that the test runner hung when it tried to close the slave pty's file descriptor, probably due to a bug in AIX's pty implementation. I could reproduce it with a short C program. The test runner also leaked file descriptors to the child process. I couldn't convince python's `subprocess.Popen()` to do what I wanted it to do so I opted to move the logic to a helper script that can do fork/setsid/etc. without having to worry about stomping on state in tools/test.py. In the process I also uncovered some bugs in the pty module of the python distro that ships with macOS 10.14, leading me to reimplement a sizable chunk of the functionality of that module. And last but not least, of course there are differences between ptys on different platforms and the helper script has to paper over that. Of course. Really, this commit took me longer to put together than I care to admit. Caveat emptor: this commit takes the hacky ^D feeding to the slave out of tools/test.py and puts it in the *.in input files. You can also feed other control characters to tests, like ^C or ^Z, simply by inserting them into the corresponding input file. I think that's nice. Fixes: https://github.com/nodejs/build/issues/1820 Fixes: https://github.com/nodejs/node/issues/28489 PR-URL: https://github.com/nodejs/node/pull/28600 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Sam Roberts authored
Add SKIP status for more tests in stringbytes-external-exceed-max that are failing on AIX. PR-URL: https://github.com/nodejs/node/pull/28516 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
-
Sam Roberts authored
These tests seem to trigger failures in the entire CI job (not just the test) on AIX. Skip them to see if that helps alleviate spurious failures in node-test-commit-aix (and the upstream PR and commit test jobs). See: - https://github.com/nodejs/build/issues/1820#issuecomment-505998851 - https://github.com/nodejs/build/issues/1847#issuecomment-504210708 PR-URL: https://github.com/nodejs/node/pull/28469 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
-
- Aug 16, 2019
-
-
Beth Griggs authored
PR-URL: https://github.com/nodejs/node/pull/29152
-
Beth Griggs authored
This is a security release. Notable changes: Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Vulnerabilities fixed: * CVE-2019-9511 “Data Dribble”: The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9512 “Ping Flood”: The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9513 “Resource Loop”: The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. * CVE-2019-9514 “Reset Flood”: The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU,or both, potentially leading to a denial of service. * CVE-2019-9515 “Settings Flood”: The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9516 “0-Length Headers Leak”: The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. * CVE-2019-9517 “Internal Data Buffering”: The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service. * CVE-2019-9518 “Empty Frames Flood”: The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google) PR-URL: https://github.com/nodejs/node/pull/29152
-
Anna Henningsen authored
Refs: https://github.com/nodejs/node/pull/27914 Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
nghttp2 has updated its limit for outstanding Ping/Settings ACKs to 1000. This commit allows reverting to the old default of 10000. The associated CVEs are CVE-2019-9512/CVE-2019-9515. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
If we are waiting for the ability to send more output, we should not process more input. This commit a) makes us send output earlier, during processing of input, if we accumulate a lot and b) allows interrupting the call into nghttp2 that processes input data and resuming it at a later time, if we do find ourselves in a position where we are waiting to be able to send more output. This is part of mitigating CVE-2019-9511/CVE-2019-9517. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
If a write to the underlying socket finishes asynchronously, that means that we cannot write any more data at that point without waiting for it to finish. If this happens, we should also not be producing any more input. This is part of mitigating CVE-2019-9511/CVE-2019-9517. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
This is intended to mitigate CVE-2019-9518. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Allocating memory upfront comes with overhead, and in particular, `std::vector` implementations do not necessarily return memory to the system when one might expect that (e.g. after shrinking the vector). Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Ignore headers with 0-length names and track memory for headers the way we track it for other HTTP/2 session memory too. This is intended to mitigate CVE-2019-9516. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Limit the number of invalid input frames, as they may be pointing towards a misbehaving peer. The limit is currently set to 1000 but could be changed or made configurable. This is intended to mitigate CVE-2019-9514. [This commit differs from the v12.x one due to the lack of https://github.com/libuv/libuv/commit/ee24ce900e5714c950b248da2b. See the comment in the test for more details.] Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Limit the number of streams that are rejected upon creation. Since each such rejection is associated with an `NGHTTP2_ENHANCE_YOUR_CALM` error that should tell the peer to not open any more streams, continuing to open streams should be read as a sign of a misbehaving peer. The limit is currently set to 100 but could be changed or made configurable. This is intended to mitigate CVE-2019-9514. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Lazily allocate `ArrayBuffer`s for the contents of DATA frames. Creating `ArrayBuffer`s is, sadly, not a cheap operation with V8. This is part of performance improvements to mitigate CVE-2019-9513. Together with the previous commit, these changes improve throughput in the adversarial case by about 100 %, and there is little more that we can do besides artificially limiting the rate of incoming metadata frames (i.e. after this patch, CPU usage is virtually exclusively in libnghttp2). [This backport also applies changes from 83e1b974 and required some manual work due to the lack of `AllocatedBuffer` on v10.x. More work was necessary for v8.x, including copying utilities for `util.h` from more recent Node.js versions.] Refs: https://github.com/nodejs/node/pull/26201 Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
For some JS events, it only makes sense to call into JS when there are listeners for the event in question. The overhead is noticeable if a lot of these events are emitted during the lifetime of a session. To reduce this overhead, keep track of whether any/how many JS listeners are present, and if there are none, skip calls into JS altogether. This is part of performance improvements to mitigate CVE-2019-9513. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
