Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/109
PR-URL: https://github.com/nodejs-private/node-private/pull/102/


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/109
PR-URL: https://github.com/nodejs-private/node-private/pull/102/


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

Remove the CNNIC certificates again and remove the whitelist from commit
3beb8807 ("crypto: add cert check to CNNIC Whitelist") from June 2015.

Backport-PR-URL: https://github.com/nodejs/node/pull/19632
PR-URL: https://github.com/nodejs/node/pull/19322


Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Update the list of root certificates in src/node_root_certs.h with
tools/mk-ca-bundle.pl.

Certificates added:
- GDCA TrustAUTH R5 ROOT
- SSL.com EV Root Certification Authority ECC
- SSL.com EV Root Certification Authority RSA R2
- SSL.com Root Certification Authority ECC
- SSL.com Root Certification Authority RSA
- TrustCor ECA-1
- TrustCor RootCert CA-1
- TrustCor RootCert CA-2

Certificates removed:
- ACEDICOM Root
- AddTrust Low-Value Services Root
- AddTrust Public Services Root
- AddTrust ualified Certificates Root
- CA Disig Root R1
- Camerfirma Chambers of Commerce Root
- Camerfirma Global Chambersign Root
- CA WoSign ECC Root
- Certification Authority of WoSign G2
- Certinomis - Autorité Racine
- Certum Root CA
- China Internet Network Information Center EV Certificates Root
- CNNIC ROOT
- Comodo Secure Services root
- Comodo Trusted Services root
- DST ACES CA X6
- GeoTrust Global CA 2
- PSCProcert
- Security Communication EV RootCA1
- StartCom Certification Authority
- StartCom Certification Authority
- StartCom Certification Authority G2
- Swisscom Root CA 1
- Swisscom Root CA 2
- Swisscom Root EV CA 2
- TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3
- TURKTRUST Certificate Services Provider Root 2007
- UTN USERFirst Hardware Root CA
- WoSign
- WoSign China

Backport-PR-URL: https://github.com/nodejs/node/pull/19632
PR-URL: https://github.com/nodejs/node/pull/19322


Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05.

This is the version of NSS that will ship in Firefox 60 on 2018-05-01.

[0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt

Backport-PR-URL: https://github.com/nodejs/node/pull/19632
PR-URL: https://github.com/nodejs/node/pull/19322


Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

In openssl s_client on Windows, RAND_screen() is invoked to initialize
random state but it takes several seconds in each connection.
This added -no_rand_screen to openssl s_client on Windows to skip
RAND_screen() and gets a better performance in the unit test of
test-tls-server-verify.
Do not enable this except to use in the unit test.

Backport-PR-URL: https://github.com/nodejs/node/pull/19638
Fixes: https://github.com/nodejs/io.js/issues/1461
PR-URL: https://github.com/nodejs/io.js/pull/1836


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Reapply b9106137 .

Backport-PR-URL: https://github.com/nodejs/node/pull/19638
Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

See
https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html

iojs needs to stop using masm and move to nasm or yasm on Win32.

Backport-PR-URL: https://github.com/nodejs/node/pull/19638
Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and
perhaps others) are requiring .686 .

Backport-PR-URL: https://github.com/nodejs/node/pull/19638
Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: https://github.com/nodejs/node/pull/19638


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rod Vagg <rod@vagg.org>

This replaces all sources of openssl-1.0.2o.tar.gz into
deps/openssl/openssl

PR-URL: https://github.com/nodejs/node/pull/19638


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Rod Vagg <rod@vagg.org>

Original commit message follows:

    Before this commit `Content-Length: 4 2` was accepted as a valid
    header and recorded as `parser->content_length = 42`.  Now it is
    a parse error that fails with error `HPE_INVALID_CONTENT_LENGTH`.

    Downstream users that inspect `parser->content_length` and naively
    parse the string value using `strtoul()` might get confused by the
    discrepancy between the two values.  Resolve that by simply not
    letting it happen.

Fixes: https://github.com/nodejs-private/security/issues/178
PR-URL: https://github.com/nodejs-private/http-parser-private/pull/1


Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

PR-URL: https://github.com/nodejs-private/http-parser-private/pull/1


Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

PR-URL: https://github.com/nodejs/node/pull/19027

Notable Changes:

* http, tls:
  - better support for IPv6 addresses (Mattias Holmlund)
    https://github.com/nodejs/node/pull/14772

PR-URL: https://github.com/nodejs/node/pull/19027

Allows env vars to be passed through to child processes. This is needed
for things like NODE_TEST_DIR or LD_LIBRARY_PATH if testing the shared
library.

Backport-PR-URL: https://github.com/nodejs/node/pull/18883
PR-URL: https://github.com/nodejs/node/pull/14822
Refs: https://github.com/nodejs/node/pull/13390


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/18432


Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>

assert.strictEqual message argument removed to replace
with default assert message to show the expected vs
actual values

PR-URL: https://github.com/nodejs/node/pull/18259
Refs: https://github.com/nodejs/node/issues/13296


Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Shingo Inoue <leko.noor@gmail.com>
Reviewed-By: Jon Moss <me@jonathanmoss.me>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Use upper case variant in text in compliance with RFC 2898.

PR-URL: https://github.com/nodejs/node/pull/18279


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Vladimir Kurchatkin <vladimir.kurchatkin@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/17326
Refs: https://github.com/nodejs/node/issues/17169


Reviewed-By: Jon Moss <me@jonathanmoss.me>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/18236


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

Add 8.x to the LTS versions that use a V8 branch that is
not active anymore.

PR-URL: https://github.com/nodejs/node/pull/18155


Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Fixes: https://github.com/nodejs/node/issues/12516
Refs: https://github.com/nodejs/node/pull/2497

PR-URL: https://github.com/nodejs/node/pull/17705


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

The build breaks if there's a non-ASCII character on
the path to the building directory.

PR-URL: https://github.com/nodejs/node/pull/16735
Refs: https://github.com/nodejs/node/issues/16278
Refs: https://github.com/nodejs/node/issues/14336


Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Change many instances of "x is considered to be y" to "x is y".

PR-URL: https://github.com/nodejs/node/pull/18095


Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Fixes: https://github.com/nodejs/node/issues/18116
PR-URL: https://github.com/nodejs/node/pull/18121


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Weijia Wang <starkwang@126.com>

PR-URL: https://github.com/nodejs/node/pull/18103


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/18097


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/16539
Fixes: https://github.com/nodejs/node/issues/16394


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/18117


Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Yuta Hiroto <hello@about-hiroppy.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>

In the documentation for the buffer module, change instances of "the
result is considered undefined behavior" to "the resulting behavior is
undefined". It's less ambiguous in meaning and less awkward
stylistically.

PR-URL: https://github.com/nodejs/node/pull/18091


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Minwoo Jung <minwoo@nodesource.com>
Reviewed-By: Khaidi Chu <i@2333.moe>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>

After slicing, the `lastSegmentLength` should be calculated again,
instead of assigning value `j`.

PR-URL: https://github.com/nodejs/node/pull/17974
Fixes: https://github.com/nodejs/node/issues/17928


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/17379


Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

PR-URL: https://github.com/nodejs/node/pull/17988
Fixes: https://github.com/nodejs/node/issues/17986


Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/18007


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Eugene Ostroukhov <eostroukhov@google.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Roman Reiss <me@silverwind.io>
Reviewed-By: Jon Moss <me@jonathanmoss.me>

PR-URL: https://github.com/nodejs/node/pull/17556


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

Document and test the existing support for generic Duplex streams
in the TLS module.

PR-URL: https://github.com/nodejs/node/pull/17599


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

- Properly handle IPv6 in Host header when setting servername.
- When comparing IP addresses against addresses in the subjectAltName
  field of a certificate, format the address correctly before
  doing the string comparison.

PR-URL: https://github.com/nodejs/node/pull/14772
Fixes: https://github.com/nodejs/node/issues/14736


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/18342

This LTS release comes with 112 commits, 17 of which are considered
Semver-Minor. This includes 32 which are doc related, 30 which are test
related, 8 which are build / tool related and 1 commit which updates
a dependency.

Notable Changes:

* console:
  - added console.count() and console.clear() (James M Snell)
    https://github.com/nodejs/node/pull/12678
* crypto:
  - expose ECDH class (Bryan English)
    https://github.com/nodejs/node/pull/8188
  - added cypto.randomFill() and crypto.randomFillSync() (Evan Lucas)
    https://github.com/nodejs/node/pull/10209
  - warn on invalid authentication tag length (Tobias Nießen)
    https://github.com/nodejs/node/pull/17566
* deps:
  - upgrade libuv to 1.16.1 (cjihrig)
    https://github.com/nodejs/node/pull/16835
* dgram:
  - added socket.setMulticastInterface() (Will Young)
    https://github.com/nodejs/node/pull/7855
* http:
  - add agent.keepSocketAlive and agent.reuseSocket as to allow
    overridable keep-alive behavior of `Agent` (Fedor Indutny)
    https://github.com/nodejs/node/pull/13005
* lib:
  - return this from net.Socket.end() (Sam Roberts)
    https://github.com/nodejs/node/pull/13481
* module:
  - add builtinModules api that provides list of all builtin modules in
    Node (Jon Moss)
    https://github.com/nodejs/node/pull/16386
* net:
  - return this from getConnections() (Sam Roberts)
    https://github.com/nodejs/node/pull/13553
* promises:
  - more robust stringification for unhandled rejections (Timothy Gu)
    https://github.com/nodejs/node/pull/13784
* repl:
  - improve require() autocompletion (Alexey Orlenko)
    https://github.com/nodejs/node/pull/14409
* src:
  - add openssl-system-ca-path configure option (Daniel Bevenius)
    https://github.com/nodejs/node/pull/16790
  - add --use-bundled-ca --use-openssl-ca check (Daniel Bevenius)
    https://github.com/nodejs/node/pull/12087
  - add process.ppid (cjihrig)
    https://github.com/nodejs/node/pull/16839
* tls:
  - accept `lookup` option for `tls.connect()` (Fedor Indutny)
    https://github.com/nodejs/node/pull/12839
* tools, build:
  - a new macOS installer! (JP Wesselink)
    https://github.com/nodejs/node/pull/15179
* url:
  - WHATWG URL api support (James M Snell)
    https://github.com/nodejs/node/pull/7448
* util:
  - add %i and %f formatting specifiers (Roman Reiss)
    https://github.com/nodejs/node/pull/10308

PR-URL: https://github.com/nodejs/node/pull/18342