- Feb 28, 2019
-
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Shigeki Ohtsu authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h.
-
Shigeki Ohtsu authored
This replaces all sources of openssl-1.0.2r.tar.gz into deps/openssl/openssl
-
Matteo Collina authored
Fixes: https://github.com/nodejs-private/security/issues/214 PR-URL: https://github.com/nodejs-private/node-private/pull/162 Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
realwakka authored
Make the same reliability changes that were applied to the https test in ce5745bf. Refs: https://github.com/nodejs/node/pull/13312 PR-URL: https://github.com/nodejs/node/pull/13448 Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Alexey Orlenko <eaglexrlnk@gmail.com>
-
Rich Trott authored
The test is flaky under load. These changes greatly improve reliability. * Use a recurring interval to determine when the test should end rather than a timer. * Increase server timeout to 500ms to allow for events being delayed by system load Changing to an interval has the added benefit of reducing the test run time from over 2 seconds to under 1 second. Fixes: https://github.com/nodejs/node/issues/13307 PR-URL: https://github.com/nodejs/node/pull/13312 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Alexey Orlenko <eaglexrlnk@gmail.com>
-
Alexey Orlenko authored
Fix the logic of resetting the socket timeout of keep-alive HTTP connections and add two tests: * `test-http-server-keep-alive-timeout-slow-server` is a regression test for GH-13391. It ensures that the server-side keep-alive timeout will not fire during processing of a request. * `test-http-server-keep-alive-timeout-slow-client-headers` ensures that the regular socket timeout is restored as soon as a client starts sending a new request, not as soon as the whole message is received, so that the keep-alive timeout will not fire while, e.g., the client is sending large cookies. Refs: https://github.com/nodejs/node/pull/2534 Fixes: https://github.com/nodejs/node/issues/13391 PR-URL: https://github.com/nodejs/node/pull/13549 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Brian White <mscdex@mscdex.net>
-
Timur Shemsedinov authored
Implement server.keepAliveTimeout in addition to server.timeout to prevent temporary socket/memory leaking in keep-alive mode. PR-URL: https://github.com/nodejs/node/pull/2534 Author: Timur Shemsedinov <timur.shemsedinov@gmail.com> Author: Alexey Orlenko <eaglexrlnk@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By:
Refael Ackermann <refack@gmail.com>
-
- Dec 27, 2018
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/25178
-
- Dec 26, 2018
-
-
Myles Borins authored
The 6.15.0 security release introduced some unexpected breakages on the 6.x release line. This is a special release to fix a regression in the HTTP binary upgrade response body and add a missing CLI flag to adjust the max header size of the http parser. Notable changes: * cli: - add --max-http-header-size flag (cjihrig) https://github.com/nodejs/node/pull/24811 * http: - add maxHeaderSize property (cjihrig) https://github.com/nodejs/node/pull/24860 PR-URL: https://github.com/nodejs/node/pull/25178
-
- Dec 25, 2018
-
-
cjihrig authored
This commit exposes the value of --max-http-header-size as a property of the http module. Backport-PR-URL: https://github.com/nodejs/node/pull/25218 PR-URL: https://github.com/nodejs/node/pull/24860 Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Shelley Vohr <codebytere@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
- Dec 22, 2018
-
-
cjihrig authored
Allow the maximum size of HTTP headers to be overridden from the command line. Backport-PR-URL: https://github.com/nodejs/node/pull/25173 co-authored-by:
Matteo Collina <hello@matteocollina.com> PR-URL: https://github.com/nodejs/node/pull/24811 Fixes: https://github.com/nodejs/node/issues/24692 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com>
-
cjihrig authored
This commit adds http_parser_set_max_header_size() to the http-parser for overriding the compile time maximum HTTP header size. Backport-PR-URL: https://github.com/nodejs/node/pull/25173 PR-URL: https://github.com/nodejs/node/pull/24811 Fixes: https://github.com/nodejs/node/issues/24692 Refs: https://github.com/nodejs/http-parser/pull/453 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com>
-
Matteo Collina authored
See: https://github.com/nodejs/node/issues/24958 PR-URL: https://github.com/nodejs/node/pull/25036 Reviewed-By:
Myles Borins <myles.borins@gmail.com>
-
- Dec 03, 2018
-
-
Rod Vagg authored
PR-URL: https://github.com/nodejs/node/pull/24803
-
Rod Vagg authored
Notable Changes: This is a patch release to address a bad backport of the fix for "Slowloris HTTP Denial of Service" (CVE-2018-12122). Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session, resulting in prematurely disconnected sockets. PR-URL: https://github.com/nodejs/node/pull/24803 Refs: https://github.com/nodejs/node/pull/24796 Refs: https://github.com/nodejs/node/issues/24760 Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com>
-
Matteo Collina authored
The backport of https://github.com/nodejs/node/commit/618eebdd17 was not complete, and the starting time to parse the headers was not reset. PR-URL: https://github.com/nodejs/node/pull/24796 Fixes: https://github.com/nodejs/node/issues/24760 Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
- Nov 28, 2018
-
-
Rod Vagg authored
PR-URL: https://github.com/nodejs-private/node-private/pull/153
-
- Nov 27, 2018
-
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Debugger port 5858 listens on any interface by default (CVE-2018-12120) * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * Node.js: HTTP request splitting (CVE-2018-12116) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) Notable Changes: * debugger: Backport of https://github.com/nodejs/node/pull/8106 to prevent the debugger from listening on `0.0.0.0`. It now defa...
-
Matteo Collina authored
PR-URL: https://github.com/nodejs-private/node-private/pull/146 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Timothy Gu <timothygu99@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de>
-
James M Snell authored
Make the revert related functions inline to eliminate the need for node_revert.cc, prefitx the constants and the def, other misc cleanup PR-URL: https://github.com/nodejs/node/pull/14864 Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Benno Fünfstück authored
CVE-2018-12116 Backport of b961d9fd to 6.x Original commit: This commit changes node's handling of two-byte characters in the path component of an http URL. Previously, node would just strip the higher byte when generating the request. So this code: ``` http.request({host: "example.com", port: "80", "/N"}) ``` would request `http://example.com/.` (`.` is the character for the byte `0x2e`). This is not useful and can in some cases lead to filter evasion. With this change, the code generates `ERR_UNESCAPED_CHARACTERS`, just like space and control characters already did. PR-URL: https://github.com/nodejs/node/pull/16237 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Timothy Gu <timothygu99@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/146 Fixes: https://github.com/nodejs-private/security/issues/207 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Timothy Gu <timothygu99@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de>
-
Matteo Collina authored
CVE-2018-12123 Fixes: https://github.com/nodejs-private/security/issues/205 PR-URL: https://github.com/nodejs-private/node-private/pull/145 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Matteo Collina authored
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/152 Ref: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Matteo Collina authored
CVE-2018-12121 PR-URL: https://github.com/nodejs-private/node-private/pull/143 Ref: https://github.com/nodejs-private/security/issues/139 Ref: https://github.com/nodejs-private/http-parser-private/pull/2 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
- Nov 24, 2018
-
-
Ben Noordhuis authored
CVE-2018-12120 Backport of 8e7cbe25 to v6.x Prepared by Sam Roberts <vieuxtech@gmail.com> Original commit: Commit 22720524 ("net: bind to `::` TCP address by default") from April 2014 seems to have accidentally changed the default listen address from 127.0.0.1 to 0.0.0.0, a.k.a. the "any" address. From a security viewpoint it's undesirable to accept debug agent connections from anywhere so let's change that back. Users can override the default with the `--debug=<host>:<port>` switch. Fixes: https://github.com/nodejs/node/issues/8081 PR-URL: https://github.com/nodejs/node/pull/8106 Reviewed-By:
James M Snell <jasnell@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/148 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Sam Roberts authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Header files were generated by: $ cd deps/openssl $ mkdir -p openssl/include/openssl $ tar xf .../openssl-1.02q.tar.gz $ cd openssl-1.02q $ ./config $ cd include/openssl $ sed -i '' *.h $ cp *.h ../../../openssl/include/openssl/ PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Sam Roberts authored
This updates all sources in deps/openssl/openssl with openssl-1.0.2q. PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Rod Vagg authored
-
- Aug 15, 2018
-
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * CVE-2018-0732 (OpenSSL) * CVE-2018-12115 (Node.js) Notable changes: * buffer: Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding (CVE-2018-12115) * deps: Upgrade to OpenSSL 1.0.2p, fixing: * Client DoS due to large DH parameter (CVE-2018-0732) * ECDSA key extraction via local side-channel (CVE not assigned)
-
Shigeki Ohtsu authored
After upgradeing OpenSSL-1.0.2p, test-tls-passphrase.js was failed due to change of error messages. Ref: https://github.com/openssl/openssl/commit/18026c0215e942f0ad33a6012cb8cad2f51f841b PR-URL: https://github.com/nodejs/node/pull/22320 Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-