I've not been able to find any reason for calling
BIO_set_shutdown(bio, 1). This is done by default for the following
versions of OpenSSL:

https://github.com/openssl/openssl/blob/OpenSSL_1_1_0/
crypto/bio/bio_lib.c#L26

https://github.com/openssl/openssl/blob/OpenSSL_1_0_1/
crypto/bio/bio_lib.c#L90

https://github.com/openssl/openssl/blob/OpenSSL_1_0_2/
crypto/bio/bio_lib.c#L88

https://github.com/openssl/openssl/blob/OpenSSL_1_0_0/
crypto/bio/bio_lib.c#L90

This commit removes the call and the comment.

PR-URL: https://github.com/nodejs/node/pull/17542


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

I looks like this test has not worked as expected since commit
2bc7841d ("test: use random ports
where possible"). The test in that commit checked for `CERT_REVOKED`
which was returned by CheckWhitelistedServerCert.

CheckWhitelistedServerCert was later removed in commit
6ee4228c ("src: drop CNNIC+StartCom
certificate whitelisting").

I'm suggesting that this test case be removed as I don't think it is
valid anymore.

Backport-PR-URL: https://github.com/nodejs/node/pull/20776
PR-URL: https://github.com/nodejs/node/pull/19767


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

Currently this test will overwrite the clientOpts object with the port,
instead of setting the port property on the clientOpts object which
looks like the original intent.

Doing this the test fails reporting that the fake-cnnic-root-cert has
expired. This is indeed true:
$ openssl x509 -in test/fixtures/keys/fake-cnnic-root-cert.pem \
-text -noout
Certificate:
        ...
        Validity
            Not Before: Jun  9 17:15:16 2015 GMT
            Not After : Mar 29 17:15:16 2018 GMT

This commit sets the errorCode to CERT_HAS_EXPIRED. I tried updating the
certificate using test/fixtures/keys/Makefile but then no error is
thrown and I'm currently looking into this.

Backport-PR-URL: https://github.com/nodejs/node/pull/20776
PR-URL: https://github.com/nodejs/node/pull/19767


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>

A error message should always be non-enumerable. This makes sure
that is true for dns errors as well. It also adds another check
in `common.expectsError` to make sure no other regressions are
introduced going forward.

Fixes #19716

Backport-PR-URL: https://github.com/nodejs/node/pull/19191
PR-URL: https://github.com/nodejs/node/pull/19719
Fixes: https://github.com/nodejs/node/issues/19716


Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

This commit moves error creation helpers scattered around
under lib/ into lib/internal/errors.js in the hope of being clearer
about the differences of errors that we throw into the user land.

- Move util._errnoException and util._exceptionWithHostPort
  into internal/errors.js and simplify their logic so it's
  clearer what the properties these helpers create.
- Move the errnoException helper in dns.js to internal/errors.js
  into internal/errors.js and rename it to dnsException. Simplify
  it's logic so it no longer calls errnoException and skips
  the unnecessary argument checks.

Backport-PR-URL: https://github.com/nodejs/node/pull/19191
PR-URL: https://github.com/nodejs/node/pull/18546


Reviewed-By: James M Snell <jasnell@gmail.com>

Backport-PR-URL: https://github.com/nodejs/node/pull/19191
PR-URL: https://github.com/nodejs/node/pull/18546


Reviewed-By: James M Snell <jasnell@gmail.com>

Backport-PR-URL: https://github.com/nodejs/node/pull/19191
PR-URL: https://github.com/nodejs/node/pull/18358


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jon Moss <me@jonathanmoss.me>

Reimplement uv.errname() as internal/util.getSystemErrorName() to
avoid the memory leaks caused by unknown error codes
and avoid calling into C++ for the error names. Also
expose it as a public API for external use.

Backport-PR-URL: https://github.com/nodejs/node/pull/19191
PR-URL: https://github.com/nodejs/node/pull/18186
Refs: http://docs.libuv.org/en/v1.x/errors.html#c.uv_err_name


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Add a errno -> [error code, uv error message] map to the uv binding
so the error message can be assembled in the JS layer.

Backport-PR-URL: https://github.com/nodejs/node/pull/19191
PR-URL: https://github.com/nodejs/node/pull/17338


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Redefining private breaks any private inheritance in the
included files. We can simply declare GenDebugSymbols()
as friends in related classes to gain the access that we need.

Backport-PR-URL: https://github.com/nodejs/node/pull/19176
PR-URL: https://github.com/nodejs/node/pull/18653


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Backport-PR-URL: https://github.com/nodejs/node/pull/19176
PR-URL: https://github.com/nodejs/node/pull/18530


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>

Before these changes, only V8 added postmortem metadata to Node's
binary, limiting the possibilities for debugger's developers to add some
features that rely on investigating Node's internal structures.

These changes are first steps towards empowering debug tools to
navigate Node's internal structures. One example of what can be
achieved with this is shown at nodejs/llnode#122 (a command which prints
information about handles and requests on the queue for a core dump
file). Node postmortem metadata are prefixed with nodedbg_.

This also adds tests to validate if all postmortem metadata are
calculated correctly, plus some documentation on what is postmortem
metadata and a few care to be taken to avoid breaking it.

Ref: https://github.com/nodejs/llnode/pull/122
Ref: https://github.com/nodejs/post-mortem/issues/46

Backport-PR-URL: https://github.com/nodejs/node/pull/19176
PR-URL: https://github.com/nodejs/node/pull/14901
Refs: https://github.com/nodejs/post-mortem/issues/46


Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>

Allow the user to specify the filepath for the trace_events log file
using a template string.

Backport-PR-URL: https://github.com/nodejs/node/pull/19145
PR-URL: https://github.com/nodejs/node/pull/18480


Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

The error check doesn't matter because a failure would be ignored
as part of the loop condition.

PR-URL: https://github.com/nodejs/node/pull/16950


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>

by using package-lock.json

PR-URL: https://github.com/nodejs/node/pull/16945
Fixes: https://github.com/nodejs/node/issues/16628


Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Khaidi Chu <i@2333.moe>
Reviewed-By: James M Snell <jasnell@gmail.com>

When configure with --debug-http2 --debug-nghttp2 the following
compilation error is generated:

DEBUG_HTTP2SESSION2(this, "fatal error receiving data: %d", ret);
                          ^
../src/node_http2.cc:1690:27:
error: invalid use of 'this' outside of a non-static member function

1 errors generated.

OnStreamReadImpl is static and I think the intention was to pass in the
session variable here.

PR-URL: https://github.com/nodejs/node/pull/20815
Refs: https://github.com/nodejs/node/issues/20806


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>

Backport-PR-URL: https://github.com/nodejs/node/pull/20456
PR-URL: https://github.com/nodejs/node/pull/18872


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Add optional Http2ServerRequest and Http2ServerResponse options
to createServer and createSecureServer. Allows custom req & res
classes that extend the default ones to be used without
overriding the prototype.

Backport-PR-URL: https://github.com/nodejs/node/pull/20456
PR-URL: https://github.com/nodejs/node/pull/15560


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

This adds the Http1IncomingMessage and Http1ServerReponse options
to http2.createServer().

Backport-PR-URL: https://github.com/nodejs/node/pull/20456
PR-URL: https://github.com/nodejs/node/pull/15752


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

This adds the optional options argument to `http.createServer()`.
It contains two options: the `IncomingMessage` and `ServerReponse`
option.

Backport-PR-URL: https://github.com/nodejs/node/pull/20456
PR-URL: https://github.com/nodejs/node/pull/15752


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anatoli Papirovski <apapirovski@mac.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>

This is a security release. All Node.js users should consult the
security release summary at:

  https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

for details on patched vulnerabilities.

Fixes for the following CVEs are included in this release:

  * CVE-2018-0732 (OpenSSL)
  * CVE-2018-12115 (Node.js)

Notable changes:

* buffer: Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding
  (CVE-2018-12115)
* deps: Upgrade to OpenSSL 1.0.2p, fixing:
  * Client DoS due to large DH parameter (CVE-2018-0732)
  * ECDSA key extraction via local side-channel (CVE not assigned)

CVE-2018-12115
Discovered by ChALkeR - Сковорода Никита Андреевич
Fix by Anna Henningsen

Writing to the second-to-last byte with UCS-2 encoding will cause a -1
length to be send to String::Write(), writing all of the provided Buffer
from that point and beyond.

Fixes: https://github.com/nodejs-private/security/issues/203
PR-URL: https://github.com/nodejs-private/node-private/pull/138

After upgradeing OpenSSL-1.0.2p, test-tls-passphrase.js was failed
due to change of error messages.

Ref: https://github.com/openssl/openssl/commit/18026c0215e942f0ad33a6012cb8cad2f51f841b
PR-URL: https://github.com/nodejs/node/pull/22320


Reviewed-By: Rod Vagg <rod@vagg.org>

In openssl s_client on Windows, RAND_screen() is invoked to initialize
random state but it takes several seconds in each connection.
This added -no_rand_screen to openssl s_client on Windows to skip
RAND_screen() and gets a better performance in the unit test of
test-tls-server-verify.
Do not enable this except to use in the unit test.

Fixes: https://github.com/nodejs/io.js/issues/1461
PR-URL: https://github.com/nodejs/io.js/pull/1836


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Reapply b9106137 .

Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

See
https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html

iojs needs to stop using masm and move to nasm or yasm on Win32.

Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and
perhaps others) are requiring .686 .

Fixes: https://github.com/iojs/io.js/issues/589
PR-URL: https://github.com/iojs/io.js/pull/1389


Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: https://github.com/nodejs/node/pull/22320


Reviewed-By: Rod Vagg <rod@vagg.org>

This replaces all sources of openssl-1.0.2p.tar.gz into
deps/openssl/openssl

PR-URL: https://github.com/nodejs/node/pull/22320


Reviewed-By: Rod Vagg <rod@vagg.org>

The certificates in test fixtures were set to expire in 999 days since
they were generated. That time has passed, and they have to be reissued.
Bump expiration time to 99999 days for all of them to prevent this from
happening again in near future.

PR-URL: https://github.com/nodejs/node/pull/22184
Fixes: https://github.com/nodejs/node/issues/22182


Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

Currently when running make clean, followed by make not all certificates
get genenerated. In addition there are also the following error messages
related to the startdate in agent8-cert.pem, and agent9-cert.pem:
start date is invalid, it should be YYMMDDHHMMSSZ

After this commit it is possible to perform the following commands:
$ make clean
$ make
$ make test

PR-URL: https://github.com/nodejs/node/pull/19975


Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/126

Notable changes:

* **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability
    where calling Buffer.fill() could hang
* **http2**
  * (CVE-2018-7161): Fixes Denial of Service vulnerability by
      updating the http2 implementation to not crash under
      certain circumstances during cleanup
  * (CVE-2018-1000168): Fixes Denial of Service vulnerability
      by upgrading nghttp2 to 1.32.0

PR-URL: https://github.com/nodejs-private/node-private/pull/126

This would otherwise keep a lot of unused memory lying around,
and in particular add up to a page per chunk of memory overhead
for network reads, potentially opening a DoS vector if the resulting
`Buffer` objects are kept around indefinitely (e.g. stored in a list
and not concatenated until the socket finishes).

This is to prevent v8.x from becoming susceptible to CVE-2018-7164.

Refs: https://github.com/nodejs-private/security/issues/186
Refs: https://github.com/nodejs/node/commit/7c4b09b24bbe7d6a8cbad256f47b30a101a909ea
PR-URL: https://github.com/nodejs-private/node-private/pull/132


Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Add a mock TLS socket implementation and a regression test for
the previous commit.

This is to prevent v8.x from becoming susceptible to CVE-2018-7162.

Refs: https://github.com/nodejs-private/security/issues/189
PR-URL: https://github.com/nodejs-private/node-private/pull/131


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Evan Lucas <evanlucas@me.com>

PR-URL: https://github.com/nodejs-private/node-private/pull/125


Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This fixes CVE-2018-1000168.

PR-URL: https://github.com/nodejs-private/node-private/pull/125


Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This fixes CVE-2018-7161.

PR-URL: https://github.com/nodejs-private/node-private/pull/123


Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Note that buffer.fill() can zero-fill on some input types if no
valid fill data remains, but does nothing on other input types.

PR-URL: https://github.com/nodejs-private/node-private/pull/119
Fixes: https://github.com/nodejs-private/security/issues/193
Refs: https://github.com/nodejs-private/node-private/pull/118


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

Previously, zero-length Buffers and TypedArrays passed as fillers hanged
Buffer#fill and Buffer.from.

This changes those cases when it hanged to a zero-fill instead, which
should be backwards compatible.

This fixes CVE-2018-7167.

PR-URL: https://github.com/nodejs-private/node-private/pull/119
Fixes: https://github.com/nodejs-private/security/issues/193
Refs: https://github.com/nodejs-private/node-private/pull/118


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Tiancheng "Timothy" Gu <timothygu99@gmail.com>
Reviewed-By: Evan Lucas <evanlucas@me.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>