- Sep 19, 2019
-
-
Sam Roberts authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: (none) Certificates removed: - Certinomis - Root CA PR-URL: https://github.com/nodejs/node/pull/28808 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-
Ben Noordhuis authored
This is a partial backport of commit f1a3968a ("tls: expose built-in root certificates") from the master branch. The original commit adds a new API, this commit just backports the non-visible changes to ease backporting follow-up commits. PR-URL: https://github.com/nodejs/node/pull/26415 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Ron Korving <ron@ronkorving.nl> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com>
-
Sam Roberts authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - emSign Root CA - G1 - emSign ECC Root CA - G3 - emSign Root CA - C1 - emSign ECC Root CA - C3 - Hongkong Post Root CA 3 PR-URL: https://github.com/nodejs/node/pull/27374 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
-
Sam Roberts authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - GlobalSign Root CA - R6 - OISTE WISeKey Global Root GC CA - GTS Root R1 - GTS Root R2 - GTS Root R3 - GTS Root R4 - UCA Global G2 Root - UCA Extended Validation Root - Certigna Root CA Certificates removed: - Visa eCommerce Root - TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5 - Certplus Root CA G1 - Certplus Root CA G2 - OpenTrust Root CA G1 - OpenTrust Root CA G2 - OpenTrust Root CA G3 PR-URL: https://github.com/nodejs/node/pull/25113 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
This is the certdata.txt[0] from NSS 3.45, released on 2019-07-05. This is the version of NSS that will ship in Firefox 69 on 2019-09-03. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_45_RTM/lib/ckfw/builtins/certdata.txt PR-URL: https://github.com/nodejs/node/pull/28808 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
This is the certdata.txt[0] from NSS 3.43, released on 2019-03-15. This is the version of NSS that will ship in Firefox 67 on 2019-03-19. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_43_RTM/lib/ckfw/builtins/certdata.txt PR-URL: https://github.com/nodejs/node/pull/27374 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Sam Roberts authored
This is the certdata.txt[0] from NSS 3.41, released on 2018-12-03. This is the version of NSS that will ship in Firefox 65 on 2018-12-11. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_41_RTM/lib/ckfw/builtins/certdata.txt PR-URL: https://github.com/nodejs/node/pull/25113 Backport-PR-URL: https://github.com/nodejs/node/pull/29137 Reviewed-By:
-
Michaël Zasso authored
Original commit message: [turbofan] Fix NumberFloor typing. Bug: chromium:841117 Change-Id: I1e83dfc82f87d0b49d3cca96290ae1d738e37d20 Reviewed-on: https://chromium-review.googlesource.com/1051228 Reviewed-by:Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#53083} Refs: https://github.com/v8/v8/commit/d520ebb9a85b73b2a6505e133a7cc940c7d2adbd Fixes: https://github.com/nodejs/node/issues/22810 PR-URL: https://github.com/nodejs/node/pull/27358 Reviewed-By:
Refael Ackermann (רפאל פלחי) <refack@gmail.com> Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Beth Griggs <Bethany.Griggs@uk.ibm.com>
-
Sam Roberts authored
One skipped test remains, it creates very large Buffer objects, triggering the AIX OOM to kill node and its parent processes. See: https://github.com/nodejs/build/issues/1849#issuecomment-514414165 PR-URL: https://github.com/nodejs/node/pull/29054 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
Richard Lau <riclau@uk.ibm.com>
-
Sam Roberts authored
Assumption that if memory can be malloc()ed it can be used is not true on AIX. Later access of the allocated pages can trigger SIGKILL if there are insufficient VM pages. Use psdanger() to better estimate available memory. Fixes: https://github.com/nodejs/build/issues/1849 More info: - https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/generalprogramming/sys_mem_alloc.html - https://www.ibm.com/support/knowledgecenter/en/ssw_aix_71/p_bostechref/psdanger.html Related to: - https://github.com/nodejs/build/issues/1820#issuecomment-505998851 - https://github.com/nodejs/node/pull/28469 - https://github.com/nodejs/node/pull/28516 PR-URL: https://github.com/nodejs/node/pull/28857 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
-
Ben Noordhuis authored
Some pty tests persistently hung on the AIX CI buildbots. Fix that by adding a helper script that properly sets up the pty before spawning the script under test. On investigation I discovered that the test runner hung when it tried to close the slave pty's file descriptor, probably due to a bug in AIX's pty implementation. I could reproduce it with a short C program. The test runner also leaked file descriptors to the child process. I couldn't convince python's `subprocess.Popen()` to do what I wanted it to do so I opted to move the logic to a helper script that can do fork/setsid/etc. without having to worry about stomping on state in tools/test.py. In the process I also uncovered some bugs in the pty module of the python distro that ships with macOS 10.14, leading me to reimplement a sizable chunk of the functionality of that module. And last but not least, of course there are differences between ptys on different platforms and the helper script has to paper over that. Of course. Really, this commit took me longer to put together than I care to admit. Caveat emptor: this commit takes the hacky ^D feeding to the slave out of tools/test.py and puts it in the *.in input files. You can also feed other control characters to tests, like ^C or ^Z, simply by inserting them into the corresponding input file. I think that's nice. Fixes: https://github.com/nodejs/build/issues/1820 Fixes: https://github.com/nodejs/node/issues/28489 PR-URL: https://github.com/nodejs/node/pull/28600 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Sam Roberts authored
Add SKIP status for more tests in stringbytes-external-exceed-max that are failing on AIX. PR-URL: https://github.com/nodejs/node/pull/28516 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
-
Sam Roberts authored
These tests seem to trigger failures in the entire CI job (not just the test) on AIX. Skip them to see if that helps alleviate spurious failures in node-test-commit-aix (and the upstream PR and commit test jobs). See: - https://github.com/nodejs/build/issues/1820#issuecomment-505998851 - https://github.com/nodejs/build/issues/1847#issuecomment-504210708 PR-URL: https://github.com/nodejs/node/pull/28469 Backport-PR-URL: https://github.com/nodejs/node/pull/29599 Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
-
- Aug 16, 2019
-
-
Beth Griggs authored
PR-URL: https://github.com/nodejs/node/pull/29152
-
Beth Griggs authored
This is a security release. Notable changes: Node.js, as well as many other implementations of HTTP/2, have been found vulnerable to Denial of Service attacks. See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md for more information. Vulnerabilities fixed: * CVE-2019-9511 “Data Dribble”: The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9512 “Ping Flood”: The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9513 “Resource Loop”: The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU, potentially leading to a denial of service. * CVE-2019-9514 “Reset Flood”: The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU,or both, potentially leading to a denial of service. * CVE-2019-9515 “Settings Flood”: The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service. * CVE-2019-9516 “0-Length Headers Leak”: The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory, potentially leading to a denial of service. * CVE-2019-9517 “Internal Data Buffering”: The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both, potentially leading to a denial of service. * CVE-2019-9518 “Empty Frames Flood”: The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU, potentially leading to a denial of service. (Discovered by Piotr Sikora of Google) PR-URL: https://github.com/nodejs/node/pull/29152
-
Anna Henningsen authored
Refs: https://github.com/nodejs/node/pull/27914 Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
nghttp2 has updated its limit for outstanding Ping/Settings ACKs to 1000. This commit allows reverting to the old default of 10000. The associated CVEs are CVE-2019-9512/CVE-2019-9515. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
If we are waiting for the ability to send more output, we should not process more input. This commit a) makes us send output earlier, during processing of input, if we accumulate a lot and b) allows interrupting the call into nghttp2 that processes input data and resuming it at a later time, if we do find ourselves in a position where we are waiting to be able to send more output. This is part of mitigating CVE-2019-9511/CVE-2019-9517. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
If a write to the underlying socket finishes asynchronously, that means that we cannot write any more data at that point without waiting for it to finish. If this happens, we should also not be producing any more input. This is part of mitigating CVE-2019-9511/CVE-2019-9517. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
This is intended to mitigate CVE-2019-9518. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Allocating memory upfront comes with overhead, and in particular, `std::vector` implementations do not necessarily return memory to the system when one might expect that (e.g. after shrinking the vector). Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Ignore headers with 0-length names and track memory for headers the way we track it for other HTTP/2 session memory too. This is intended to mitigate CVE-2019-9516. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Limit the number of invalid input frames, as they may be pointing towards a misbehaving peer. The limit is currently set to 1000 but could be changed or made configurable. This is intended to mitigate CVE-2019-9514. [This commit differs from the v12.x one due to the lack of https://github.com/libuv/libuv/commit/ee24ce900e5714c950b248da2b. See the comment in the test for more details.] Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Limit the number of streams that are rejected upon creation. Since each such rejection is associated with an `NGHTTP2_ENHANCE_YOUR_CALM` error that should tell the peer to not open any more streams, continuing to open streams should be read as a sign of a misbehaving peer. The limit is currently set to 100 but could be changed or made configurable. This is intended to mitigate CVE-2019-9514. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
Lazily allocate `ArrayBuffer`s for the contents of DATA frames. Creating `ArrayBuffer`s is, sadly, not a cheap operation with V8. This is part of performance improvements to mitigate CVE-2019-9513. Together with the previous commit, these changes improve throughput in the adversarial case by about 100 %, and there is little more that we can do besides artificially limiting the rate of incoming metadata frames (i.e. after this patch, CPU usage is virtually exclusively in libnghttp2). [This backport also applies changes from 83e1b974 and required some manual work due to the lack of `AllocatedBuffer` on v10.x. More work was necessary for v8.x, including copying utilities for `util.h` from more recent Node.js versions.] Refs: https://github.com/nodejs/node/pull/26201 Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
For some JS events, it only makes sense to call into JS when there are listeners for the event in question. The overhead is noticeable if a lot of these events are emitted during the lifetime of a session. To reduce this overhead, keep track of whether any/how many JS listeners are present, and if there are none, skip calls into JS altogether. This is part of performance improvements to mitigate CVE-2019-9513. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
DRY up the `debug()` calls, and in particular, avoid building template strings before we know whether we need to. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
Anna Henningsen authored
This includes mitigations for CVE-2019-9512/CVE-2019-9515. Backport-PR-URL: https://github.com/nodejs/node/pull/29124 PR-URL: https://github.com/nodejs/node/pull/29122 Reviewed-By:
-
gengjiawen authored
PR-URL: https://github.com/nodejs/node/pull/28448 Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
-
gengjiawen authored
PR-URL: https://github.com/nodejs/node/pull/27295 Reviewed-By:
Yongsheng Zhang <zyszys98@gmail.com> Reviewed-By:
Masashi Hirano <shisama07@gmail.com>
-
gengjiawen authored
PR-URL: https://github.com/nodejs/node/pull/26990 Reviewed-By:
-
James M Snell authored
Key new feature: RFC 8441 `:protocol` support PR-URL: https://github.com/nodejs/node/pull/23284 Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
-
James M Snell authored
Multiple general improvements to http2 internals for readability and efficiency [This backport applied to v10.x cleanly but had several merge conflicts on v8.x.] PR-URL: https://github.com/nodejs/node/pull/23984 Reviewed-By:
Ujjwal Sharma <usharma1998@gmail.com> Reviewed-By:
-
- Apr 17, 2019
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/26933
-
Myles Borins authored
Notable Changes: * n-api: - add API for asynchronous functions (Gabriel Schulhof) https://github.com/nodejs/node/pull/17887 - mark thread-safe function as stable (Gabriel Schulhof) https://github.com/nodejs/node/pull/25556 PR-URL: https://github.com/nodejs/node/pull/26933
-
- Apr 16, 2019
-
-
Anthony Tuininga authored
Improve performance creating strings using N-API by ensuring that the strings are not internalized. Added test cases for latin-1 and utf-16 strings. PR-URL: https://github.com/nodejs/node/pull/26439 Fixes: https://github.com/nodejs/node/issues/26437 Reviewed-By:
-
Ruben Bridgewater authored
This fixes a regression for an error case with `assert.rejects` and `assert.doesNotReject`. Fixes: https://github.com/nodejs/node/issues/27185 PR-URL: https://github.com/nodejs/node/pull/27202 Reviewed-By:
-
- Mar 21, 2019
-
-
Yihong Wang authored
For shared lib build, we leave the signal handling for embedding users. In these two test cases: - `parallel/test-process-external-stdio-close-spawn` - `parallel/test-process-external-stdio-close` The pipe is used for stdout and is destroied before child process uses it for logging. So the node executble that uses shared lib build receives SIGPIPE and the child process ends. This change ignores the SIGPIPE in node_main.cc for shared lib case. Refs: https://github.com/nodejs/node/issues/18535 Signed-off-by:
Yihong Wang <yh.wang@ibm.com> PR-URL: https://github.com/nodejs/node/pull/19211 Refs: https://github.com/nodejs/node/issues/18535 Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Signed-off-by:
-
John Barboza authored
On AIX the underlying fsync system call returns EBADF on a file descriptor for an open directory. So avoid running fsync on it. PR-URL: https://github.com/nodejs/node/pull/21298 Reviewed-By:
-
Farazmand authored
Original commit message: PPC: fix Regex addi overflow using add insetad of addi when Operand is more than 16 bits long Change-Id: I7f9452381ed8b321ec71e68d0d90485508b69885 Reviewed-on: https://chromium-review.googlesource.com/c/1430619 Commit-Queue: Junliang Yan <jyan@ca.ibm.com> Reviewed-by:Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#59049} Refs: https://github.com/v8/v8/commit/3cc69194b5ee967d0386fdd47de7a84141fef8cc PR-URL: https://github.com/nodejs/node/pull/25874 Reviewed-By:
George Adams <george.adams@uk.ibm.com> Reviewed-By:
-
