PR-URL: https://github.com/nodejs/node/pull/27314

Notable changes:

* deps: add s390 asm rules for OpenSSL-1.1.1 (Shigeki Ohtsu) [#19794](https://github.com/nodejs/node/pull/19794)
* src: add .code and SSL specific error properties (Sam Roberts) [#25093](https://github.com/nodejs/node/pull/25093)
* tls:
  * add --tls-min-v1.2 CLI switch (Sam Roberts) [#26951](https://github.com/nodejs/node/pull/26951)
  * supported shared openssl 1.1.0 (Sam Roberts) [#26951](https://github.com/nodejs/node/pull/26951)
  * revert default max toTLSv1.2 (Sam Roberts) [#26951](https://github.com/nodejs/node/pull/26951)
  * revert change to invalid protocol error type (Sam Roberts) [#26951](https://github.com/nodejs/node/pull/26951)
  * support TLSv1.3 (Sam Roberts) [#26209](https://github.com/nodejs/node/pull/26209)
  * add code for ERR\_TLS\_INVALID\_PROTOCOL\_METHOD (Sam Roberts) [#24729](https://github.com/nodejs/node/pull/24729)

PR-URL: https://github.com/nodejs/node/pull/27314

The differences to the original patch are the replacement of
`i::IsIdentifier...()` with `unicode_cache_.IsIdentifier...()`,
because the former is not available on Node.js v11.x, as well
as the omitted `no_gc` argument for `GetFlatContent()`.

Original commit message:

    Assume flat string when checking CompileFunctionInContext arguments.

    R=jkummerow@chromium.org

    Change-Id: I54c6137a3c6e14d4102188f154aa7216e7414dbc
    Reviewed-on: https://chromium-review.googlesource.com/c/1388533


Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
    Commit-Queue: Yang Guo <yangguo@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#58562}

Refs: https://github.com/v8/v8/commit/61f4c2251e107aebca620054701f2faec36209a8
Fixes: https://github.com/nodejs/node/issues/27256

PR-URL: https://github.com/nodejs/node/pull/27259


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

For 11.x, the default minimum is TLSv1, so it needs a CLI switch to
change the default to the more secure minimum of TLSv1.2.

PR-URL: https://github.com/nodejs/node/pull/26951


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/26951


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26821


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26843


Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <minwoo@nodesource.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26843


Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Minwoo Jung <minwoo@nodesource.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>

TLSv1.3 is still supported when explicitly configured, but it is not the
default.

PR-URL: https://github.com/nodejs/node/pull/26951


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

This introduces TLS1.3 support and makes it the default max protocol,
but also supports CLI/NODE_OPTIONS switches to disable it if necessary.

TLS1.3 is a major update to the TLS protocol, with many security
enhancements. It should be preferred over TLS1.2 whenever possible.

TLS1.3 is different enough that even though the OpenSSL APIs are
technically API/ABI compatible, that when TLS1.3 is negotiated, the
timing of protocol records and of callbacks broke assumptions hard-coded
into the 'tls' module.

This change introduces no API incompatibilities when TLS1.2 is
negotiated. It is the intention that it be backported to current and LTS
release lines with the default maximum TLS protocol reset to 'TLSv1.2'.
This will allow users of those lines to explicitly enable TLS1.3 if they
want.

API incompatibilities between TLS1.2 and TLS1.3 are:

- Renegotiation is not supported by TLS1.3 protocol, attempts to call
`.renegotiate()` will always fail.

- Compiling against a system OpenSSL lower than 1.1.1 is no longer
supported (OpenSSL-1.1.0 used to be supported with configure flags).

- Variations of `conn.write('data'); conn.destroy()` have undefined
behaviour according to the streams API. They may or may not send the
'data', and may or may not cause a ERR_STREAM_DESTROYED error to be
emitted. This has always been true, but conditions under which the write
suceeds is slightly but observably different when TLS1.3 is negotiated
vs when TLS1.2 or below is negotiated.

- If TLS1.3 is negotiated, and a server calls `conn.end()` in its
'secureConnection' listener without any data being written, the client
will not receive session tickets (no 'session' events will be emitted,
and `conn.getSession()` will never return a resumable session).

- The return value of `conn.getSession()` API may not return a resumable
session if called right after the handshake. The effect will be that
clients using the legacy `getSession()` API will resume sessions if
TLS1.2 is negotiated, but will do full handshakes if TLS1.3 is
negotiated.  See https://github.com/nodejs/node/pull/25831 for more
information.

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26209


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>

`cd deps/openssl/config; make` updates all archs dependant files.

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26327


Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This is a floating patch against OpenSSL-1.1.1 to generate asm files
with Makefile rules.

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26327


Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

Original:

Fixes: https://github.com/nodejs/node/issues/4270
PR-URL: https://github.com/nodejs/node/pull/19794


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

This updates all sources in deps/openssl/openssl with openssl-1.1.1b.

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/26327


Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

SSL errors have a long structured message, but lacked the standard .code
property which can be used for stable comparisons. Add a `code`
property, as well as the 3 string components of an SSL error: `reason`,
`library`, and `function`.

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/25093


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>

In https://github.com/nodejs/node/pull/24729, the error was changed to
be a TypeError, which is the standard type for this kind of error.
However, it was Error in 11.x and earlier, so revert that single aspect,
so the backport can be semver-minor.

PR-URL: https://github.com/nodejs/node/pull/26951


Reviewed-By: Rod Vagg <rod@vagg.org>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Add an error code property to invalid `secureProtocol` method
exceptions.

Backport-PR-URL: https://github.com/nodejs/node/pull/26951
PR-URL: https://github.com/nodejs/node/pull/24729


Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/27163

Notable changes:

- child_process: doc deprecate ChildProcess.\_channel (cjihrig)
  [#26982](https://github.com/nodejs/node/pull/26982)
- deps: update nghttp2 to 1.37.0 (gengjiawen)
  [#26990](https://github.com/nodejs/node/pull/26990)
- dns:
  - make dns.promises enumerable (cjihrig)
    [#26592](https://github.com/nodejs/node/pull/26592)
  - remove dns.promises experimental warning (cjihrig)
    [#26592](https://github.com/nodejs/node/pull/26592)
- fs: remove experimental warning for fs.promises (Anna Henningsen)
  [#26581] (https://github.com/nodejs/node/pull/26581)
- stream: make Symbol.asyncIterator support stable (Matteo Collina)
  [#26989](https://github.com/nodejs/node/pull/26989)
- worker: use copy of process.env (Anna Henningsen)
  [#26544](https://github.com/nodejs/node/pull/26544)

PR-URL: https://github.com/nodejs/node/pull/27163

Refs: https://github.com/nodejs/node/pull/26982

PR-URL: https://github.com/nodejs/node/pull/27164


Reviewed-By: Vse Mozhet Byt <vsemozhetbyt@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>

PR-URL: https://github.com/nodejs/node/pull/27041


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

It was reported that parallel builds on Windows sometimes error because
of missing intermediate files.

On closer inspection I noticed that some files are copied from src/ to
the intermediate build directory in a way where they don't participate
in dependency resolution. Put another way, the build system doesn't
know to wait for the copy to complete because we don't tell it to.

Fix that by not copying around files but instead making the script that
processes them a little smarter about where to find them and where to
store the results.

PR-URL: https://github.com/nodejs/node/pull/27026
Fixes: https://github.com/nodejs/node/issues/27025


Reviewed-By: Eugene Ostroukhov <eostroukhov@google.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Cleanup some code and make the emit hooks very slightly faster.

PR-URL: https://github.com/nodejs/node/pull/27034


Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/27041


Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

When console.log is called for the first time it initializes
TTYWrap object. However, if there is not enough space on the
V8 stack, creating function template fails and triggers
empty maybe local exception.

PR-URL: https://github.com/nodejs/node/pull/26832


Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/26591


Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

This change adds the generated files required for building OpenSSL for
Node.js for ARM64 Windows. I did this on a VM running Ubuntu 18.04. The
basic workflow is to cd to deps/openssl/config and run `make`,
installing any needed packages until all architectures build correctly.

Note that OpenSSL 1.1.1 does not support ASM on ARM64 Windows, so this
change also supports only no-asm on ARM64 Windows.

PR-URL: https://github.com/nodejs/node/pull/26001
Fixes: https://github.com/nodejs/node/issues/25998


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

This adds ARM64 Windows support in the OpenSSL build system.

Since OpenSSL's ARM64 Windows support does not have support for ASM--
that is, VC-WIN64-ARM inherits from VC-noCE-common which has no ASM
files--`openssl_no_asm.gypi` is always used for building. This
essentially forces the 'no-asm' Configure flag.

PR-URL: https://github.com/nodejs/node/pull/26001
Fixes: https://github.com/nodejs/node/issues/25998


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

The list argument may only be of type array, not of any other type
as it actually suggests.

PR-URL: https://github.com/nodejs/node/pull/27050


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Yongsheng Zhang <zyszys98@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

This adds an extra modules caching layer that operates on the parent's
`path` property and the current require argument. That together can
be used as unique identifier to speed up loading the same module more
than once. It is a cache on top of the current modules cache.

It has the nice feature that this cache does not only work in the same
file but it works for the whole current directory. So if the same file
is loaded in any other file from the same directory, it will also hit
this cache instead of having to resolve the file again.

To keep it backwards compatible with the old modules cache, it detects
invalidation of that cache.

PR-URL: https://github.com/nodejs/node/pull/26970
Refs: https://github.com/nodejs/node/pull/25362


Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

This adds the `path` property to the module object. It contains the
current directory as path. That is necessary to add an extra caching
layer.

It also makes sure the `id` uses a default in case it's not set.
Otherwise the `path.dirname(id)` command could fail.

PR-URL: https://github.com/nodejs/node/pull/26970
Refs: https://github.com/nodejs/node/pull/25362


Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Moving `try / catch` into separate functions is not necessary
anymore due to V8 optimizations.

PR-URL: https://github.com/nodejs/node/pull/26970
Refs: https://github.com/nodejs/node/pull/25362


Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Add more benchmark options to properly verify the gains.

This makes sure the benchmark also tests requiring the same module
again instead of only loading each module only once.

PR-URL: https://github.com/nodejs/node/pull/26970
Refs: https://github.com/nodejs/node/pull/25362


Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/26970
Refs: https://github.com/nodejs/node/pull/25362


Reviewed-By: Guy Bedford <guybedford@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Change `memset(&s, 0, sizeof(type))` to `memset(&s, 0, sizeof(s))`.
The former is dangerous when the type of `s` changes.

PR-URL: https://github.com/nodejs/node/pull/27038


Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Santiago Gimeno <santiago.gimeno@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/27076


Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Richard Lau <riclau@uk.ibm.com>
Reviewed-By: Yuta Hiroto <hello@hiroppy.me>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

Correctly document the default maxBuffer size for execSync,
execFileSync, and spawnSync. It is 200 * 1024, not Infinity.
Add tests to verify behaviour is as documented.

PR-URL: https://github.com/nodejs/node/pull/22894


Reviewed-By: Sam Roberts <vieuxtech@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

The check that the user specified `icu` in `--download` only needs to be
done once and not for each entry in `tools/icu/current_ver.dep`.

Fixes: https://github.com/nodejs/node/issues/26860

PR-URL: https://github.com/nodejs/node/pull/27031


Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

This gets rid of Environment::ExecutionMode as well now that
we use the original arguments to determine execution mode.

PR-URL: https://github.com/nodejs/node/pull/26945


Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/26885


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Minwoo Jung <minwoo@nodesource.com>
Reviewed-By: Refael Ackermann <refack@gmail.com>
Signed-off-by: Beth Griggs <Bethany.Griggs@uk.ibm.com>

PR-URL: https://github.com/nodejs/node/pull/26990


Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>