diff --git a/0001-Disable-running-gyp-on-shared-deps.patch b/0001-Disable-running-gyp-on-shared-deps.patch index 6d662d3413c3a010b12aecef075d9c822af89a8f..d2f02224025e876e17fbfcdee2d4ebdf452debea 100644 --- a/0001-Disable-running-gyp-on-shared-deps.patch +++ b/0001-Disable-running-gyp-on-shared-deps.patch @@ -1,25 +1,25 @@ -From 0da4decd64a9cbfcf75b2697c722cd6fc82a164d Mon Sep 17 00:00:00 2001 +From 298230f850d45b805e79ab8d1888b1c6c7667335 Mon Sep 17 00:00:00 2001 From: Zuzana Svetlikova -Date: Fri, 17 Apr 2020 12:59:44 +0200 -Subject: [PATCH] 0001 +Date: Thu, 23 Sep 2021 11:32:58 +0800 +Subject: [PATCH] Disable running gyp on shared deps --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile -index 88166da2a8..f0637b6c78 100644 +index 25dd8b3e..36dd400d 100644 --- a/Makefile +++ b/Makefile -@@ -141,7 +141,7 @@ test-code-cache: with-code-cache - echo "'test-code-cache' target is a noop" +@@ -143,7 +143,7 @@ with-code-cache test-code-cache: + $(warning '$@' target is a noop) out/Makefile: config.gypi common.gypi node.gyp \ -- deps/uv/uv.gyp deps/http_parser/http_parser.gyp deps/zlib/zlib.gyp \ -+ deps/http_parser/http_parser.gyp \ +- deps/uv/uv.gyp deps/llhttp/llhttp.gyp deps/zlib/zlib.gyp \ ++ deps/llhttp/llhttp.gyp \ tools/v8_gypfiles/toolchain.gypi tools/v8_gypfiles/features.gypi \ tools/v8_gypfiles/inspector.gypi tools/v8_gypfiles/v8.gyp $(PYTHON) tools/gyp_node.py -f make -- -2.25.2 +2.30.0 diff --git a/0002-Install-both-binaries-and-use-libdir.patch b/0002-Install-both-binaries-and-use-libdir.patch index c0613bf6bf3e456f3f070c3b1833c70297a72703..d04dbd721c5a516db3c55a166b4aac4c0e92adc8 100644 --- a/0002-Install-both-binaries-and-use-libdir.patch +++ b/0002-Install-both-binaries-and-use-libdir.patch @@ -16,17 +16,17 @@ diff --git a/configure.py b/configure.py index 6537a62d3954d83927c698db3fb80c9fc05faba7..b9a894bec9e5fd954004bcb423822ca984066dc5 100755 --- a/configure.py +++ b/configure.py -@@ -571,6 +571,12 @@ parser.add_option('--shared', +@@ -571,6 +571,12 @@ parser.add_argument('--shared', help='compile shared library for embedding node in another project. ' + '(This mode is not officially supported for regular applications)') -+parser.add_option('--libdir', ++parser.add_argument('--libdir', + action='store', + dest='libdir', + default='lib', + help='a directory to install the shared library into') + - parser.add_option('--without-v8-platform', + parser.add_argument('--without-v8-platform', action='store_true', dest='without_v8_platform', @@ -1105,6 +1111,7 @@ def configure_node(o): @@ -41,7 +41,7 @@ diff --git a/tools/install.py b/tools/install.py index 655802980a6ea94d1d4ca1dc63c8c8e905fbb83a..fe4723bf15012c8aacacb0393dc8294c049b0503 100755 --- a/tools/install.py +++ b/tools/install.py -@@ -121,26 +121,23 @@ def subdir_files(path, dest, action): +@@ -121,22 +121,19 @@ def subdir_files(path, dest, action): def files(action): is_windows = sys.platform == 'win32' @@ -60,16 +60,8 @@ index 655802980a6ea94d1d4ca1dc63c8c8e905fbb83a..fe4723bf15012c8aacacb0393dc8294c - output_file += '.dll' - else: - output_file = 'lib' + output_file + '.' + variables.get('shlib_suffix') -- # GYP will output to lib.target except on OS X, this is hardcoded -- # in its source - see the _InstallableTargetInstallPath function. -- if sys.platform != 'darwin': -- output_prefix += 'lib.target/' + output_bin = 'node' + output_lib = 'libnode.' + variables.get('shlib_suffix') -+ # GYP will output to lib.target except on OS X, this is hardcoded -+ # in its source - see the _InstallableTargetInstallPath function. -+ if sys.platform != 'darwin': -+ output_libprefix += 'lib.target/' - if 'false' == variables.get('node_shared'): - action([output_prefix + output_file], 'bin/' + output_file) diff --git a/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch b/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch index 5542230fd65fbd3e76f42d8d424abc91dd6d9497..5a63cba866562361135eaa05f16e9e5d0f5bcce9 100644 --- a/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch +++ b/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch @@ -11,15 +11,17 @@ diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-defin index c7c07e6d..38a035e2 100644 --- a/deps/v8/src/flags/flag-definitions.h +++ b/deps/v8/src/flags/flag-definitions.h +DEFINE_BOOL(always_compact, false, "Perform compaction on every full GC") +DEFINE_BOOL(never_compact, false, @@ -917,7 +917,7 @@ DEFINE_BOOL(memory_reducer_for_small_heaps, true, "use memory reducer for small heaps") DEFINE_INT(heap_growing_percent, 0, "specifies heap growing factor as (1 + heap_growing_percent/100)") -DEFINE_INT(v8_os_page_size, 0, "override OS page size (in KBytes)") +DEFINE_INT(v8_os_page_size, 64, "override OS page size (in KBytes)") + DEFINE_BOOL(allocation_buffer_parking, true, "allocation buffer parking") DEFINE_BOOL(always_compact, false, "Perform compaction on every full GC") DEFINE_BOOL(never_compact, false, - "Never perform compaction on full GC - testing only") -- 2.23.0 diff --git a/0004-Make-AARCH64-compile-on-64KB-physical-pages.patch b/0004-Make-AARCH64-compile-on-64KB-physical-pages.patch index c276904fc92112e3f7a921c3b9798990a8cfd29e..787b23fff1b7180d6799b9c75072e0b3878b9c65 100644 --- a/0004-Make-AARCH64-compile-on-64KB-physical-pages.patch +++ b/0004-Make-AARCH64-compile-on-64KB-physical-pages.patch @@ -11,15 +11,16 @@ diff --git a/deps/v8/src/base/build_config.h b/deps/v8/src/base/build_config.h index f430082..098e36f 100644 --- a/deps/v8/src/base/build_config.h +++ b/deps/v8/src/base/build_config.h +#elif defined(ENABLE_HUGEPAGE) @@ -202,7 +202,7 @@ - #endif + V8_TARGET_ARCH_STORES_RETURN_ADDRESS_ON_STACK ? 1 : 0; // Number of bits to represent the page size for paged spaces. -#if defined(V8_TARGET_ARCH_PPC) || defined(V8_TARGET_ARCH_PPC64) +#if defined(V8_TARGET_ARCH_PPC) || defined(V8_TARGET_ARCH_PPC64) || defined(V8_TARGET_ARCH_ARM64) // PPC has large (64KB) physical pages. const int kPageSizeBits = 19; - #else + #elif defined(ENABLE_HUGEPAGE) -- 2.23.0 diff --git a/0005-use-getauxval-in-node_main_cc.patch b/0005-use-getauxval-in-node_main_cc.patch deleted file mode 100644 index b1c67ae33dbff030bee6144477fb5ffa8ba797aa..0000000000000000000000000000000000000000 --- a/0005-use-getauxval-in-node_main_cc.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 7232c2a1604d241ce0455d919ba9b0b8e9959f81 Mon Sep 17 00:00:00 2001 -From: Daniel Bevenius -Date: Tue, 2 Jun 2020 05:33:25 +0200 -Subject: [PATCH] src: use getauxval in node_main.cc - -This commit suggests using getauxval in node_main.cc. - -The motivation for this is that getauxval was introduced in glibc 2.16 -and looking at BUILDING.md, in the 'Platform list' section, it looks -like we now support glibc >= 2.17 and perhaps this change would be -alright now. - -PR-URL: https://github.com/nodejs/node/pull/33693 -Refs: https://github.com/nodejs/node/pull/12548 -Reviewed-By: Ben Noordhuis -Reviewed-By: David Carlier -Reviewed-By: Anna Henningsen -Reviewed-By: Colin Ihrig -Reviewed-By: James M Snell ---- - src/node_main.cc | 18 ++---------------- - 1 file changed, 2 insertions(+), 16 deletions(-) - -diff --git a/src/node_main.cc b/src/node_main.cc -index 9f4ea22d12c6..6bac10759325 100644 ---- a/src/node_main.cc -+++ b/src/node_main.cc -@@ -89,13 +89,7 @@ int wmain(int argc, wchar_t* wargv[]) { - #else - // UNIX - #ifdef __linux__ --#include --#ifdef __LP64__ --#define Elf_auxv_t Elf64_auxv_t --#else --#define Elf_auxv_t Elf32_auxv_t --#endif // __LP64__ --extern char** environ; -+#include - #endif // __linux__ - #if defined(__POSIX__) && defined(NODE_SHARED_MODE) - #include -@@ -124,15 +118,7 @@ int main(int argc, char* argv[]) { - #endif - - #if defined(__linux__) -- char** envp = environ; -- while (*envp++ != nullptr) {} -- Elf_auxv_t* auxv = reinterpret_cast(envp); -- for (; auxv->a_type != AT_NULL; auxv++) { -- if (auxv->a_type == AT_SECURE) { -- node::per_process::linux_at_secure = auxv->a_un.a_val; -- break; -- } -- } -+ node::per_process::linux_at_secure = getauxval(AT_SECURE); - #endif - // Disable stdio buffering, it interacts poorly with printf() - // calls elsewhere in the program (e.g., any logging from V8.) - diff --git a/CVE-2020-8265.patch b/CVE-2020-8265.patch deleted file mode 100644 index 534550e3ec19ae3d97390a5af9e1dff98a20872b..0000000000000000000000000000000000000000 --- a/CVE-2020-8265.patch +++ /dev/null @@ -1,164 +0,0 @@ -From 5b00de7d67a1372aa342115ad28edd3f78268bb6 Mon Sep 17 00:00:00 2001 -From: James M Snell -Date: Thu, 12 Nov 2020 12:34:33 -0800 -Subject: [PATCH] src: retain pointers to WriteWrap/ShutdownWrap - -Avoids potential use-after-free when wrap req's are synchronously -destroyed. - -CVE-ID: CVE-2020-8265 -Fixes: https://github.com/nodejs-private/node-private/issues/227 -PR-URL: https://github.com/nodejs-private/node-private/pull/230 -Refs: https://hackerone.com/bugs?subject=nodejs&report_id=988103 -Reviewed-By: Anna Henningsen -Reviewed-By: Matteo Collina -Reviewed-By: Rich Trott -Reference: https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268bb6 ---- - src/stream_base-inl.h | 11 +++- - src/stream_base.cc | 2 +- - src/stream_base.h | 1 + - .../test-tls-use-after-free-regression.js | 58 +++++++++++++++++++ - 4 files changed, 68 insertions(+), 4 deletions(-) - create mode 100644 test/parallel/test-tls-use-after-free-regression.js - -diff --git a/src/stream_base-inl.h b/src/stream_base-inl.h -index dd80683af10..1603a2fb2e0 100644 ---- a/src/stream_base-inl.h -+++ b/src/stream_base-inl.h -@@ -163,8 +163,11 @@ inline int StreamBase::Shutdown(v8::Local req_wrap_obj) { - StreamReq::ResetObject(req_wrap_obj); - } - -+ BaseObjectPtr req_wrap_ptr; - AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap()); - ShutdownWrap* req_wrap = CreateShutdownWrap(req_wrap_obj); -+ if (req_wrap != nullptr) -+ req_wrap_ptr.reset(req_wrap->GetAsyncWrap()); - int err = DoShutdown(req_wrap); - - if (err != 0 && req_wrap != nullptr) { -@@ -198,7 +201,7 @@ inline StreamWriteResult StreamBase::Write( - if (send_handle == nullptr) { - err = DoTryWrite(&bufs, &count); - if (err != 0 || count == 0) { -- return StreamWriteResult { false, err, nullptr, total_bytes }; -+ return StreamWriteResult { false, err, nullptr, total_bytes, {} }; - } - } - -@@ -208,13 +211,14 @@ inline StreamWriteResult StreamBase::Write( - if (!env->write_wrap_template() - ->NewInstance(env->context()) - .ToLocal(&req_wrap_obj)) { -- return StreamWriteResult { false, UV_EBUSY, nullptr, 0 }; -+ return StreamWriteResult { false, UV_EBUSY, nullptr, 0, {} }; - } - StreamReq::ResetObject(req_wrap_obj); - } - - AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap()); - WriteWrap* req_wrap = CreateWriteWrap(req_wrap_obj); -+ BaseObjectPtr req_wrap_ptr(req_wrap->GetAsyncWrap()); - - err = DoWrite(req_wrap, bufs, count, send_handle); - bool async = err == 0; -@@ -232,7 +236,8 @@ inline StreamWriteResult StreamBase::Write( - ClearError(); - } - -- return StreamWriteResult { async, err, req_wrap, total_bytes }; -+ return StreamWriteResult { -+ async, err, req_wrap, total_bytes, std::move(req_wrap_ptr) }; - } - - template -diff --git a/src/stream_base.cc b/src/stream_base.cc -index 516f57e40bf..06032e2c096 100644 ---- a/src/stream_base.cc -+++ b/src/stream_base.cc -@@ -259,7 +259,7 @@ int StreamBase::WriteString(const FunctionCallbackInfo& args) { - - // Immediate failure or success - if (err != 0 || count == 0) { -- SetWriteResult(StreamWriteResult { false, err, nullptr, data_size }); -+ SetWriteResult(StreamWriteResult { false, err, nullptr, data_size, {} }); - return err; - } - -diff --git a/src/stream_base.h b/src/stream_base.h -index eb75fdc8339..fafd327d75d 100644 ---- a/src/stream_base.h -+++ b/src/stream_base.h -@@ -24,6 +24,7 @@ struct StreamWriteResult { - int err; - WriteWrap* wrap; - size_t bytes; -+ BaseObjectPtr wrap_obj; - }; - - using JSMethodFunction = void(const v8::FunctionCallbackInfo& args); -diff --git a/test/parallel/test-tls-use-after-free-regression.js b/test/parallel/test-tls-use-after-free-regression.js -new file mode 100644 -index 00000000000..51835fc0339 ---- /dev/null -+++ b/test/parallel/test-tls-use-after-free-regression.js -@@ -0,0 +1,58 @@ -+'use strict'; -+ -+const common = require('../common'); -+ -+if (!common.hasCrypto) -+ common.skip('missing crypto'); -+ -+const https = require('https'); -+const tls = require('tls'); -+ -+const kMessage = -+ 'GET / HTTP/1.1\r\nHost: localhost\r\nConnection: Keep-alive\r\n\r\n'; -+ -+const key = `-----BEGIN EC PARAMETERS----- -+BggqhkjOPQMBBw== -+-----END EC PARAMETERS----- -+-----BEGIN EC PRIVATE KEY----- -+MHcCAQEEIDKfHHbiJMdu2STyHL11fWC7psMY19/gUNpsUpkwgGACoAoGCCqGSM49 -+AwEHoUQDQgAEItqm+pYj3Ca8bi5mBs+H8xSMxuW2JNn4I+kw3aREsetLk8pn3o81 -+PWBiTdSZrGBGQSy+UAlQvYeE6Z/QXQk8aw== -+-----END EC PRIVATE KEY-----`; -+ -+const cert = `-----BEGIN CERTIFICATE----- -+MIIBhjCCASsCFDJU1tCo88NYU//pE+DQKO9hUDsFMAoGCCqGSM49BAMCMEUxCzAJ -+BgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5l -+dCBXaWRnaXRzIFB0eSBMdGQwHhcNMjAwOTIyMDg1NDU5WhcNNDgwMjA3MDg1NDU5 -+WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwY -+SW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD -+QgAEItqm+pYj3Ca8bi5mBs+H8xSMxuW2JNn4I+kw3aREsetLk8pn3o81PWBiTdSZ -+rGBGQSy+UAlQvYeE6Z/QXQk8azAKBggqhkjOPQQDAgNJADBGAiEA7Bdn4F87KqIe -+Y/ABy/XIXXpFUb2nyv3zV7POQi2lPcECIQC3UWLmfiedpiIKsf9YRIyO0uEood7+ -+glj2R1NNr1X68w== -+-----END CERTIFICATE-----`; -+ -+const server = https.createServer( -+ { key, cert }, -+ common.mustCall((req, res) => { -+ res.writeHead(200); -+ res.end('boom goes the dynamite\n'); -+ }, 3)); -+ -+server.listen(0, common.mustCall(() => { -+ const socket = -+ tls.connect( -+ server.address().port, -+ 'localhost', -+ { rejectUnauthorized: false }, -+ common.mustCall(() => { -+ socket.write(kMessage); -+ socket.write(kMessage); -+ socket.write(kMessage); -+ })); -+ -+ socket.on('data', common.mustCall(() => socket.destroy())); -+ socket.on('close', () => { -+ setImmediate(() => server.close()); -+ }); -+})); diff --git a/CVE-2020-8287-1.patch b/CVE-2020-8287-1.patch deleted file mode 100644 index 3761c94220efdbe4357ff1f5fe0cc83b49eb07ee..0000000000000000000000000000000000000000 --- a/CVE-2020-8287-1.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 92d430917a63a567bb528100371263c46e50ee4a Mon Sep 17 00:00:00 2001 -From: Fedor Indutny -Date: Wed, 18 Nov 2020 20:50:21 -0800 -Subject: [PATCH] http: unset `F_CHUNKED` on new `Transfer-Encoding` - -Duplicate `Transfer-Encoding` header should be a treated as a single, -but with original header values concatenated with a comma separator. In -the light of this, even if the past `Transfer-Encoding` ended with -`chunked`, we should be not let the `F_CHUNKED` to leak into the next -header, because mere presence of another header indicates that `chunked` -is not the last transfer-encoding token. - -CVE-ID: CVE-2020-8287 -PR-URL: https://github.com/nodejs-private/node-private/pull/236 -Reviewed-By: Fedor Indutny -Reference: https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50ee4a ---- - deps/http_parser/http_parser.c | 7 +++++++ - deps/http_parser/test.c | 26 ++++++++++++++++++++++++++ - 2 files changed, 33 insertions(+) - -diff --git a/deps/http_parser/http_parser.c b/deps/http_parser/http_parser.c -index 0f76b6a..5cc951a 100644 ---- a/deps/http_parser/http_parser.c -+++ b/deps/http_parser/http_parser.c -@@ -1339,6 +1339,13 @@ reexecute: - } else if (parser->index == sizeof(TRANSFER_ENCODING)-2) { - parser->header_state = h_transfer_encoding; - parser->flags |= F_TRANSFER_ENCODING; -+ -+ /* Multiple `Transfer-Encoding` headers should be treated as -+ * one, but with values separate by a comma. -+ * -+ * See: https://tools.ietf.org/html/rfc7230#section-3.2.2 -+ */ -+ parser->flags &= ~F_CHUNKED; - } - break; - -diff --git a/deps/http_parser/test.c b/deps/http_parser/test.c -index c979467..f185c56 100644 ---- a/deps/http_parser/test.c -+++ b/deps/http_parser/test.c -@@ -2045,6 +2045,32 @@ const struct message responses[] = - ,.body= "2\r\nOK\r\n0\r\n\r\n" - ,.num_chunks_complete= 0 - } -+#define HTTP_200_DUPLICATE_TE_NOT_LAST_CHUNKED 30 -+, {.name= "HTTP 200 response with `chunked` and duplicate Transfer-Encoding" -+ ,.type= HTTP_RESPONSE -+ ,.raw= "HTTP/1.1 200 OK\r\n" -+ "Transfer-Encoding: chunked\r\n" -+ "Transfer-Encoding: identity\r\n" -+ "\r\n" -+ "2\r\n" -+ "OK\r\n" -+ "0\r\n" -+ "\r\n" -+ ,.should_keep_alive= FALSE -+ ,.message_complete_on_eof= TRUE -+ ,.http_major= 1 -+ ,.http_minor= 1 -+ ,.status_code= 200 -+ ,.response_status= "OK" -+ ,.content_length= -1 -+ ,.num_headers= 2 -+ ,.headers= -+ { { "Transfer-Encoding", "chunked" } -+ , { "Transfer-Encoding", "identity" } -+ } -+ ,.body= "2\r\nOK\r\n0\r\n\r\n" -+ ,.num_chunks_complete= 0 -+ } - }; - - /* strnlen() is a POSIX.2008 addition. Can't rely on it being available so --- -2.23.0 - diff --git a/CVE-2020-8287-2.patch b/CVE-2020-8287-2.patch deleted file mode 100644 index e88984e2414c599c7ead781e9ef30bb6d89aabef..0000000000000000000000000000000000000000 --- a/CVE-2020-8287-2.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 420244e4d9ca6de2612e7f503f5c87e448fbc14b Mon Sep 17 00:00:00 2001 -From: Matteo Collina -Date: Thu, 22 Oct 2020 14:10:51 +0200 -Subject: [PATCH] http: unset `F_CHUNKED` on new `Transfer-Encoding` - -Duplicate `Transfer-Encoding` header should be a treated as a single, -but with original header values concatenated with a comma separator. In -the light of this, even if the past `Transfer-Encoding` ended with -`chunked`, we should be not let the `F_CHUNKED` to leak into the next -header, because mere presence of another header indicates that `chunked` -is not the last transfer-encoding token. - -Ref: https://github.com/nodejs-private/llhttp-private/pull/3 -See: https://hackerone.com/bugs?report_id=1002188&subject=nodejs - -CVE-ID: CVE-2020-8287 -PR-URL: https://github.com/nodejs-private/node-private/pull/236 -Reviewed-By: Fedor Indutny -Reference: https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc14b ---- - deps/llhttp/src/llhttp.c | 36 ++++++++++++++- - .../test-http-transfer-encoding-smuggling.js | 46 +++++++++++++++++++ - 2 files changed, 80 insertions(+), 2 deletions(-) - create mode 100644 test/parallel/test-http-transfer-encoding-smuggling.js - -diff --git a/deps/llhttp/src/llhttp.c b/deps/llhttp/src/llhttp.c -index acc35479f88..3019c410963 100644 ---- a/deps/llhttp/src/llhttp.c -+++ b/deps/llhttp/src/llhttp.c -@@ -813,6 +813,14 @@ int llhttp__internal__c_or_flags_16( - return 0; - } - -+int llhttp__internal__c_and_flags( -+ llhttp__internal_t* state, -+ const unsigned char* p, -+ const unsigned char* endp) { -+ state->flags &= -9; -+ return 0; -+} -+ - int llhttp__internal__c_update_header_state_7( - llhttp__internal_t* state, - const unsigned char* p, -@@ -5974,10 +5982,18 @@ static llparse_state_t llhttp__internal__run( - /* UNREACHABLE */; - abort(); - } -+ s_n_llhttp__internal__n_invoke_and_flags: { -+ switch (llhttp__internal__c_and_flags(state, p, endp)) { -+ default: -+ goto s_n_llhttp__internal__n_header_value_te_chunked; -+ } -+ /* UNREACHABLE */; -+ abort(); -+ } - s_n_llhttp__internal__n_invoke_or_flags_16: { - switch (llhttp__internal__c_or_flags_16(state, p, endp)) { - default: -- goto s_n_llhttp__internal__n_header_value_te_chunked; -+ goto s_n_llhttp__internal__n_invoke_and_flags; - } - /* UNREACHABLE */; - abort(); -@@ -7625,6 +7641,14 @@ int llhttp__internal__c_or_flags_16( - return 0; - } - -+int llhttp__internal__c_and_flags( -+ llhttp__internal_t* state, -+ const unsigned char* p, -+ const unsigned char* endp) { -+ state->flags &= -9; -+ return 0; -+} -+ - int llhttp__internal__c_update_header_state_7( - llhttp__internal_t* state, - const unsigned char* p, -@@ -12522,10 +12546,18 @@ static llparse_state_t llhttp__internal__run( - /* UNREACHABLE */; - abort(); - } -+ s_n_llhttp__internal__n_invoke_and_flags: { -+ switch (llhttp__internal__c_and_flags(state, p, endp)) { -+ default: -+ goto s_n_llhttp__internal__n_header_value_te_chunked; -+ } -+ /* UNREACHABLE */; -+ abort(); -+ } - s_n_llhttp__internal__n_invoke_or_flags_16: { - switch (llhttp__internal__c_or_flags_16(state, p, endp)) { - default: -- goto s_n_llhttp__internal__n_header_value_te_chunked; -+ goto s_n_llhttp__internal__n_invoke_and_flags; - } - /* UNREACHABLE */; - abort(); -diff --git a/test/parallel/test-http-transfer-encoding-smuggling.js b/test/parallel/test-http-transfer-encoding-smuggling.js -new file mode 100644 -index 00000000000..9d97db4c0a2 ---- /dev/null -+++ b/test/parallel/test-http-transfer-encoding-smuggling.js -@@ -0,0 +1,46 @@ -+'use strict'; -+ -+const common = require('../common'); -+ -+const assert = require('assert'); -+const http = require('http'); -+const net = require('net'); -+ -+const msg = [ -+ 'POST / HTTP/1.1', -+ 'Host: 127.0.0.1', -+ 'Transfer-Encoding: chunked', -+ 'Transfer-Encoding: chunked-false', -+ 'Connection: upgrade', -+ '', -+ '1', -+ 'A', -+ '0', -+ '', -+ 'GET /flag HTTP/1.1', -+ 'Host: 127.0.0.1', -+ '', -+ '', -+].join('\r\n'); -+ -+// Verify that the server is called only once even with a smuggled request. -+ -+const server = http.createServer(common.mustCall((req, res) => { -+ res.end(); -+}, 1)); -+ -+function send(next) { -+ const client = net.connect(server.address().port, 'localhost'); -+ client.setEncoding('utf8'); -+ client.on('error', common.mustNotCall()); -+ client.on('end', next); -+ client.write(msg); -+ client.resume(); -+} -+ -+server.listen(0, common.mustCall((err) => { -+ assert.ifError(err); -+ send(common.mustCall(() => { -+ server.close(); -+ })); -+})); diff --git a/CVE-2021-22883.patch b/CVE-2021-22883.patch deleted file mode 100644 index 4e50657705fc1972cdfa3fe27089c141ba950600..0000000000000000000000000000000000000000 --- a/CVE-2021-22883.patch +++ /dev/null @@ -1,219 +0,0 @@ -From 922ada77132c1b0b69c9a146822d762b2f9b912b Mon Sep 17 00:00:00 2001 -From: Daniel Bevenius -Date: Fri, 22 Jan 2021 12:34:21 +0100 -Subject: [PATCH] http2: add unknownProtocol timeout -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This commit add a configuration options named unknownProtocolTimeout -which can be specified to set a value for the timeout in milliseconds -that a server should wait when an unknowProtocol is sent to it. When -this happens a timer will be started and the if the socket has not been -destroyed during that time the timer callback will destoy it. - -Refs: https://hackerone.com/reports/1043360 -CVE-ID: CVE-2021-22883 -PR-URL: https://github.com/nodejs/node/pull/246 -Backport-PR-URL: https://github.com/nodejs/node/pull/250 -Reviewed-By: Beth Griggs -Reviewed-By: Matteo Collina -Reviewed-By: Michael Dawson -Reviewed-By: Rich Trott -Reviewed-By: Tobias Nießen -Reference: https://github.com/nodejs/node/commit/922ada77132c1b0b69c9a146822d762b2f9b912b ---- - doc/api/http2.md | 25 +++++++++++++- - lib/internal/http2/core.js | 31 ++++++++++++++--- - .../test-http2-server-unknown-protocol.js | 33 +++++++++++++++++++ - 3 files changed, 84 insertions(+), 5 deletions(-) - create mode 100644 test/parallel/test-http2-server-unknown-protocol.js - -diff --git a/doc/api/http2.md b/doc/api/http2.md -index 40a107f..d57a560 100644 ---- a/doc/api/http2.md -+++ b/doc/api/http2.md -@@ -1908,7 +1908,9 @@ added: v8.4.0 - The `'unknownProtocol'` event is emitted when a connecting client fails to - negotiate an allowed protocol (i.e. HTTP/2 or HTTP/1.1). The event handler - receives the socket for handling. If no listener is registered for this event, --the connection is terminated. See the [Compatibility API][]. -+the connection is terminated. A timeout may be specified using the -+`'unknownProtocolTimeout'` option passed to [`http2.createSecureServer()`][]. -+See the [Compatibility API][]. - - #### `server.close([callback])` -