diff --git a/0001-Disable-running-gyp-on-shared-deps.patch b/0001-Disable-running-gyp-on-shared-deps.patch deleted file mode 100644 index 6d662d3413c3a010b12aecef075d9c822af89a8f..0000000000000000000000000000000000000000 --- a/0001-Disable-running-gyp-on-shared-deps.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 0da4decd64a9cbfcf75b2697c722cd6fc82a164d Mon Sep 17 00:00:00 2001 -From: Zuzana Svetlikova -Date: Fri, 17 Apr 2020 12:59:44 +0200 -Subject: [PATCH] 0001 - ---- - Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/Makefile b/Makefile -index 88166da2a8..f0637b6c78 100644 ---- a/Makefile -+++ b/Makefile -@@ -141,7 +141,7 @@ test-code-cache: with-code-cache - echo "'test-code-cache' target is a noop" - - out/Makefile: config.gypi common.gypi node.gyp \ -- deps/uv/uv.gyp deps/http_parser/http_parser.gyp deps/zlib/zlib.gyp \ -+ deps/http_parser/http_parser.gyp \ - tools/v8_gypfiles/toolchain.gypi tools/v8_gypfiles/features.gypi \ - tools/v8_gypfiles/inspector.gypi tools/v8_gypfiles/v8.gyp - $(PYTHON) tools/gyp_node.py -f make --- -2.25.2 - diff --git a/0002-Install-both-binaries-and-use-libdir.patch b/0002-Install-both-binaries-and-use-libdir.patch deleted file mode 100644 index c0613bf6bf3e456f3f070c3b1833c70297a72703..0000000000000000000000000000000000000000 --- a/0002-Install-both-binaries-and-use-libdir.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 11512edeb046b64be4daca76f061a3a918251ee0 Mon Sep 17 00:00:00 2001 -From: Elliott Sales de Andrade -Date: Tue, 19 Mar 2019 23:22:40 -0400 -Subject: [PATCH 2/2] Install both binaries and use libdir. - -This allows us to build with a shared library for other users while -still providing the normal executable. - -Signed-off-by: Elliott Sales de Andrade ---- - configure.py | 7 +++++++ - tools/install.py | 29 +++++++++++++---------------- - 2 files changed, 20 insertions(+), 16 deletions(-) - -diff --git a/configure.py b/configure.py -index 6537a62d3954d83927c698db3fb80c9fc05faba7..b9a894bec9e5fd954004bcb423822ca984066dc5 100755 ---- a/configure.py -+++ b/configure.py -@@ -571,6 +571,12 @@ parser.add_option('--shared', - help='compile shared library for embedding node in another project. ' + - '(This mode is not officially supported for regular applications)') - -+parser.add_option('--libdir', -+ action='store', -+ dest='libdir', -+ default='lib', -+ help='a directory to install the shared library into') -+ - parser.add_option('--without-v8-platform', - action='store_true', - dest='without_v8_platform', -@@ -1105,6 +1111,7 @@ def configure_node(o): - o['variables']['node_no_browser_globals'] = b(options.no_browser_globals) - - o['variables']['node_shared'] = b(options.shared) -+ o['variables']['libdir'] = options.libdir - node_module_version = getmoduleversion.get_version() - - if options.dest_os == 'android': -diff --git a/tools/install.py b/tools/install.py -index 655802980a6ea94d1d4ca1dc63c8c8e905fbb83a..fe4723bf15012c8aacacb0393dc8294c049b0503 100755 ---- a/tools/install.py -+++ b/tools/install.py -@@ -121,26 +121,23 @@ def subdir_files(path, dest, action): - - def files(action): - is_windows = sys.platform == 'win32' -- output_file = 'node' - output_prefix = 'out/Release/' -+ output_libprefix = output_prefix - -- if 'false' == variables.get('node_shared'): -- if is_windows: -- output_file += '.exe' -+ if is_windows: -+ output_bin = 'node.exe' -+ output_lib = 'node.dll' - else: -- if is_windows: -- output_file += '.dll' -- else: -- output_file = 'lib' + output_file + '.' + variables.get('shlib_suffix') -- # GYP will output to lib.target except on OS X, this is hardcoded -- # in its source - see the _InstallableTargetInstallPath function. -- if sys.platform != 'darwin': -- output_prefix += 'lib.target/' -+ output_bin = 'node' -+ output_lib = 'libnode.' + variables.get('shlib_suffix') -+ # GYP will output to lib.target except on OS X, this is hardcoded -+ # in its source - see the _InstallableTargetInstallPath function. -+ if sys.platform != 'darwin': -+ output_libprefix += 'lib.target/' - -- if 'false' == variables.get('node_shared'): -- action([output_prefix + output_file], 'bin/' + output_file) -- else: -- action([output_prefix + output_file], 'lib/' + output_file) -+ action([output_prefix + output_bin], 'bin/' + output_bin) -+ if 'true' == variables.get('node_shared'): -+ action([output_libprefix + output_lib], variables.get('libdir') + '/' + output_lib) - - if 'true' == variables.get('node_use_dtrace'): - action(['out/Release/node.d'], 'lib/dtrace/node.d') --- -2.24.1 - diff --git a/CVE-2018-12122.patch b/CVE-2018-12122.patch new file mode 100644 index 0000000000000000000000000000000000000000..c46268b278865a2e9d773bfcc441a160c8f48b55 --- /dev/null +++ b/CVE-2018-12122.patch @@ -0,0 +1,208 @@ +From ee618a7ab239c98d945c723a4e225bc409151736 Mon Sep 17 00:00:00 2001 +From: Matteo Collina +Date: Thu, 23 Aug 2018 16:46:07 +0200 +Subject: [PATCH] http,https: protect against slow headers attack + +CVE-2018-12122 + +An attacker can send a char/s within headers and exahust the resources +(file descriptors) of a system even with a tight max header length +protection. This PR destroys a socket if it has not received the headers +in 40s. + +PR-URL: https://github.com/nodejs-private/node-private/pull/144 +Reviewed-By: Sam Roberts +Reviewed-By: Ben Noordhuis +Reviewed-By: James M Snell +--- + doc/api/http.md | 20 ++++++++ + doc/api/https.md | 7 +++ + lib/_http_server.js | 22 ++++++++- + lib/https.js | 1 + + lib/internal/http.js | 27 +++++++--- + test/async-hooks/test-graph.http.js | 2 +- + test/parallel/test-http-slow-headers.js | 50 +++++++++++++++++++ + test/parallel/test-https-slow-headers.js | 63 ++++++++++++++++++++++++ + 8 files changed, 182 insertions(+), 10 deletions(-) + create mode 100644 test/parallel/test-http-slow-headers.js + create mode 100644 test/parallel/test-https-slow-headers.js + +diff --git a/doc/api/http.md b/doc/api/http.md +index 1c6b5717e004..13373debb404 100644 +--- a/doc/api/http.md ++++ b/doc/api/http.md +@@ -958,6 +958,26 @@ added: v0.7.0 + + Limits maximum incoming headers count. If set to 0, no limit will be applied. + ++### server.headersTimeout ++ ++ ++* {number} **Default:** `40000` ++ ++Limit the amount of time the parser will wait to receive the complete HTTP ++headers. ++ ++In case of inactivity, the rules defined in [server.timeout][] apply. However, ++that inactivity based timeout would still allow the connection to be kept open ++if the headers are being sent very slowly (by default, up to a byte per 2 ++minutes). In order to prevent this, whenever header data arrives an additional ++check is made that more than `server.headersTimeout` milliseconds has not ++passed since the connection was established. If the check fails, a `'timeout'` ++event is emitted on the server object, and (by default) the socket is destroyed. ++See [server.timeout][] for more information on how timeout behaviour can be ++customised. ++ + ### server.setTimeout([msecs][, callback]) +