diff --git a/0004-Make-AARCH64-compile-on-64KB-physical-pages.patch b/0003-Make-AARCH64-compile-on-64KB-physical-pages.patch similarity index 100% rename from 0004-Make-AARCH64-compile-on-64KB-physical-pages.patch rename to 0003-Make-AARCH64-compile-on-64KB-physical-pages.patch diff --git a/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch b/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch deleted file mode 100644 index 5542230fd65fbd3e76f42d8d424abc91dd6d9497..0000000000000000000000000000000000000000 --- a/0003-Modify-openEuler-aarch64-v8_os_page_size-to-64.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 7fddd1453f365e54b46f6564d5c168ed13e758db Mon Sep 17 00:00:00 2001 -From: lingsheng -Date: Wed, 18 Nov 2020 14:58:37 +0800 -Subject: [PATCH] Modify openEuler aarch64 v8_os_page_size to 64 - ---- - deps/v8/src/flags/flag-definitions.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h -index c7c07e6d..38a035e2 100644 ---- a/deps/v8/src/flags/flag-definitions.h -+++ b/deps/v8/src/flags/flag-definitions.h -@@ -917,7 +917,7 @@ DEFINE_BOOL(memory_reducer_for_small_heaps, true, - "use memory reducer for small heaps") - DEFINE_INT(heap_growing_percent, 0, - "specifies heap growing factor as (1 + heap_growing_percent/100)") --DEFINE_INT(v8_os_page_size, 0, "override OS page size (in KBytes)") -+DEFINE_INT(v8_os_page_size, 64, "override OS page size (in KBytes)") - DEFINE_BOOL(always_compact, false, "Perform compaction on every full GC") - DEFINE_BOOL(never_compact, false, - "Never perform compaction on full GC - testing only") --- -2.23.0 - diff --git a/0005-use-getauxval-in-node_main_cc.patch b/0004-use-getauxval-in-node_main_cc.patch similarity index 100% rename from 0005-use-getauxval-in-node_main_cc.patch rename to 0004-use-getauxval-in-node_main_cc.patch diff --git a/0006-The-third-party-software-jinja2-support-python-3.10.0.patch b/0005-The-third-party-software-jinja2-support-python-3.10.0.patch similarity index 100% rename from 0006-The-third-party-software-jinja2-support-python-3.10.0.patch rename to 0005-The-third-party-software-jinja2-support-python-3.10.0.patch diff --git a/CVE-2020-8265.patch b/CVE-2020-8265.patch deleted file mode 100644 index 534550e3ec19ae3d97390a5af9e1dff98a20872b..0000000000000000000000000000000000000000 --- a/CVE-2020-8265.patch +++ /dev/null @@ -1,164 +0,0 @@ -From 5b00de7d67a1372aa342115ad28edd3f78268bb6 Mon Sep 17 00:00:00 2001 -From: James M Snell -Date: Thu, 12 Nov 2020 12:34:33 -0800 -Subject: [PATCH] src: retain pointers to WriteWrap/ShutdownWrap - -Avoids potential use-after-free when wrap req's are synchronously -destroyed. - -CVE-ID: CVE-2020-8265 -Fixes: https://github.com/nodejs-private/node-private/issues/227 -PR-URL: https://github.com/nodejs-private/node-private/pull/230 -Refs: https://hackerone.com/bugs?subject=nodejs&report_id=988103 -Reviewed-By: Anna Henningsen -Reviewed-By: Matteo Collina -Reviewed-By: Rich Trott -Reference: https://github.com/nodejs/node/commit/5b00de7d67a1372aa342115ad28edd3f78268bb6 ---- - src/stream_base-inl.h | 11 +++- - src/stream_base.cc | 2 +- - src/stream_base.h | 1 + - .../test-tls-use-after-free-regression.js | 58 +++++++++++++++++++ - 4 files changed, 68 insertions(+), 4 deletions(-) - create mode 100644 test/parallel/test-tls-use-after-free-regression.js - -diff --git a/src/stream_base-inl.h b/src/stream_base-inl.h -index dd80683af10..1603a2fb2e0 100644 ---- a/src/stream_base-inl.h -+++ b/src/stream_base-inl.h -@@ -163,8 +163,11 @@ inline int StreamBase::Shutdown(v8::Local req_wrap_obj) { - StreamReq::ResetObject(req_wrap_obj); - } - -+ BaseObjectPtr req_wrap_ptr; - AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap()); - ShutdownWrap* req_wrap = CreateShutdownWrap(req_wrap_obj); -+ if (req_wrap != nullptr) -+ req_wrap_ptr.reset(req_wrap->GetAsyncWrap()); - int err = DoShutdown(req_wrap); - - if (err != 0 && req_wrap != nullptr) { -@@ -198,7 +201,7 @@ inline StreamWriteResult StreamBase::Write( - if (send_handle == nullptr) { - err = DoTryWrite(&bufs, &count); - if (err != 0 || count == 0) { -- return StreamWriteResult { false, err, nullptr, total_bytes }; -+ return StreamWriteResult { false, err, nullptr, total_bytes, {} }; - } - } - -@@ -208,13 +211,14 @@ inline StreamWriteResult StreamBase::Write( - if (!env->write_wrap_template() - ->NewInstance(env->context()) - .ToLocal(&req_wrap_obj)) { -- return StreamWriteResult { false, UV_EBUSY, nullptr, 0 }; -+ return StreamWriteResult { false, UV_EBUSY, nullptr, 0, {} }; - } - StreamReq::ResetObject(req_wrap_obj); - } - - AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(GetAsyncWrap()); - WriteWrap* req_wrap = CreateWriteWrap(req_wrap_obj); -+ BaseObjectPtr req_wrap_ptr(req_wrap->GetAsyncWrap()); - - err = DoWrite(req_wrap, bufs, count, send_handle); - bool async = err == 0; -@@ -232,7 +236,8 @@ inline StreamWriteResult StreamBase::Write( - ClearError(); - } - -- return StreamWriteResult { async, err, req_wrap, total_bytes }; -+ return StreamWriteResult { -+ async, err, req_wrap, total_bytes, std::move(req_wrap_ptr) }; - } - - template -diff --git a/src/stream_base.cc b/src/stream_base.cc -index 516f57e40bf..06032e2c096 100644 ---- a/src/stream_base.cc -+++ b/src/stream_base.cc -@@ -259,7 +259,7 @@ int StreamBase::WriteString(const FunctionCallbackInfo& args) { - - // Immediate failure or success - if (err != 0 || count == 0) { -- SetWriteResult(StreamWriteResult { false, err, nullptr, data_size }); -+ SetWriteResult(StreamWriteResult { false, err, nullptr, data_size, {} }); - return err; - } - -diff --git a/src/stream_base.h b/src/stream_base.h -index eb75fdc8339..fafd327d75d 100644 ---- a/src/stream_base.h -+++ b/src/stream_base.h -@@ -24,6 +24,7 @@ struct StreamWriteResult { - int err; - WriteWrap* wrap; - size_t bytes; -+ BaseObjectPtr wrap_obj; - }; - - using JSMethodFunction = void(const v8::FunctionCallbackInfo& args); -diff --git a/test/parallel/test-tls-use-after-free-regression.js b/test/parallel/test-tls-use-after-free-regression.js -new file mode 100644 -index 00000000000..51835fc0339 ---- /dev/null -+++ b/test/parallel/test-tls-use-after-free-regression.js -@@ -0,0 +1,58 @@ -+'use strict'; -+ -+const common = require('../common'); -+ -+if (!common.hasCrypto) -+ common.skip('missing crypto'); -+ -+const https = require('https'); -+const tls = require('tls'); -+ -+const kMessage = -+ 'GET / HTTP/1.1\r\nHost: localhost\r\nConnection: Keep-alive\r\n\r\n'; -+ -+const key = `-----BEGIN EC PARAMETERS----- -+BggqhkjOPQMBBw== -+-----END EC PARAMETERS----- -+-----BEGIN EC PRIVATE KEY----- -+MHcCAQEEIDKfHHbiJMdu2STyHL11fWC7psMY19/gUNpsUpkwgGACoAoGCCqGSM49 -+AwEHoUQDQgAEItqm+pYj3Ca8bi5mBs+H8xSMxuW2JNn4I+kw3aREsetLk8pn3o81 -+PWBiTdSZrGBGQSy+UAlQvYeE6Z/QXQk8aw== -+-----END EC PRIVATE KEY-----`; -+ -+const cert = `-----BEGIN CERTIFICATE----- -+MIIBhjCCASsCFDJU1tCo88NYU//pE+DQKO9hUDsFMAoGCCqGSM49BAMCMEUxCzAJ -+BgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5l -+dCBXaWRnaXRzIFB0eSBMdGQwHhcNMjAwOTIyMDg1NDU5WhcNNDgwMjA3MDg1NDU5 -+WjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwY -+SW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD -+QgAEItqm+pYj3Ca8bi5mBs+H8xSMxuW2JNn4I+kw3aREsetLk8pn3o81PWBiTdSZ -+rGBGQSy+UAlQvYeE6Z/QXQk8azAKBggqhkjOPQQDAgNJADBGAiEA7Bdn4F87KqIe -+Y/ABy/XIXXpFUb2nyv3zV7POQi2lPcECIQC3UWLmfiedpiIKsf9YRIyO0uEood7+ -+glj2R1NNr1X68w== -+-----END CERTIFICATE-----`; -+ -+const server = https.createServer( -+ { key, cert }, -+ common.mustCall((req, res) => { -+ res.writeHead(200); -+ res.end('boom goes the dynamite\n'); -+ }, 3)); -+ -+server.listen(0, common.mustCall(() => { -+ const socket = -+ tls.connect( -+ server.address().port, -+ 'localhost', -+ { rejectUnauthorized: false }, -+ common.mustCall(() => { -+ socket.write(kMessage); -+ socket.write(kMessage); -+ socket.write(kMessage); -+ })); -+ -+ socket.on('data', common.mustCall(() => socket.destroy())); -+ socket.on('close', () => { -+ setImmediate(() => server.close()); -+ }); -+})); diff --git a/CVE-2020-8287-1.patch b/CVE-2020-8287-1.patch deleted file mode 100644 index 3761c94220efdbe4357ff1f5fe0cc83b49eb07ee..0000000000000000000000000000000000000000 --- a/CVE-2020-8287-1.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 92d430917a63a567bb528100371263c46e50ee4a Mon Sep 17 00:00:00 2001 -From: Fedor Indutny -Date: Wed, 18 Nov 2020 20:50:21 -0800 -Subject: [PATCH] http: unset `F_CHUNKED` on new `Transfer-Encoding` - -Duplicate `Transfer-Encoding` header should be a treated as a single, -but with original header values concatenated with a comma separator. In -the light of this, even if the past `Transfer-Encoding` ended with -`chunked`, we should be not let the `F_CHUNKED` to leak into the next -header, because mere presence of another header indicates that `chunked` -is not the last transfer-encoding token. - -CVE-ID: CVE-2020-8287 -PR-URL: https://github.com/nodejs-private/node-private/pull/236 -Reviewed-By: Fedor Indutny -Reference: https://github.com/nodejs/node/commit/92d430917a63a567bb528100371263c46e50ee4a ---- - deps/http_parser/http_parser.c | 7 +++++++ - deps/http_parser/test.c | 26 ++++++++++++++++++++++++++ - 2 files changed, 33 insertions(+) - -diff --git a/deps/http_parser/http_parser.c b/deps/http_parser/http_parser.c -index 0f76b6a..5cc951a 100644 ---- a/deps/http_parser/http_parser.c -+++ b/deps/http_parser/http_parser.c -@@ -1339,6 +1339,13 @@ reexecute: - } else if (parser->index == sizeof(TRANSFER_ENCODING)-2) { - parser->header_state = h_transfer_encoding; - parser->flags |= F_TRANSFER_ENCODING; -+ -+ /* Multiple `Transfer-Encoding` headers should be treated as -+ * one, but with values separate by a comma. -+ * -+ * See: https://tools.ietf.org/html/rfc7230#section-3.2.2 -+ */ -+ parser->flags &= ~F_CHUNKED; - } - break; - -diff --git a/deps/http_parser/test.c b/deps/http_parser/test.c -index c979467..f185c56 100644 ---- a/deps/http_parser/test.c -+++ b/deps/http_parser/test.c -@@ -2045,6 +2045,32 @@ const struct message responses[] = - ,.body= "2\r\nOK\r\n0\r\n\r\n" - ,.num_chunks_complete= 0 - } -+#define HTTP_200_DUPLICATE_TE_NOT_LAST_CHUNKED 30 -+, {.name= "HTTP 200 response with `chunked` and duplicate Transfer-Encoding" -+ ,.type= HTTP_RESPONSE -+ ,.raw= "HTTP/1.1 200 OK\r\n" -+ "Transfer-Encoding: chunked\r\n" -+ "Transfer-Encoding: identity\r\n" -+ "\r\n" -+ "2\r\n" -+ "OK\r\n" -+ "0\r\n" -+ "\r\n" -+ ,.should_keep_alive= FALSE -+ ,.message_complete_on_eof= TRUE -+ ,.http_major= 1 -+ ,.http_minor= 1 -+ ,.status_code= 200 -+ ,.response_status= "OK" -+ ,.content_length= -1 -+ ,.num_headers= 2 -+ ,.headers= -+ { { "Transfer-Encoding", "chunked" } -+ , { "Transfer-Encoding", "identity" } -+ } -+ ,.body= "2\r\nOK\r\n0\r\n\r\n" -+ ,.num_chunks_complete= 0 -+ } - }; - - /* strnlen() is a POSIX.2008 addition. Can't rely on it being available so --- -2.23.0 - diff --git a/CVE-2020-8287-2.patch b/CVE-2020-8287-2.patch deleted file mode 100644 index e88984e2414c599c7ead781e9ef30bb6d89aabef..0000000000000000000000000000000000000000 --- a/CVE-2020-8287-2.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 420244e4d9ca6de2612e7f503f5c87e448fbc14b Mon Sep 17 00:00:00 2001 -From: Matteo Collina -Date: Thu, 22 Oct 2020 14:10:51 +0200 -Subject: [PATCH] http: unset `F_CHUNKED` on new `Transfer-Encoding` - -Duplicate `Transfer-Encoding` header should be a treated as a single, -but with original header values concatenated with a comma separator. In -the light of this, even if the past `Transfer-Encoding` ended with -`chunked`, we should be not let the `F_CHUNKED` to leak into the next -header, because mere presence of another header indicates that `chunked` -is not the last transfer-encoding token. - -Ref: https://github.com/nodejs-private/llhttp-private/pull/3 -See: https://hackerone.com/bugs?report_id=1002188&subject=nodejs - -CVE-ID: CVE-2020-8287 -PR-URL: https://github.com/nodejs-private/node-private/pull/236 -Reviewed-By: Fedor Indutny -Reference: https://github.com/nodejs/node/commit/420244e4d9ca6de2612e7f503f5c87e448fbc14b ---- - deps/llhttp/src/llhttp.c | 36 ++++++++++++++- - .../test-http-transfer-encoding-smuggling.js | 46 +++++++++++++++++++ - 2 files changed, 80 insertions(+), 2 deletions(-) - create mode 100644 test/parallel/test-http-transfer-encoding-smuggling.js - -diff --git a/deps/llhttp/src/llhttp.c b/deps/llhttp/src/llhttp.c -index acc35479f88..3019c410963 100644 ---- a/deps/llhttp/src/llhttp.c -+++ b/deps/llhttp/src/llhttp.c -@@ -813,6 +813,14 @@ int llhttp__internal__c_or_flags_16( - return 0; - } - -+int llhttp__internal__c_and_flags( -+ llhttp__internal_t* state, -+ const unsigned char* p, -+ const unsigned char* endp) { -+ state->flags &= -9; -+ return 0; -+} -+ - int llhttp__internal__c_update_header_state_7( - llhttp__internal_t* state, - const unsigned char* p, -@@ -5974,10 +5982,18 @@ static llparse_state_t llhttp__internal__run( - /* UNREACHABLE */; - abort(); - } -+ s_n_llhttp__internal__n_invoke_and_flags: { -+ switch (llhttp__internal__c_and_flags(state, p, endp)) { -+ default: -+ goto s_n_llhttp__internal__n_header_value_te_chunked; -+ } -+ /* UNREACHABLE */; -+ abort(); -+ } - s_n_llhttp__internal__n_invoke_or_flags_16: { - switch (llhttp__internal__c_or_flags_16(state, p, endp)) { - default: -- goto s_n_llhttp__internal__n_header_value_te_chunked; -+ goto s_n_llhttp__internal__n_invoke_and_flags; - } - /* UNREACHABLE */; - abort(); -@@ -7625,6 +7641,14 @@ int llhttp__internal__c_or_flags_16( - return 0; - } - -+int llhttp__internal__c_and_flags( -+ llhttp__internal_t* state, -+ const unsigned char* p, -+ const unsigned char* endp) { -+ state->flags &= -9; -+ return 0; -+} -+ - int llhttp__internal__c_update_header_state_7( - llhttp__internal_t* state, - const unsigned char* p, -@@ -12522,10 +12546,18 @@ static llparse_state_t llhttp__internal__run( - /* UNREACHABLE */; - abort(); - } -+ s_n_llhttp__internal__n_invoke_and_flags: { -+ switch (llhttp__internal__c_and_flags(state, p, endp)) { -+ default: -+ goto s_n_llhttp__internal__n_header_value_te_chunked; -+ } -+ /* UNREACHABLE */; -+ abort(); -+ } - s_n_llhttp__internal__n_invoke_or_flags_16: { - switch (llhttp__internal__c_or_flags_16(state, p, endp)) { - default: -- goto s_n_llhttp__internal__n_header_value_te_chunked; -+ goto s_n_llhttp__internal__n_invoke_and_flags; - } - /* UNREACHABLE */; - abort(); -diff --git a/test/parallel/test-http-transfer-encoding-smuggling.js b/test/parallel/test-http-transfer-encoding-smuggling.js -new file mode 100644 -index 00000000000..9d97db4c0a2 ---- /dev/null -+++ b/test/parallel/test-http-transfer-encoding-smuggling.js -@@ -0,0 +1,46 @@ -+'use strict'; -+ -+const common = require('../common'); -+ -+const assert = require('assert'); -+const http = require('http'); -+const net = require('net'); -+ -+const msg = [ -+ 'POST / HTTP/1.1', -+ 'Host: 127.0.0.1', -+ 'Transfer-Encoding: chunked', -+ 'Transfer-Encoding: chunked-false', -+ 'Connection: upgrade', -+ '', -+ '1', -+ 'A', -+ '0', -+ '', -+ 'GET /flag HTTP/1.1', -+ 'Host: 127.0.0.1', -+ '', -+ '', -+].join('\r\n'); -+ -+// Verify that the server is called only once even with a smuggled request. -+ -+const server = http.createServer(common.mustCall((req, res) => { -+ res.end(); -+}, 1)); -+ -+function send(next) { -+ const client = net.connect(server.address().port, 'localhost'); -+ client.setEncoding('utf8'); -+ client.on('error', common.mustNotCall()); -+ client.on('end', next); -+ client.write(msg); -+ client.resume(); -+} -+ -+server.listen(0, common.mustCall((err) => { -+ assert.ifError(err); -+ send(common.mustCall(() => { -+ server.close(); -+ })); -+})); diff --git a/CVE-2021-22883.patch b/CVE-2021-22883.patch deleted file mode 100644 index 4e50657705fc1972cdfa3fe27089c141ba950600..0000000000000000000000000000000000000000 --- a/CVE-2021-22883.patch +++ /dev/null @@ -1,219 +0,0 @@ -From 922ada77132c1b0b69c9a146822d762b2f9b912b Mon Sep 17 00:00:00 2001 -From: Daniel Bevenius -Date: Fri, 22 Jan 2021 12:34:21 +0100 -Subject: [PATCH] http2: add unknownProtocol timeout -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This commit add a configuration options named unknownProtocolTimeout -which can be specified to set a value for the timeout in milliseconds -that a server should wait when an unknowProtocol is sent to it. When -this happens a timer will be started and the if the socket has not been -destroyed during that time the timer callback will destoy it. - -Refs: https://hackerone.com/reports/1043360 -CVE-ID: CVE-2021-22883 -PR-URL: https://github.com/nodejs/node/pull/246 -Backport-PR-URL: https://github.com/nodejs/node/pull/250 -Reviewed-By: Beth Griggs -Reviewed-By: Matteo Collina -Reviewed-By: Michael Dawson -Reviewed-By: Rich Trott -Reviewed-By: Tobias Nießen -Reference: https://github.com/nodejs/node/commit/922ada77132c1b0b69c9a146822d762b2f9b912b ---- - doc/api/http2.md | 25 +++++++++++++- - lib/internal/http2/core.js | 31 ++++++++++++++--- - .../test-http2-server-unknown-protocol.js | 33 +++++++++++++++++++ - 3 files changed, 84 insertions(+), 5 deletions(-) - create mode 100644 test/parallel/test-http2-server-unknown-protocol.js - -diff --git a/doc/api/http2.md b/doc/api/http2.md -index 40a107f..d57a560 100644 ---- a/doc/api/http2.md -+++ b/doc/api/http2.md -@@ -1908,7 +1908,9 @@ added: v8.4.0 - The `'unknownProtocol'` event is emitted when a connecting client fails to - negotiate an allowed protocol (i.e. HTTP/2 or HTTP/1.1). The event handler - receives the socket for handling. If no listener is registered for this event, --the connection is terminated. See the [Compatibility API][]. -+the connection is terminated. A timeout may be specified using the -+`'unknownProtocolTimeout'` option passed to [`http2.createSecureServer()`][]. -+See the [Compatibility API][]. - - #### `server.close([callback])` -