copyOnto is broken when one argument has 1 byte size and the other > 1
byte.
PR-URL: https://github.com/joyent/node/pull/8637
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
* openssl: Update to 1.0.1j (Addressing multiple CVEs)
* uv: Update to v0.10.29
* child_process: properly support optional args (cjihrig)
* crypto: Disable autonegotiation for SSLv2/3 by default (Fedor Indutny,
Timothy J Fontaine, Alexis Campailla)
This is a behavior change, by default we will not allow the negotiation to
SSLv2 or SSLv3. If you want this behavior, run Node.js with either
`--enable-ssl2` or `--enable-ssl3` respectively.
This does not change the behavior for users specifically requesting
`SSLv2_method` or `SSLv3_method`. While this behavior is not advised, it is
assumed you know what you're doing since you're specifically asking to use
these methods.
Always set ssl2/ssl3 disabled based on whether they are enabled in Node.
In some corner-case scenario, node with OPENSSL_NO_SSL3 defined could
be linked to openssl that has SSL3 enabled.
This change disables SSLv2/SSLv3 use by default, and introduces a
command line flag to opt into using SSLv2/SSLv3.
SSLv2 and SSLv3 are considered unsafe, and should only be used in
situations where compatibility with other components is required and
they cannot be upgrade to support newer forms of TLS.
Because of behavior change of some V8 APIs (they mostly became more
strict), following modules needed to be fixed:
* crypto: duplicate prototype methods are not allowed anymore
* contextify: some TryCatch trickery, the binding was using it
incorrectly
* util: maximum call stack error is now crashing in a different place
Reviewed-By: Trevor Norris <trevnorris@gmail.com>
PR-URL: https://github.com/joyent/node/pull/8476
Do not call SSL_read() and ignore ZERO_RETURN if the connection was
shutdown and there could not be any reads.
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
PR-URL: https://github.com/joyent/node/pull/8519
The constants in enum v8::ExternalArrayType have been changed. The old
values are there for legacy reasons, but it's best to update anyway.
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
Performance improvement by moving checks for floating point operations
to JS and doing the operation on a protected internal function that
assumes all arguments are correct. Still abort if the operation
overflows memory. This can only be caused if the Buffer's length
property isn't the same as the actual internal length.
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
Since we are taking control of the microtask queue it makes sense to
disable autorun and only run microtasks when necessary. Just setting
isolate->SetAutorunMicrotasks(false) would cause _tickCallback() not to
be called.
Automatically running the microtask queue will cause it to run:
* After callback invocation
* Inside _tickCallback()
* After _tickCallback() invocation
The third one is unnecessary as the microtask queue is guaranteed to be
empty at this point. The first only needs to be run manually when
_tickCallback() isn't going to be called by MakeCallback().
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
The two main goals of this change are:
- To make it easier to build the Intl option using ICU (particularly,
using a newer ICU than v8/Chromium's version)
- To enable a much smaller ICU build with only English support The goal
here is to get node.js binaries built this way by default so that the
Intl API can be used. Additional data can be added at execution time
(see Readme and wiki)
More details are at https://github.com/joyent/node/pull/7719
In particular, this change adds the "--with-intl=" configure option to
provide more ways of building "Intl":
- "full-icu" picks up an ICU from deps/icu
- "small-icu" is similar, but builds only English
- "system-icu" uses pkg-config to find an installed ICU
- "none" does nothing (no Intl)
For Windows builds, the "full-icu" or "small-icu" options are added to
vcbuild.bat.
Note that the existing "--with-icu-path" option is not removed from
configure, but may not be used alongside the new option.
Wiki changes have already been made on
https://github.com/joyent/node/wiki/Installation
and a new page created at
https://github.com/joyent/node/wiki/Intl
(marked as provisional until this change lands.)
Summary of changes:
* README.md : doc updates
* .gitignore : added "deps/icu" as this is the location where ICU is
unpacked to.
* Makefile : added the tools/icu/* files to cpplint, but excluded a
problematic file.
* configure : added the "--with-intl" option mentioned above.
Calculate at config time the list of ICU source files to use and data
packaging options.
* node.gyp : add the new files src/node_i18n.cc/.h as well as ICU
linkage.
* src/node.cc : add call into
node::i18n::InitializeICUDirectory(icu_data_dir) as well as new
--icu-data-dir option and NODE_ICU_DATA env variable to configure ICU
data loading. This loading is only relevant in the "small"
configuration.
* src/node_i18n.cc : new source file for the above Initialize..
function, to setup ICU as needed.
* tools/icu : new directory with some tools needed for this build.
* tools/icu/icu-generic.gyp : new .gyp file that builds ICU in some new
ways, both on unix/mac and windows.
* tools/icu/icu-system.gyp : new .gyp file to build node against a
pkg-config detected ICU.
* tools/icu/icu_small.json : new config file for the "English-only" small
build.
* tools/icu/icutrim.py : new tool for trimming down ICU data. Reads the
above .json file.
* tools/icu/iculslocs.cc : new tool for repairing ICU data manifests
after trim operation.
* tools/icu/no-op.cc : dummy file to force .gyp into using a C++ linker.
* vcbuild.bat : added small-icu and full-icu options, to call into
configure.
* Fixed toolset dependencies, see
https://github.com/joyent/node/pull/7719#issuecomment-54641687
Note that because of a bug in gyp {CC,CXX}_host must also be set.
Otherwise gcc/g++ will be used by default for part of the build.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Reviewed-by: Fedor Indutny <fedor@indutny.com>
Running fill() with an empty string would cause Node to hang
indefinitely. Now it will return without having operated on the buffer.
User facing function has been pulled into JS to perform all initial
value checks and coercions. The C++ method has been placed on the
"internal" object.
Coerced non-string values to numbers to match v0.10 support.
Simplified logic and changed a couple variable names.
Added tests for fill() and moved them all to the beginning of
buffer-test.js since many other tests depend on fill() working properly.
Fixes: https://github.com/joyent/node/issues/8469
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
Calls from JS to C++ have an implicit HandleScope. So there is no need
to instantiate a new HandleScope in these basic cases.
Check if the returned int64_t is an SMI and cast the return value to
uint32_t instead of a double. Prevents needing to box the return value,
and saves a small amount of execution time.
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
Don't allocate any BIO buffers initially, do this on a first read from
the TCP connection. Allocate different amount of data for initial read
and for consequent reads: small buffer for hello+certificate, big buffer
for better throughput.
see #8416
When V8 started supporting Promises natively it also introduced a
microtack queue. This feature operates similar to process.nextTick(),
and created an issue where neither knew when the other had run. This
patch has nextTick() call the microtask queue runner at the end of
processing callbacks in the nextTickQueue.
Fixes: https://github.com/joyent/node/issues/7714
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Adding a compatibility section to node.exe embedded manifest so that
Node is declared explicitly compatible with Windows 8.1. Required so
that os.release() can return the correct version on Windows 8.1.
See http://msdn.microsoft.com/en-us/library/windows/desktop/ms724451(v=vs.85).aspx
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
* npm: Update to 1.4.28
* v8: fix a crash introduced by previous release (Fedor Indutny)
* configure: add --openssl-no-asm flag (Fedor Indutny)
* crypto: use domains for any callback-taking method (Chris Dickinson)
* http: do not send `0rnrn` in TE HEAD responses (Fedor Indutny)
* querystring: fix unescape override (Tristan Berger)
* url: Add support for RFC 3490 separators (Mathias Bynens)
This adds domains coverage for pdbkdf2, pseudoRandomBytes, and randomBytes.
All others should be covered by event emitters.
Fixes#5801.
Reviewed-By: Timothy J Fontaine <tjfontaine@gmail.com>
Compiles and executes source code in V8's debugger context. Provides
a programmatic way to get access to the debug object by executing:
var Debug = vm.runInDebugContext('Debug');
Fixes#7886.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Strings are treated as UTF8 instead of one-byte strings when
names are processed and when OpenSSL's ..._print functions are used.
This commit fixes simple/test-tls-peer-certificate-encoding test.
fix#8366
There is only one call site that uses it and that can do the checks
itself. Removes ~15 lines of code.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
It's safe to call BaseObject::object() from your destructor _unless_
the handle is weak; then it's the weak callback that is calling your
destructor and the object will have been released by the time the
destructor runs.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Weak handles put strain on the garbage collector and the parser handle
doesn't need to be weak in the first place. This change should improve
GC times on busy servers a little.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Counterpart to Wrap(), clears the previously assigned internal field.
Will be used in an upcoming commit.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
Fix a resource leak where an intermediate Local<Context> handle in
Environment::GetCurrent() got leaked into whatever HandleScope was
further up the stack.
Reviewed-by: Trevor Norris <trev.norris@gmail.com>
node::StringBytes::Write() has appropriate support to write strings with
'binary' encoding. So expose that API through StreamWrap and allow
inheriting classes to use it.
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
The REPL global object lazy loads modules by placing getters for each.
This causes MakeDomainCallback() to be run if a native module is loaded
from the REPL, but if the domain module hasn't been loaded then there
are no enter/exit callbacks to be called. Causing an assert() to fail.
Fix the issue by conditionally running the callback instead of asserting
it is available. Also add "addon" test to verify the fix.
Fixes: #8231
Signed-off-by: Trevor Norris <trev.norris@gmail.com>
Currently, cluster workers can be removed from the workers list in three
different places:
- In the exit event handler for the worker process.
- In the disconnect event handler of the worker process.
- In the disconnect event handler of the cluster master.
However, handles for a given worker are cleaned up only in one of these
places: in the cluster master's disconnect event handler.
Because these events happen asynchronously, it is possible that the
workers list is empty before we even clean up one handle. This makes
the assert that makes sure that no handle is left when the workers
list is empty fail.
This commit removes the worker from the cluster.workers list only when
the worker is dead _and_ disconnected, at which point we're sure that
its associated handles are cleaned up.
Fixes#8191 and #8192.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
In case of an invalid DH parameter file, it is sliently discarded. To
use auto DH parameter in a server and DHE key length check in a
client, we need to wait for the next release of OpenSSL-1.0.2.
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Saúl Ibarra Corretgé
Vladimir Kurchatkin
Timothy J Fontaine
Fedor Indutny
Alexis Campailla
Trevor Norris
Steven R. Loomis
Rasmus Christian Pedersen
Mickael van der Beek
Chris Dickinson
Ben Noordhuis
Adam Lippai
Julien Gilli
Brian White
Jackson Tian
Isaac Burns
Shigeki Ohtsu