diff --git a/0001-Disable-running-gyp-on-shared-deps.patch b/0001-Disable-running-gyp-on-shared-deps.patch new file mode 100644 index 0000000..6d662d3 --- /dev/null +++ b/0001-Disable-running-gyp-on-shared-deps.patch @@ -0,0 +1,25 @@ +From 0da4decd64a9cbfcf75b2697c722cd6fc82a164d Mon Sep 17 00:00:00 2001 +From: Zuzana Svetlikova +Date: Fri, 17 Apr 2020 12:59:44 +0200 +Subject: [PATCH] 0001 + +--- + Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 88166da2a8..f0637b6c78 100644 +--- a/Makefile ++++ b/Makefile +@@ -141,7 +141,7 @@ test-code-cache: with-code-cache + echo "'test-code-cache' target is a noop" + + out/Makefile: config.gypi common.gypi node.gyp \ +- deps/uv/uv.gyp deps/http_parser/http_parser.gyp deps/zlib/zlib.gyp \ ++ deps/http_parser/http_parser.gyp \ + tools/v8_gypfiles/toolchain.gypi tools/v8_gypfiles/features.gypi \ + tools/v8_gypfiles/inspector.gypi tools/v8_gypfiles/v8.gyp + $(PYTHON) tools/gyp_node.py -f make +-- +2.25.2 + diff --git a/0002-Install-both-binaries-and-use-libdir.patch b/0002-Install-both-binaries-and-use-libdir.patch new file mode 100644 index 0000000..c0613bf --- /dev/null +++ b/0002-Install-both-binaries-and-use-libdir.patch @@ -0,0 +1,86 @@ +From 11512edeb046b64be4daca76f061a3a918251ee0 Mon Sep 17 00:00:00 2001 +From: Elliott Sales de Andrade +Date: Tue, 19 Mar 2019 23:22:40 -0400 +Subject: [PATCH 2/2] Install both binaries and use libdir. + +This allows us to build with a shared library for other users while +still providing the normal executable. + +Signed-off-by: Elliott Sales de Andrade +--- + configure.py | 7 +++++++ + tools/install.py | 29 +++++++++++++---------------- + 2 files changed, 20 insertions(+), 16 deletions(-) + +diff --git a/configure.py b/configure.py +index 6537a62d3954d83927c698db3fb80c9fc05faba7..b9a894bec9e5fd954004bcb423822ca984066dc5 100755 +--- a/configure.py ++++ b/configure.py +@@ -571,6 +571,12 @@ parser.add_option('--shared', + help='compile shared library for embedding node in another project. ' + + '(This mode is not officially supported for regular applications)') + ++parser.add_option('--libdir', ++ action='store', ++ dest='libdir', ++ default='lib', ++ help='a directory to install the shared library into') ++ + parser.add_option('--without-v8-platform', + action='store_true', + dest='without_v8_platform', +@@ -1105,6 +1111,7 @@ def configure_node(o): + o['variables']['node_no_browser_globals'] = b(options.no_browser_globals) + + o['variables']['node_shared'] = b(options.shared) ++ o['variables']['libdir'] = options.libdir + node_module_version = getmoduleversion.get_version() + + if options.dest_os == 'android': +diff --git a/tools/install.py b/tools/install.py +index 655802980a6ea94d1d4ca1dc63c8c8e905fbb83a..fe4723bf15012c8aacacb0393dc8294c049b0503 100755 +--- a/tools/install.py ++++ b/tools/install.py +@@ -121,26 +121,23 @@ def subdir_files(path, dest, action): + + def files(action): + is_windows = sys.platform == 'win32' +- output_file = 'node' + output_prefix = 'out/Release/' ++ output_libprefix = output_prefix + +- if 'false' == variables.get('node_shared'): +- if is_windows: +- output_file += '.exe' ++ if is_windows: ++ output_bin = 'node.exe' ++ output_lib = 'node.dll' + else: +- if is_windows: +- output_file += '.dll' +- else: +- output_file = 'lib' + output_file + '.' + variables.get('shlib_suffix') +- # GYP will output to lib.target except on OS X, this is hardcoded +- # in its source - see the _InstallableTargetInstallPath function. +- if sys.platform != 'darwin': +- output_prefix += 'lib.target/' ++ output_bin = 'node' ++ output_lib = 'libnode.' + variables.get('shlib_suffix') ++ # GYP will output to lib.target except on OS X, this is hardcoded ++ # in its source - see the _InstallableTargetInstallPath function. ++ if sys.platform != 'darwin': ++ output_libprefix += 'lib.target/' + +- if 'false' == variables.get('node_shared'): +- action([output_prefix + output_file], 'bin/' + output_file) +- else: +- action([output_prefix + output_file], 'lib/' + output_file) ++ action([output_prefix + output_bin], 'bin/' + output_bin) ++ if 'true' == variables.get('node_shared'): ++ action([output_libprefix + output_lib], variables.get('libdir') + '/' + output_lib) + + if 'true' == variables.get('node_use_dtrace'): + action(['out/Release/node.d'], 'lib/dtrace/node.d') +-- +2.24.1 + diff --git a/CVE-2018-12122.patch b/CVE-2018-12122.patch deleted file mode 100644 index c46268b..0000000 --- a/CVE-2018-12122.patch +++ /dev/null @@ -1,208 +0,0 @@ -From ee618a7ab239c98d945c723a4e225bc409151736 Mon Sep 17 00:00:00 2001 -From: Matteo Collina -Date: Thu, 23 Aug 2018 16:46:07 +0200 -Subject: [PATCH] http,https: protect against slow headers attack - -CVE-2018-12122 - -An attacker can send a char/s within headers and exahust the resources -(file descriptors) of a system even with a tight max header length -protection. This PR destroys a socket if it has not received the headers -in 40s. - -PR-URL: https://github.com/nodejs-private/node-private/pull/144 -Reviewed-By: Sam Roberts -Reviewed-By: Ben Noordhuis -Reviewed-By: James M Snell ---- - doc/api/http.md | 20 ++++++++ - doc/api/https.md | 7 +++ - lib/_http_server.js | 22 ++++++++- - lib/https.js | 1 + - lib/internal/http.js | 27 +++++++--- - test/async-hooks/test-graph.http.js | 2 +- - test/parallel/test-http-slow-headers.js | 50 +++++++++++++++++++ - test/parallel/test-https-slow-headers.js | 63 ++++++++++++++++++++++++ - 8 files changed, 182 insertions(+), 10 deletions(-) - create mode 100644 test/parallel/test-http-slow-headers.js - create mode 100644 test/parallel/test-https-slow-headers.js - -diff --git a/doc/api/http.md b/doc/api/http.md -index 1c6b5717e004..13373debb404 100644 ---- a/doc/api/http.md -+++ b/doc/api/http.md -@@ -958,6 +958,26 @@ added: v0.7.0 - - Limits maximum incoming headers count. If set to 0, no limit will be applied. - -+### server.headersTimeout -+ -+ -+* {number} **Default:** `40000` -+ -+Limit the amount of time the parser will wait to receive the complete HTTP -+headers. -+ -+In case of inactivity, the rules defined in [server.timeout][] apply. However, -+that inactivity based timeout would still allow the connection to be kept open -+if the headers are being sent very slowly (by default, up to a byte per 2 -+minutes). In order to prevent this, whenever header data arrives an additional -+check is made that more than `server.headersTimeout` milliseconds has not -+passed since the connection was established. If the check fails, a `'timeout'` -+event is emitted on the server object, and (by default) the socket is destroyed. -+See [server.timeout][] for more information on how timeout behaviour can be -+customised. -+ - ### server.setTimeout([msecs][, callback]) -