As part of the fix for logjam, node was upgraded to a
level of openssl which rejects connections to servers that
are using keys smaller than 768 bits. It is still possible,
however, to create a server that uses a smaller key size
and and older client may be able to connect to it.
This PR moves us to a secure by default stance on the
server side as well, preventing the creation of a server
using a dhe key size less than 768. This can be overridden
with the command line option which is also added.
It is derived from
9b35be5810
which was landed in later io.js/node versions but makes
the limit 1024. This PR uses the smaller limit in order
to meet the recomendations for logjam while matching was
was done on the client side in openssl to minimize the
potential impacton users.
The command line option will only be documented in the
release notes and will not be added to the tls
documentation. The goal is that people who are
upgrading are aware and can use the option if they
run into issues, but otherwise the option is not
visible/used.
PR-URL: https://github.com/nodejs/node/pull/3890
Fixes: https://github.com/nodejs/LTS/issues/49
Reviewed-By: Myles Borins <mborins@us.ibm.com>
Reviewed-By: James Snell <jasnell@gmail.com>
Reviewed-By: Rod Vagg <r@va.gg>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
Changed child_process.exec documentation to reflect that the parameters stdout and stderr are instances of Buffer only if {encoding: null}. Otherwise, they are instances of String with the encoding.
Fixes#9434
removed .DS_Store
PR-URL: https://github.com/joyent/node/pull/14088
Reviewed-By: jasnell - James M Snell <jasnell@gmail.com>
Reviewed-By: piscisaureus - Bert Belder <bertbelder@gmail.com>
Updated documentation as per the issue below:
https://github.com/joyent/node/issues/25466
Event listeners can alter parts of the passed object, in some
circumstances the changes are passed to the next listeners
due to pass by reference. This is documentation of that behavior.
PR-URL: https://github.com/joyent/node/pull/25467
Reviewed-By: jasnell - James M Snell <jasnell@gmail.com>
No offense to @izs, but the doxygen he put up 3.5 years ago isn't
accurate for node 0.12 nor io.js. I'm trying to keep up and have
multiple sets of doxygen of v8 available at http://v8dox.com/
PR-URL: https://github.com/joyent/node/pull/25811
Reviewed-By: James M Snell <jasnell@gmail.com>
The current wording "This module is used for writing unit tests for your applications, you can access it with require('assert')." implies that this module should only be used in development while unit testing.
The article "Error Handling in Node.js" by Joyent (https://www.joyent.com/developers/node/design/errors) uses the assert module in an efficient way to validate required function arguments.
PR-URL: https://github.com/joyent/node/pull/25811
Reviewed-By: James M Snell <jasnell@gmail.com>
per https://github.com/joyent/node/issues/14597
Indicate that `'readable'` indicates only that data can
be read from the stream, not that there is actually data
to be consumed. `readable.read([size])` can still return
null. Includes an example that illustrates the point.
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25591
Per https://github.com/joyent/node/issues/14604,
Document that performing an `unshift` during a read
can have unexpected results. Following the `unshift`
with a `push('')` resets the reading state appropriately.
Also indicate that doing an `unshift` during a read
is not optimal and should be avoided.
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25591
per: https://github.com/joyent/node/issues/14596
1. document that a runtime error will occur if you attempt
to unshift after the end event
2. document that calling read after the end event will return
null and will not trigger a runtime error
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25591
Made explicitely clear that when size bytes are not available, it will
return null, unless we've ended, in which case the data remaining in the
buffer will be returned.
Fixes#7273
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25591
The documentation for createWriteStream() references an
'encoding' property that has a default value of null. However,
this property is never referenced by createWriteStream() or
WritableState(). Instead a 'defaultEncoding' property is
referenced in WritableState() with a default of 'utf8' if no value
is supplied.
This fix updates the documentation to rename the 'encoding'
property to 'defaultEncoding' and indicate its default value of
'utf8'.
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25591
Per #4409, the documentation on http.abort is a bit lacking.
This provides a slight improvement.
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25591
This reverts commit 67d9a56251.
This commit actually reverts both
67d9a56251 and
02a549ed2b (both related to ciphers list
changes). It does it in one commit because reverting
02a549ed2b results in an empty commit.
These changes are not yet ready to be released, and before they are we
want to be able to publish new releases. We're reverting them so that we
can submit a new PR that will contain all these changes plus what's
necessary to be able to land them properly.
Conflicts:
src/node.cc
PR: #25511
PR-URL: https://github.com/joyent/node/pull/25511
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
Revert "disable RC4, add --cipher-list command line switch" and
"tls: make --enable-legacy-cipher-list=val less verbose"
This reverts commit f9291a9449 and
b5737bb977.
There is still some work to be done to guarantee secure defaults and a
smooth upgrade path for v0.12.x users. Before this work is finished, we
want to be able to release new versions of v0.12.x. So instead of
waiting for these changes to be ready to ship, revert them and integrate
them when they're ready to be shipped.
Conflicts:
src/node.cc
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/25296
V4MAPPED is not supported on recent FreeBSD versions, at least on 10.1.
Thus, do not set this flag in net.connect on FreeBSD.
Fixes#8540 and #9204.
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
PR-URL: https://github.com/joyent/node/pull/18204
Disable RC4 in the default cipher list
Add the `--cipher-list` command line switch and `NODE_CIPHER_LIST`
environment variable to completely override the default cipher list.
Add the `--enable-legacy-cipher-list` and `NODE_LEGACY_CIPHER_LIST`
environment variable to selectively enable the default cipher list from
previous node.js releases.
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/14414
Disable RC4 in the default cipher list
Add the `--cipher-list` command line switch and `NODE_CIPHER_LIST`
environment variable to completely override the default cipher list.
Add the `--enable-legacy-cipher-list` and `NODE_LEGACY_CIPHER_LIST`
environment variable to selectively enable the default cipher list from
previous node.js releases.
Reviewed-By: James M Snell <jasnell@gmail.com>
PR-URL: https://github.com/joyent/node/pull/14413
Clarify that synchronous functions in fs with no return value return
undefined.
Specify that fs.openSync() returns an integer and fs.existsSync()
returns true or false.
Fixes#9313
PR: #9359
PR-URL: https://github.com/joyent/node/pull/9359
Reviewed-By: Julien Gilli <julien.gilli@joyent.com>
In the documentation for querystring.parse, the documentation mentions
that the default value for options.decodeURIComponent is the
decodeURIComponent function, but it's actually the querystring.unescape
function.
PR-URL: https://github.com/joyent/node/pull/9259
Reviewed-by: Julien Gilli <julien.gilli@joyent.com>
Currently, fs.truncate() silently fails when a file descriptor
is passed as the first argument. This commit changes this
behavior to properly call fs.ftruncate().
PR-URL: https://github.com/joyent/node/pull/9161
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Timothy J Fontaine <tjfontaine@gmail.com>
This reverts commit d312b6d15c.
d312b6d15c introduced some confusion in
the existing API of url.format and url.parse.
The way the 'path' property overrides other properties in url.format's
input is too confusing for existing users compared to the issues it
fixes.
Fixes such as https://github.com/joyent/node/pull/9081 have been
proposed, but they do not make the API less confusing.
Instead, this change just reverts the original breaking change so that
it gives us more time after v0.12.0 is released to come up with a better
API for url.format, url.parse and other related APIs in the v0.13
development branch.
Fixes#9070.
Conflicts:
doc/api/url.markdown
PR: #9109
PR-URL: https://github.com/joyent/node/pull/9109
Reviewed-By: Timothy J Fontaine <tjfontaine@gmail.com>
The message argument is optional for both assert() and
assert.ok(). This commit makes message optional for assert().
PR-URL: https://github.com/joyent/node/pull/9003
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
The message argument is optional for both assert() and
assert.ok(). This commit makes message optional for assert().
PR-URL: https://github.com/joyent/node/pull/9003
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Trevor Norris <trev.norris@gmail.com>
