crypto: avoid hang when no algorithm available by richardlau · Pull Request #46237 · nodejs/node · GitHub

Avoid an endless loop if no algorithm is available to seed the cryptographically secure pseudorandom number generator (CSPRNG).

Co-authored-by: Anna Henningsen anna@addaleax.net
Fixes: #46200

cc @nodejs/crypto I believe the existing looping is to cope with transient not-enough-entropy cases but it's unclear to me how to recreate those and whether those cases are distinct enough from the two cases that his PR addresses (see the test case). As @addaleax mentions in #46200 (comment), hopefully scoping this change to a specific error will limit the scope for unintended breakage.

Avoid an endless loop if no algorithm is available to seed the cryptographically secure pseudorandom number generator (CSPRNG). Co-authored-by: Anna Henningsen <anna@addaleax.net>

Review requested:

@nodejs/crypto

Pushed a fixup since crypto.setFips isn't supported in workers.

CI: https://ci.nodejs.org/job/node-test-pull-request/49077/

CI: https://ci.nodejs.org/job/node-test-pull-request/49081/

Landed in aac2dcc

Avoid an endless loop if no algorithm is available to seed the cryptographically secure pseudorandom number generator (CSPRNG). Co-authored-by: Anna Henningsen <anna@addaleax.net> PR-URL: #46237 Fixes: #46200 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://github.com/nodejs/node) | stage | minor | `16.19.1-bullseye` -> `16.20.0-bullseye` | --- ### Release Notes <details> <summary>nodejs/node</summary> ### [`v16.20.0`](https://github.com/nodejs/node/releases/tag/v16.20.0): 2023-03-29, Version 16.20.0 'Gallium' (LTS), @BethGriggs [Compare Source](nodejs/node@v16.19.1...v16.20.0) ##### Notable Changes - **deps:** - update undici to 5.20.0 (Node.js GitHub Bot) [#46711](nodejs/node#46711) - update c-ares to 1.19.0 (Michaël Zasso) [#46415](nodejs/node#46415) - upgrade npm to 8.19.4 (npm team) [#46677](nodejs/node#46677) - update corepack to 0.17.0 (Node.js GitHub Bot) [#46842](nodejs/node#46842) - **(SEMVER-MINOR)** **src**: add support for externally shared js builtins (Michael Dawson) [#44376](nodejs/node#44376) ##### Commits - \[[`de6dd67790`](nodejs/node@de6dd67790)] - **crypto**: avoid hang when no algorithm available (Richard Lau) [#46237](nodejs/node#46237) - \[[`4617512788`](nodejs/node@4617512788)] - **crypto**: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) [#46185](nodejs/node#46185) - \[[`24972164fc`](nodejs/node@24972164fc)] - **deps**: update undici to 5.20.0 (Node.js GitHub Bot) [#46711](nodejs/node#46711) - \[[`85f88c6a8d`](nodejs/node@85f88c6a8d)] - **deps**: V8: cherry-pick [`90be99f`](nodejs/node@90be99fab31c) (Michaël Zasso) [#46646](nodejs/node#46646) - \[[`b4ebe6d47b`](nodejs/node@b4ebe6d47b)] - **deps**: update c-ares to 1.19.0 (Michaël Zasso) [#46415](nodejs/node#46415) - \[[`56cbc7fdda`](nodejs/node@56cbc7fdda)] - **deps**: V8: cherry-pick [`c2792e5`](nodejs/node@c2792e58035f) (Jiawen Geng) [#44961](nodejs/node#44961) - \[[`7af9bdb31e`](nodejs/node@7af9bdb31e)] - **deps**: upgrade npm to 8.19.4 (npm team) [#46677](nodejs/node#46677) - \[[`962a7471b5`](nodejs/node@962a7471b5)] - **deps**: update corepack to 0.17.0 (Node.js GitHub Bot) [#46842](nodejs/node#46842) - \[[`748bc96e35`](nodejs/node@748bc96e35)] - **deps**: update corepack to 0.16.0 (Node.js GitHub Bot) [#46710](nodejs/node#46710) - \[[`a467782499`](nodejs/node@a467782499)] - **deps**: update corepack to 0.15.3 (Node.js GitHub Bot) [#46037](nodejs/node#46037) - \[[`1913b6763d`](nodejs/node@1913b6763d)] - **deps**: update corepack to 0.15.2 (Node.js GitHub Bot) [#45635](nodejs/node#45635) - \[[`809371a15f`](nodejs/node@809371a15f)] - **module**: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) [#45147](nodejs/node#45147) - \[[`086bb2f8d4`](nodejs/node@086bb2f8d4)] - ***Revert*** "**src**: let http2 streams end after session close" (Rich Trott) [#46721](nodejs/node#46721) - \[[`6a01d39120`](nodejs/node@6a01d39120)] - **(SEMVER-MINOR)** **src**: add support for externally shared js builtins (Michael Dawson) [#44376](nodejs/node#44376) - \[[`d081032a60`](nodejs/node@d081032a60)] - **test**: fix test-net-connect-reset-until-connected (Vita Batrla) [#46781](nodejs/node#46781) - \[[`efe1be47ec`](nodejs/node@efe1be47ec)] - **test**: skip test depending on `overlapped-checker` when not available (Antoine du Hamel) [#45015](nodejs/node#45015) - \[[`fc47d58abe`](nodejs/node@fc47d58abe)] - **test**: remove cjs loader from stack traces (Geoffrey Booth) [#44197](nodejs/node#44197) - \[[`cf76d0790d`](nodejs/node@cf76d0790d)] - **test**: fix WPT title when no META title is present (Filip Skokan) [#46804](nodejs/node#46804) - \[[`0d1485b924`](nodejs/node@0d1485b924)] - **test**: fix default WPT titles (Filip Skokan) [#46778](nodejs/node#46778) - \[[`088e9cde3d`](nodejs/node@088e9cde3d)] - **test**: add WPTRunner support for variants and generating WPT reports (Filip Skokan) [#46498](nodejs/node#46498) - \[[`908c4dff44`](nodejs/node@908c4dff44)] - **test**: mark test-crypto-key-objects flaky on Linux (Richard Lau) [#46684](nodejs/node#46684) - \[[`768e56227e`](nodejs/node@768e56227e)] - **tools**: make `utils.SearchFiles` deterministic (Bruno Pitrus) [#44496](nodejs/node#44496) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.walbeck.it/mwalbeck/docker-cyberchef/pulls/187 Co-authored-by: renovate-bot <bot@walbeck.it> Co-committed-by: renovate-bot <bot@walbeck.it>

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [node](https://github.com/nodejs/node) | stage | minor | `16.19.1-bullseye-slim` -> `16.20.0-bullseye-slim` | --- ### Release Notes <details> <summary>nodejs/node</summary> ### [`v16.20.0`](https://github.com/nodejs/node/releases/tag/v16.20.0): 2023-03-29, Version 16.20.0 'Gallium' (LTS), @BethGriggs [Compare Source](nodejs/node@v16.19.1...v16.20.0) ##### Notable Changes - **deps:** - update undici to 5.20.0 (Node.js GitHub Bot) [#46711](nodejs/node#46711) - update c-ares to 1.19.0 (Michaël Zasso) [#46415](nodejs/node#46415) - upgrade npm to 8.19.4 (npm team) [#46677](nodejs/node#46677) - update corepack to 0.17.0 (Node.js GitHub Bot) [#46842](nodejs/node#46842) - **(SEMVER-MINOR)** **src**: add support for externally shared js builtins (Michael Dawson) [#44376](nodejs/node#44376) ##### Commits - \[[`de6dd67790`](nodejs/node@de6dd67790)] - **crypto**: avoid hang when no algorithm available (Richard Lau) [#46237](nodejs/node#46237) - \[[`4617512788`](nodejs/node@4617512788)] - **crypto**: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) [#46185](nodejs/node#46185) - \[[`24972164fc`](nodejs/node@24972164fc)] - **deps**: update undici to 5.20.0 (Node.js GitHub Bot) [#46711](nodejs/node#46711) - \[[`85f88c6a8d`](nodejs/node@85f88c6a8d)] - **deps**: V8: cherry-pick [`90be99f`](nodejs/node@90be99fab31c) (Michaël Zasso) [#46646](nodejs/node#46646) - \[[`b4ebe6d47b`](nodejs/node@b4ebe6d47b)] - **deps**: update c-ares to 1.19.0 (Michaël Zasso) [#46415](nodejs/node#46415) - \[[`56cbc7fdda`](nodejs/node@56cbc7fdda)] - **deps**: V8: cherry-pick [`c2792e5`](nodejs/node@c2792e58035f) (Jiawen Geng) [#44961](nodejs/node#44961) - \[[`7af9bdb31e`](nodejs/node@7af9bdb31e)] - **deps**: upgrade npm to 8.19.4 (npm team) [#46677](nodejs/node#46677) - \[[`962a7471b5`](nodejs/node@962a7471b5)] - **deps**: update corepack to 0.17.0 (Node.js GitHub Bot) [#46842](nodejs/node#46842) - \[[`748bc96e35`](nodejs/node@748bc96e35)] - **deps**: update corepack to 0.16.0 (Node.js GitHub Bot) [#46710](nodejs/node#46710) - \[[`a467782499`](nodejs/node@a467782499)] - **deps**: update corepack to 0.15.3 (Node.js GitHub Bot) [#46037](nodejs/node#46037) - \[[`1913b6763d`](nodejs/node@1913b6763d)] - **deps**: update corepack to 0.15.2 (Node.js GitHub Bot) [#45635](nodejs/node#45635) - \[[`809371a15f`](nodejs/node@809371a15f)] - **module**: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) [#45147](nodejs/node#45147) - \[[`086bb2f8d4`](nodejs/node@086bb2f8d4)] - ***Revert*** "**src**: let http2 streams end after session close" (Rich Trott) [#46721](nodejs/node#46721) - \[[`6a01d39120`](nodejs/node@6a01d39120)] - **(SEMVER-MINOR)** **src**: add support for externally shared js builtins (Michael Dawson) [#44376](nodejs/node#44376) - \[[`d081032a60`](nodejs/node@d081032a60)] - **test**: fix test-net-connect-reset-until-connected (Vita Batrla) [#46781](nodejs/node#46781) - \[[`efe1be47ec`](nodejs/node@efe1be47ec)] - **test**: skip test depending on `overlapped-checker` when not available (Antoine du Hamel) [#45015](nodejs/node#45015) - \[[`fc47d58abe`](nodejs/node@fc47d58abe)] - **test**: remove cjs loader from stack traces (Geoffrey Booth) [#44197](nodejs/node#44197) - \[[`cf76d0790d`](nodejs/node@cf76d0790d)] - **test**: fix WPT title when no META title is present (Filip Skokan) [#46804](nodejs/node#46804) - \[[`0d1485b924`](nodejs/node@0d1485b924)] - **test**: fix default WPT titles (Filip Skokan) [#46778](nodejs/node#46778) - \[[`088e9cde3d`](nodejs/node@088e9cde3d)] - **test**: add WPTRunner support for variants and generating WPT reports (Filip Skokan) [#46498](nodejs/node#46498) - \[[`908c4dff44`](nodejs/node@908c4dff44)] - **test**: mark test-crypto-key-objects flaky on Linux (Richard Lau) [#46684](nodejs/node#46684) - \[[`768e56227e`](nodejs/node@768e56227e)] - **tools**: make `utils.SearchFiles` deterministic (Bruno Pitrus) [#44496](nodejs/node#44496) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.walbeck.it/mwalbeck/docker-jellyfin-livestream/pulls/243 Co-authored-by: renovate-bot <bot@walbeck.it> Co-committed-by: renovate-bot <bot@walbeck.it>

crypto: avoid hang when no algorithm available

58dca48

Avoid an endless loop if no algorithm is available to seed the cryptographically secure pseudorandom number generator (CSPRNG). Co-authored-by: Anna Henningsen <anna@addaleax.net>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Jan 17, 2023

addaleax approved these changes Jan 17, 2023

View reviewed changes

addaleax added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 17, 2023

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 17, 2023

This comment was marked as outdated.

Sign in to view

fixup! crypto: avoid hang when no algorithm available

a954614

richardlau added commit-queue-squash Add this label to instruct the Commit Queue to squash all the PR commits into the first one. request-ci Add this label to start a Jenkins CI on a PR. labels Jan 17, 2023

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 17, 2023

This comment was marked as outdated.

Sign in to view

addaleax approved these changes Jan 17, 2023

View reviewed changes

This comment was marked as outdated.

Sign in to view

richardlau added the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Jan 17, 2023

github-actions Bot mentioned this pull request Jan 18, 2023

CI Reliability 2023-01-18 nodejs/reliability#487

Open

18 tasks

bnoordhuis reviewed Jan 18, 2023

View reviewed changes

Comment thread src/crypto/crypto_util.cc Outdated

richardlau removed the author ready PRs that have at least one approval, no outstanding review comments, and a CI started. label Jan 18, 2023

fixup! crypto: avoid hang when no algorithm available

86fa1f1

addaleax approved these changes Jan 18, 2023

View reviewed changes

bnoordhuis approved these changes Jan 18, 2023

View reviewed changes

Comment thread test/parallel/test-crypto-no-algorithm.js Outdated

github-actions Bot mentioned this pull request Jan 19, 2023

CI Reliability 2023-01-19 nodejs/reliability#488

Open

14 tasks

lpinca added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 19, 2023

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jan 19, 2023

This comment was marked as outdated.

Sign in to view

fixup! crypto: avoid hang when no algorithm available

cfdea22

richardlau added the request-ci Add this label to start a Jenkins CI on a PR. label Jan 19, 2023

addaleax added author ready PRs that have at least one approval, no outstanding review comments, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. labels Jan 19, 2023

addaleax approved these changes Jan 19, 2023

View reviewed changes

nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Jan 19, 2023

nodejs-github-bot merged commit aac2dcc into nodejs:main Jan 19, 2023

richardlau added lts-watch-v16.x labels Jan 19, 2023

richardlau deleted the randombytes branch January 19, 2023 17:50

github-actions Bot mentioned this pull request Jan 20, 2023

CI Reliability 2023-01-20 nodejs/reliability#489

Open

13 tasks

RafaelGSS mentioned this pull request Jan 20, 2023

v19.5.0 proposal #46286

Merged

juanarbol mentioned this pull request Mar 3, 2023

V18.15.0 proposal #46920

Merged

BethGriggs mentioned this pull request Mar 27, 2023

v16.20.0 proposal #47272

Merged

richardlau added backported-to-v16.x and removed lts-watch-v16.x labels Aug 24, 2023

targos added backported-to-v18.x and removed lts-watch-v18.x labels Oct 27, 2023

crypto: avoid hang when no algorithm available by richardlau · Pull Request #46237 · nodejs/node · GitHub

Uh oh!

Uh oh!

crypto: avoid hang when no algorithm available - #46237

crypto: avoid hang when no algorithm available#46237
nodejs-github-bot merged 4 commits into
nodejs:mainfrom
richardlau:randombytes

richardlau commented Jan 17, 2023

Uh oh!

nodejs-github-bot commented Jan 17, 2023

Uh oh!

This comment was marked as outdated.

richardlau commented Jan 17, 2023

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

Uh oh!

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented Jan 19, 2023

Uh oh!

nodejs-github-bot commented Jan 19, 2023

Uh oh!

nodejs-github-bot commented Jan 19, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

crypto: avoid hang when no algorithm available by richardlau · Pull Request #46237 · nodejs/node · GitHub

Uh oh!

Uh oh!

crypto: avoid hang when no algorithm available - #46237

crypto: avoid hang when no algorithm available#46237nodejs-github-bot merged 4 commits intonodejs:mainnodejs/node:mainfrom richardlau:randombytesrichardlau/node-1:randombytesCopy head branch name to clipboard

Conversation

richardlau commented Jan 17, 2023

Uh oh!

nodejs-github-bot commented Jan 17, 2023

Uh oh!

This comment was marked as outdated.

richardlau commented Jan 17, 2023

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

Uh oh!

Uh oh!

This comment was marked as outdated.

nodejs-github-bot commented Jan 19, 2023

Uh oh!

nodejs-github-bot commented Jan 19, 2023

Uh oh!

nodejs-github-bot commented Jan 19, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

crypto: avoid hang when no algorithm available#46237
nodejs-github-bot merged 4 commits into
nodejs:mainfrom
richardlau:randombytes