build: enable v8's siphash for hash seed creation

Triggers the V8_USE_SIPHASH to switch from the internal custom V8 hash seed generation function to an implementation of SipHash. Final step needed to clear up HashWick. PR-URL: #26367 Refs: #23259 Refs: https://darksi.de/12.hashwick-v8-vulnerability/ Reviewed-By: Gus Caplan <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Refael Ackermann <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Yang Guo <[email protected]> Reviewed-By: Ujjwal Sharma <[email protected]>
nodejs · Mar 14, 2019 · 9b1cb9d · 9b1cb9d
1 parent 2c55282
commit 9b1cb9d
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 0 deletions.
diff --git a/common.gypi b/common.gypi
@@ -32,6 +32,9 @@
     # Increment by one for each non-official patch applied to deps/v8.
     'v8_embedder_string': '-node.18',
 
+    # Turn on SipHash for hash seed generation, addresses HashWick
+    'v8_use_siphash': 'true',
+
     # Enable disassembler for `--print-code` v8 options
     'v8_enable_disassembler': 1,
 

diff --git a/configure.py b/configure.py
@@ -509,6 +509,11 @@
     dest='without_snapshot',
     help=optparse.SUPPRESS_HELP)
 
+parser.add_option('--without-siphash',
+    action='store_true',
+    dest='without_siphash',
+    help=optparse.SUPPRESS_HELP)
+
 parser.add_option('--code-cache-path',
     action='store',
     dest='code_cache_path',
@@ -1178,6 +1183,7 @@ def configure_v8(o):
   o['variables']['v8_random_seed'] = 0  # Use a random seed for hash tables.
   o['variables']['v8_promise_internal_field_count'] = 1 # Add internal field to promises for async hooks.
   o['variables']['v8_use_snapshot'] = 'false' if options.without_snapshot else 'true'
+  o['variables']['v8_use_siphash'] = 'false' if options.without_siphash else 'true'
   o['variables']['v8_trace_maps'] = 1 if options.trace_maps else 0
   o['variables']['node_use_v8_platform'] = b(not options.without_v8_platform)
   o['variables']['node_use_bundled_v8'] = b(not options.without_bundled_v8)

diff --git a/deps/v8/gypfiles/features.gypi b/deps/v8/gypfiles/features.gypi
@@ -154,6 +154,9 @@
       ['v8_use_snapshot=="true" and v8_use_external_startup_data==1', {
         'defines': ['V8_USE_EXTERNAL_STARTUP_DATA',],
       }],
+      ['v8_use_siphash=="true"', {
+        'defines': ['V8_USE_SIPHASH',],
+      }],
       ['dcheck_always_on!=0', {
         'defines': ['DEBUG',],
       }],

diff --git a/deps/v8/gypfiles/v8.gyp b/deps/v8/gypfiles/v8.gyp
@@ -92,6 +92,7 @@
               'v8_enable_verify_predictable=<(v8_enable_verify_predictable)',
               'v8_target_cpu=<(v8_target_arch)',
               'v8_use_snapshot=<(v8_use_snapshot)',
+              'v8_use_siphash=<(v8_use_siphash)',
             ]
           },
           'conditions': [
@@ -1432,6 +1433,8 @@
         '../src/string-stream.h',
         '../src/strtod.cc',
         '../src/strtod.h',
+        '../src/third_party/siphash/halfsiphash.cc',
+        '../src/third_party/siphash/halfsiphash.h',
         '../src/third_party/utf8-decoder/utf8-decoder.h',
         '../src/tracing/trace-event.cc',
         '../src/tracing/trace-event.h',

diff --git a/node.gyp b/node.gyp
@@ -1,6 +1,7 @@
 {
   'variables': {
     'v8_use_snapshot%': 'false',
+    'v8_use_siphash%': 'true',
     'v8_trace_maps%': 0,
     'node_use_dtrace%': 'false',
     'node_use_etw%': 'false',