Initializes an OpenSSL secure heap of `n` bytes. When initialized, the

secure heap is used for selected types of allocations within OpenSSL

during key generation and other operations. This is useful, for instance,

to prevent sensitive information from leaking due to pointer overruns

or underruns.

The secure heap is a fixed size and cannot be resized at runtime so,

if used, it is important to select a large enough heap to cover all

application uses.

The heap size given must be a power of two. Any value less than 2

will disable the secure heap.

The secure heap is disabled by default.

The secure heap is not available on Windows.

See [`CRYPTO_secure_malloc_init`][] for more details.

When using `--secure-heap`, the `--secure-heap-min` flag specifies the

minimum allocation from the secure heap. The minimum value is `2`.

The maximum value is the lesser of `--secure-heap` or `2147483647`.

The value given must be a power of two.

* `--secure-heap-min`

* `--secure-heap`

[`CRYPTO_secure_malloc_init`]: https://www.openssl.org/docs/man1.1.0/man3/CRYPTO_secure_malloc_init.html

* Returns: {Object}

* `total` {number} The total allocated secure heap size as specified

using the `--secure-heap=n` command-line flag.

* `min` {number} The minimum allocation from the secure heap as

specified using the `--secure-heap-min` command-line flag.

* `used` {number} The total number of bytes currently allocated from

the secure heap.

* `utilization` {number} The calculated ratio of `used` to `total`

allocated bytes.

.It Fl -secure-heap Ns = Ns Ar n

Specify the size of the OpenSSL secure heap. Any value less than 2 disables

the secure heap. The default is 0. The value must be a power of two.

.It Fl -secure-heap-min Ns = Ns Ar n

Specify the minimum allocation from the OpenSSL secure heap. The default is 2. The value must be a power of two.

secureHeapUsed,

secureHeapUsed,

Number,

secureHeapUsed: _secureHeapUsed,

const { getOptionValue } = require('internal/options');

function secureHeapUsed() {

const val = _secureHeapUsed();

if (val === undefined)

return { total: 0, used: 0, utilization: 0, min: 0 };

const used = Number(_secureHeapUsed());

const total = Number(getOptionValue('--secure-heap'));

const min = Number(getOptionValue('--secure-heap-min'));

const utilization = used / total;

return { total, used, utilization, min };

secureHeapUsed,

using v8::BigInt;

#ifndef _WIN32

if (per_process::cli_options->secure_heap != 0) {

switch (CRYPTO_secure_malloc_init(

per_process::cli_options->secure_heap,

static_cast<int>(per_process::cli_options->secure_heap_min))) {

case 0:

fprintf(stderr, "Unable to initialize openssl secure heap.\n");

break;

case 2:

// Not a fatal error but worthy of a warning.

fprintf(stderr, "Unable to memory map openssl secure heap.\n");

break;

case 1:

// OK!

break;

}

}

#endif

void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

if (CRYPTO_secure_malloc_initialized())

args.GetReturnValue().Set(

BigInt::New(env->isolate(), CRYPTO_secure_used()));

}

env->SetMethod(target, "secureHeapUsed", SecureHeapUsed);

#include <limits>

#include <algorithm>

// Any value less than 2 disables use of the secure heap.

if (secure_heap >= 2) {

if ((secure_heap & (secure_heap - 1)) != 0)

errors->push_back("--secure-heap must be a power of 2");

secure_heap_min =

std::min({

secure_heap,

secure_heap_min,

static_cast<int64_t>(std::numeric_limits<int>::max())});

secure_heap_min = std::max(static_cast<int64_t>(2), secure_heap_min);

if ((secure_heap_min & (secure_heap_min - 1)) != 0)

errors->push_back("--secure-heap-min must be a power of 2");

}

AddOption("--secure-heap",

"total size of the OpenSSL secure heap",

&PerProcessOptions::secure_heap,

kAllowedInEnvironment);

AddOption("--secure-heap-min",

"minimum allocation size from the OpenSSL secure heap",

&PerProcessOptions::secure_heap_min,

kAllowedInEnvironment);

int64_t secure_heap = 0;

int64_t secure_heap_min = 2;

const common = require('../common');

if (!common.hasCrypto)

common.skip('missing crypto');

if (common.isWindows)

common.skip('Not supported on Windows');

const assert = require('assert');

const { fork } = require('child_process');

const fixtures = require('../common/fixtures');

const {

secureHeapUsed,

createDiffieHellman,

} = require('crypto');

if (process.argv[2] === 'child') {

const a = secureHeapUsed();

assert(a);

assert.strictEqual(typeof a, 'object');

assert.strictEqual(a.total, 65536);

assert.strictEqual(a.min, 4);

assert.strictEqual(a.used, 0);

{

const dh1 = createDiffieHellman(common.hasFipsCrypto ? 1024 : 256);

const p1 = dh1.getPrime('buffer');

const dh2 = createDiffieHellman(p1, 'buffer');

const key1 = dh1.generateKeys();

const key2 = dh2.generateKeys('hex');

dh1.computeSecret(key2, 'hex', 'base64');

dh2.computeSecret(key1, 'latin1', 'buffer');

const b = secureHeapUsed();

assert(b);

assert.strictEqual(typeof b, 'object');

assert.strictEqual(b.total, 65536);

assert.strictEqual(b.min, 4);

// The amount used can vary on a number of factors

assert(b.used > 0);

assert(b.utilization > 0.0);

}

return;

const child = fork(

process.argv[1],

['child'],

{ execArgv: ['--secure-heap=65536', '--secure-heap-min=4'] });

child.on('exit', common.mustCall((code) => {

assert.strictEqual(code, 0);

const child = fork(fixtures.path('a.js'), {

execArgv: ['--secure-heap=3', '--secure-heap-min=3'],

stdio: 'pipe'

});

let res = '';

child.on('exit', common.mustCall((code) => {

assert.notStrictEqual(code, 0);

assert.match(res, /--secure-heap must be a power of 2/);

assert.match(res, /--secure-heap-min must be a power of 2/);

}));

child.stderr.setEncoding('utf8');

child.stderr.on('data', (chunk) => res += chunk);

return [

'--openssl-config',

'--tls-cipher-list',

'--use-bundled-ca',

'--use-openssl-ca',

'--secure-heap',

'--secure-heap-min',

].includes(opt);