asherah 1.3.22 → 1.3.23

package/binding.gyp

@@ -22,7 +22,6 @@
         'src/asherah.cc',
         'src/logging.cc',
         'src/logging.h',
-        'src/cobhan_napi_interop.cc',
         'src/cobhan_napi_interop.h',
         'src/cobhan.h',
         'src/cobhan.cc',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "asherah",
-  "version": "1.3.22",
+  "version": "1.3.23",
   "description": "Asherah envelope encryption and key rotation library",
   "exports": {
     "node-addons": "./dist/asherah.node"
@@ -27,7 +27,6 @@
     "src/logging.h",
     "src/logging.cc",
     "src/cobhan_napi_interop.h",
-    "src/cobhan_napi_interop.cc",
     "src/cobhan.h",
     "src/cobhan.cc",
     "src/asherah.d.ts",

package/src/asherah.cc

@@ -6,23 +6,90 @@
 #include <mutex>
 #include <napi.h>
 
-size_t max_stack_alloc_size = 2048;
+size_t est_intermediate_key_overhead;
+size_t maximum_stack_alloc_size = 2048;
+
 int32_t setup_state = 0;
 std::mutex asherah_lock;
 
+__attribute__((always_inline)) inline size_t
+estimate_asherah_output_size_bytes(size_t data_byte_len,
+                                   size_t partition_byte_len) {
+  const size_t est_encryption_overhead = 48;
+  const size_t est_envelope_overhead = 185;
+  const double base64_overhead = 1.34;
+
+  // Add one rather than using std::ceil to round up
+  double est_data_byte_len =
+      (double(data_byte_len + est_encryption_overhead) * base64_overhead) + 1;
+
+  size_t asherah_output_size_bytes =
+      size_t(est_envelope_overhead + est_intermediate_key_overhead +
+             partition_byte_len + est_data_byte_len);
+  if (unlikely(verbose_flag)) {
+    std::string log_msg =
+        "estimate_asherah_output_size(" + std::to_string(data_byte_len) + ", " +
+        std::to_string(partition_byte_len) +
+        ") est_data_byte_len: " + std::to_string(est_data_byte_len) +
+        " asherah_output_size_bytes: " +
+        std::to_string(asherah_output_size_bytes);
+    debug_log(__func__, log_msg);
+  }
+  return asherah_output_size_bytes;
+}
+
+__attribute__((always_inline)) inline const char* asherah_cobhan_error_to_string(int32_t error) {
+  switch(error) {
+    case 0:
+      return "Success";
+    case -1:
+      return "Cobhan error: NULL pointer";
+    case -2:
+      return "Cobhan error: Buffer too large";
+    case -3:
+      return "Cobhan error: Buffer too small";
+    case -4:
+      return "Cobhan error: Copy failed";
+    case -5:
+      return "Cobhan error: JSON decode failed";
+    case -6:
+      return "Cobhan error: JSON encode failed";
+    case -7:
+      return "Cobhan error: Invalid UTF-8";
+    case -8:
+      return "Cobhan error: Read temp file failed";
+    case -9:
+      return "Cobhan error: Write temp file failed";
+    case -100:
+      return "Asherah error: Not initialized";
+    case -101:
+      return "Asherah error: Already initialized";
+    case -102:
+      return "Asherah error: Failed to get session";
+    case -103:
+      return "Asherah error: Encrypt operation failed";
+    case -104:
+      return "Asherah error: Decrypt operation failed";
+    case -105:
+      return "Asherah error: Invalid configuration";
+    default:
+      return "Unknown error";
+  }
+}
+
 void setup(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("setup", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(setup_state == 1)) {
-    log_error_and_throw("setup", "setup called twice");
+    log_error_and_throw(__func__, "setup called twice");
   }
 
   if (unlikely(info.Length() < 1)) {
-    log_error_and_throw("setup", "Wrong number of arguments");
+    log_error_and_throw(__func__, "Wrong number of arguments");
   }
 
   Napi::String config;
@@ -38,7 +105,7 @@ void setup(const Napi::CallbackInfo &info) {
     Napi::Function parse = json.Get("parse").As<Napi::Function>();
     config_json = parse.Call(json, {config}).As<Napi::Object>();
   } else {
-    log_error_and_throw("setup", "Wrong argument type");
+    log_error_and_throw(__func__, "Wrong argument type");
   }
 
   Napi::String product_id = config_json.Get("ProductID").As<Napi::String>();
@@ -50,20 +117,20 @@ void setup(const Napi::CallbackInfo &info) {
   Napi::Value verbose = config_json.Get("Verbose");
   if (likely(verbose.IsBoolean())) {
     verbose_flag = verbose.As<Napi::Boolean>().Value();
-    debug_log("setup", "verbose_flag: " + std::to_string(verbose_flag));
+    debug_log(__func__, "verbose_flag: " + std::to_string(verbose_flag));
   } else {
     verbose_flag = 0;
-    debug_log("setup", "verbose_flag: defaulting to false");
+    debug_log(__func__, "verbose_flag: defaulting to false");
   }
 
   char *config_cobhan_buffer;
   size_t config_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, config, config_cobhan_buffer, config_copied_bytes,
-                         "setup");
+                         maximum_stack_alloc_size, __func__);
 
   char *config_canary_ptr = get_canary_ptr(config_cobhan_buffer);
   if (unlikely(!check_canary_ptr(config_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for config_cobhan_buffer");
   }
 
@@ -71,18 +138,17 @@ void setup(const Napi::CallbackInfo &info) {
   GoInt32 result = SetupJson(config_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("setup", "Returned from asherah-cobhan SetupJson");
+    debug_log(__func__, "Returned from asherah-cobhan SetupJson");
   }
 
   if (unlikely(!check_canary_ptr(config_canary_ptr))) {
     log_error_and_throw(
-        "encrypt_to_json",
+        __func__,
         "Failed post-call canary check for config_cobhan_buffer");
   }
 
   if (unlikely(result < 0)) {
-    // TODO: Convert this to a proper error message
-    log_error_and_throw("setup", std::to_string(result));
+    log_error_and_throw(__func__, asherah_cobhan_error_to_string(result));
   }
   setup_state = 1;
 }
@@ -96,33 +162,32 @@ Napi::String encrypt_to_json(Napi::Env &env, size_t partition_bytes,
       estimate_asherah_output_size_bytes(data_bytes, partition_bytes);
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt_to_json", " asherah_output_size_bytes " +
+    debug_log(__func__, " asherah_output_size_bytes " +
                                      std::to_string(asherah_output_size_bytes));
   }
 
   char *output_cobhan_buffer;
   ALLOCATE_CBUFFER(output_cobhan_buffer, asherah_output_size_bytes,
-                   "encrypt_to_json");
+                   maximum_stack_alloc_size, __func__);
 
   char *partition_id_canary_ptr = get_canary_ptr(partition_id_cobhan_buffer);
   if (unlikely(!check_canary_ptr(partition_id_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed initial canary check for partition_id_cobhan_buffer");
   }
   char *input_canary_ptr = get_canary_ptr(input_cobhan_buffer);
   if (unlikely(!check_canary_ptr(input_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for input_cobhan_buffer");
   }
   char *output_canary_ptr = get_canary_ptr(output_cobhan_buffer);
   if (unlikely(!check_canary_ptr(output_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for output_cobhan_buffer");
   }
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt_to_json", "Calling asherah-cobhan EncryptToJson");
+    debug_log(__func__, "Calling asherah-cobhan EncryptToJson");
   }
 
   // extern GoInt32 EncryptToJson(void* partitionIdPtr, void* dataPtr, void*
@@ -131,28 +196,24 @@ Napi::String encrypt_to_json(Napi::Env &env, size_t partition_bytes,
                                  input_cobhan_buffer, output_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt_to_json", "Returning from asherah-cobhan EncryptToJson");
+    debug_log(__func__, "Returning from asherah-cobhan EncryptToJson");
   }
 
   if (unlikely(!check_canary_ptr(partition_id_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for partition_id_cobhan_buffer");
   }
   if (unlikely(!check_canary_ptr(input_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for input_cobhan_buffer");
   }
   if (unlikely(!check_canary_ptr(output_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for output_cobhan_buffer");
   }
 
   if (unlikely(result < 0)) {
-    // TODO: Convert this to a proper error message
-    log_error_and_throw("encrypt_to_json", std::to_string(result));
+    log_error_and_throw(__func__, asherah_cobhan_error_to_string(result));
   }
 
   Napi::String output = cbuffer_to_nstring(env, output_cobhan_buffer);
@@ -163,19 +224,19 @@ Napi::String encrypt(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(setup_state == 0)) {
-    log_error_and_throw("encrypt", "setup() not called");
+    log_error_and_throw(__func__, "setup() not called");
   }
 
   if (unlikely(info.Length() < 2)) {
-    log_error_and_throw("encrypt", "Wrong number of arguments");
+    log_error_and_throw(__func__, "Wrong number of arguments");
   }
 
   if (unlikely(!info[0].IsString() || !info[1].IsBuffer())) {
-    log_error_and_throw("encrypt", "Wrong argument types");
+    log_error_and_throw(__func__, "Wrong argument types");
   }
 
   Napi::Env env = info.Env();
@@ -184,21 +245,23 @@ Napi::String encrypt(const Napi::CallbackInfo &info) {
   char *partition_id_cobhan_buffer;
   size_t partition_id_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, partition_id, partition_id_cobhan_buffer,
-                         partition_id_copied_bytes, "encrypt");
+                         partition_id_copied_bytes, maximum_stack_alloc_size,
+                         __func__);
 
   Napi::Buffer<unsigned char> input_napi_buffer =
       info[1].As<Napi::Buffer<unsigned char>>();
   char *input_cobhan_buffer;
   size_t input_copied_bytes;
   NAPI_BUFFER_TO_CBUFFER(env, input_napi_buffer, input_cobhan_buffer,
-                         input_copied_bytes, "encrypt");
+                         input_copied_bytes, maximum_stack_alloc_size,
+                         __func__);
 
   Napi::String output =
       encrypt_to_json(env, partition_id_copied_bytes, input_copied_bytes,
                       partition_id_cobhan_buffer, input_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt", "finished");
+    debug_log(__func__, "finished");
   }
 
   return output;
@@ -208,19 +271,19 @@ Napi::String encrypt_string(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt_string", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(setup_state == 0)) {
-    log_error_and_throw("encrypt_string", "setup() not called");
+    log_error_and_throw(__func__, "setup() not called");
   }
 
   if (unlikely(info.Length() < 2)) {
-    log_error_and_throw("encrypt_string", "Wrong number of arguments");
+    log_error_and_throw(__func__, "Wrong number of arguments");
   }
 
   if (unlikely(!info[0].IsString() || !info[1].IsString())) {
-    log_error_and_throw("encrypt_string", "Wrong argument types");
+    log_error_and_throw(__func__, "Wrong argument types");
   }
 
   Napi::Env env = info.Env();
@@ -229,20 +292,21 @@ Napi::String encrypt_string(const Napi::CallbackInfo &info) {
   char *partition_id_cobhan_buffer;
   size_t partition_id_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, partition_id, partition_id_cobhan_buffer,
-                         partition_id_copied_bytes, "encrypt_string");
+                         partition_id_copied_bytes, maximum_stack_alloc_size,
+                         __func__);
 
   Napi::String input = info[1].As<Napi::String>();
   char *input_cobhan_buffer;
   size_t input_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, input, input_cobhan_buffer, input_copied_bytes,
-                         "encrypt_string");
+                         maximum_stack_alloc_size, __func__);
 
   Napi::String output =
       encrypt_to_json(env, partition_id_copied_bytes, input_copied_bytes,
                       partition_id_cobhan_buffer, input_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("encrypt_string", "finished");
+    debug_log(__func__, "finished");
   }
 
   return output;
@@ -252,19 +316,19 @@ Napi::Buffer<unsigned char> decrypt(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(setup_state == 0)) {
-    log_error_and_throw("decrypt", "setup() not called");
+    log_error_and_throw(__func__, "setup() not called");
   }
 
   if (unlikely(info.Length() < 2)) {
-    log_error_and_throw("decrypt", "Wrong number of arguments");
+    log_error_and_throw(__func__, "Wrong number of arguments");
   }
 
   if (unlikely(!info[0].IsString() || !info[1].IsString())) {
-    log_error_and_throw("decrypt", "Wrong argument types");
+    log_error_and_throw(__func__, "Wrong argument types");
   }
 
   Napi::Env env = info.Env();
@@ -273,36 +337,38 @@ Napi::Buffer<unsigned char> decrypt(const Napi::CallbackInfo &info) {
   char *partition_id_cobhan_buffer;
   size_t partition_id_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, partition_id, partition_id_cobhan_buffer,
-                         partition_id_copied_bytes, "decrypt");
+                         partition_id_copied_bytes, maximum_stack_alloc_size,
+                         __func__);
 
   Napi::String input = info[1].As<Napi::String>();
   char *input_cobhan_buffer;
   size_t input_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, input, input_cobhan_buffer, input_copied_bytes,
-                         "decrypt");
+                         maximum_stack_alloc_size, __func__);
 
   char *output_cobhan_buffer;
-  ALLOCATE_CBUFFER(output_cobhan_buffer, input_copied_bytes, "decrypt");
+  ALLOCATE_CBUFFER(output_cobhan_buffer, input_copied_bytes,
+                   maximum_stack_alloc_size, __func__);
 
   char *partition_id_canary_ptr = get_canary_ptr(partition_id_cobhan_buffer);
   if (unlikely(!check_canary_ptr(partition_id_canary_ptr))) {
     log_error_and_throw(
-        "encrypt_to_json",
+        __func__,
         "Failed initial canary check for partition_id_cobhan_buffer");
   }
   char *input_canary_ptr = get_canary_ptr(input_cobhan_buffer);
   if (unlikely(!check_canary_ptr(input_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for input_cobhan_buffer");
   }
   char *output_canary_ptr = get_canary_ptr(output_cobhan_buffer);
   if (unlikely(!check_canary_ptr(output_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for output_cobhan_buffer");
   }
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt", "Calling asherah-cobhan DecryptFromJson");
+    debug_log(__func__, "Calling asherah-cobhan DecryptFromJson");
   }
 
   // extern GoInt32 DecryptFromJson(void* partitionIdPtr, void* jsonPtr, void*
@@ -311,35 +377,31 @@ Napi::Buffer<unsigned char> decrypt(const Napi::CallbackInfo &info) {
                                    input_cobhan_buffer, output_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt", "Returned from asherah-cobhan DecryptFromJson");
+    debug_log(__func__, "Returned from asherah-cobhan DecryptFromJson");
   }
 
   if (unlikely(!check_canary_ptr(partition_id_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for partition_id_cobhan_buffer");
   }
   if (unlikely(!check_canary_ptr(input_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for input_cobhan_buffer");
   }
   if (unlikely(!check_canary_ptr(output_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for output_cobhan_buffer");
   }
 
   if (unlikely(result < 0)) {
-    // TODO: Convert this to a proper error message
-    log_error_and_throw("decrypt", std::to_string(result));
+    log_error_and_throw(__func__, asherah_cobhan_error_to_string(result));
   }
 
   Napi::Buffer<unsigned char> output =
       cbuffer_to_nbuffer(env, output_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt", "finished");
+    debug_log(__func__, "finished");
   }
 
   return output;
@@ -349,19 +411,19 @@ Napi::String decrypt_string(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt_string", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(setup_state == 0)) {
-    log_error_and_throw("decrypt_string", "setup() not called");
+    log_error_and_throw(__func__, "setup() not called");
   }
 
   if (unlikely(info.Length() < 2)) {
-    log_error_and_throw("decrypt_string", "Wrong number of arguments");
+    log_error_and_throw(__func__, "Wrong number of arguments");
   }
 
   if (unlikely(!info[0].IsString() || !info[1].IsString())) {
-    log_error_and_throw("decrypt_string", "Wrong argument types");
+    log_error_and_throw(__func__, "Wrong argument types");
   }
 
   Napi::Env env = info.Env();
@@ -370,36 +432,38 @@ Napi::String decrypt_string(const Napi::CallbackInfo &info) {
   char *partition_id_cobhan_buffer;
   size_t partition_id_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, partition_id, partition_id_cobhan_buffer,
-                         partition_id_copied_bytes, "decrypt_string");
+                         partition_id_copied_bytes, maximum_stack_alloc_size,
+                         __func__);
 
   Napi::String input = info[1].As<Napi::String>();
   char *input_cobhan_buffer;
   size_t input_copied_bytes;
   NAPI_STRING_TO_CBUFFER(env, input, input_cobhan_buffer, input_copied_bytes,
-                         "decrypt_string");
+                         maximum_stack_alloc_size, __func__);
 
   char *output_cobhan_buffer;
-  ALLOCATE_CBUFFER(output_cobhan_buffer, input_copied_bytes, "decrypt_string");
+  ALLOCATE_CBUFFER(output_cobhan_buffer, input_copied_bytes,
+                   maximum_stack_alloc_size, __func__);
 
   char *partition_id_canary_ptr = get_canary_ptr(partition_id_cobhan_buffer);
   if (unlikely(!check_canary_ptr(partition_id_canary_ptr))) {
     log_error_and_throw(
-        "encrypt_to_json",
+        __func__,
         "Failed initial canary check for partition_id_cobhan_buffer");
   }
   char *input_canary_ptr = get_canary_ptr(input_cobhan_buffer);
   if (unlikely(!check_canary_ptr(input_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for input_cobhan_buffer");
   }
   char *output_canary_ptr = get_canary_ptr(output_cobhan_buffer);
   if (unlikely(!check_canary_ptr(output_canary_ptr))) {
-    log_error_and_throw("encrypt_to_json",
+    log_error_and_throw(__func__,
                         "Failed initial canary check for output_cobhan_buffer");
   }
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt_string", "Calling asherah-cobhan DecryptFromJson");
+    debug_log(__func__, "Calling asherah-cobhan DecryptFromJson");
   }
 
   // extern GoInt32 DecryptFromJson(void* partitionIdPtr, void* jsonPtr, void*
@@ -408,34 +472,30 @@ Napi::String decrypt_string(const Napi::CallbackInfo &info) {
                                    input_cobhan_buffer, output_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt_string", "Returned from asherah-cobhan DecryptFromJson");
+    debug_log(__func__, "Returned from asherah-cobhan DecryptFromJson");
   }
 
   if (unlikely(!check_canary_ptr(partition_id_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for partition_id_cobhan_buffer");
   }
   if (unlikely(!check_canary_ptr(input_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for input_cobhan_buffer");
   }
   if (unlikely(!check_canary_ptr(output_canary_ptr))) {
-    log_error_and_throw(
-        "encrypt_to_json",
+    log_error_and_throw(__func__,
         "Failed post-call canary check for output_cobhan_buffer");
   }
 
   if (unlikely(result < 0)) {
-    // TODO: Convert this to a proper error message
-    log_error_and_throw("decrypt_string", std::to_string(result));
+    log_error_and_throw(__func__, asherah_cobhan_error_to_string(result));
   }
 
   Napi::String output = cbuffer_to_nstring(env, output_cobhan_buffer);
 
   if (unlikely(verbose_flag)) {
-    debug_log("decrypt_string", "finished");
+    debug_log(__func__, "finished");
   }
 
   return output;
@@ -445,20 +505,20 @@ void shutdown(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("shutdown", "called");
+    debug_log(__func__, "called");
   }
 
   setup_state = 0;
 
   if (unlikely(verbose_flag)) {
-    debug_log("shutdown", "Calling asherah-cobhan Shutdown");
+    debug_log(__func__, "Calling asherah-cobhan Shutdown");
   }
 
   // extern void Shutdown();
   Shutdown();
 
   if (unlikely(verbose_flag)) {
-    debug_log("shutdown", "Returned from asherah-cobhan Shutdown");
+    debug_log(__func__, "Returned from asherah-cobhan Shutdown");
   }
 }
 
@@ -466,28 +526,28 @@ void set_max_stack_alloc_item_size(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("set_max_stack_alloc_item_size", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(info.Length() < 1)) {
-    log_error_and_throw("set_max_stack_alloc_item_size",
+    log_error_and_throw(__func__,
                         "Wrong number of arguments");
   }
 
   Napi::Number item_size = info[0].ToNumber();
 
-  max_stack_alloc_size = (size_t)item_size.Int32Value();
+  maximum_stack_alloc_size = (size_t)item_size.Int32Value();
 }
 
 void set_safety_padding_overhead(const Napi::CallbackInfo &info) {
   std::lock_guard<std::mutex> lock(asherah_lock);
 
   if (unlikely(verbose_flag)) {
-    debug_log("set_safety_padding_overhead", "called");
+    debug_log(__func__, "called");
   }
 
   if (unlikely(info.Length() < 1)) {
-    log_error_and_throw("set_safety_padding_overhead",
+    log_error_and_throw(__func__,
                         "Wrong number of arguments");
   }
 

package/src/cobhan.h

@@ -37,7 +37,7 @@ calculate_cobhan_buffer_allocation_size(size_t data_len_bytes) {
 __attribute__((always_inline)) inline void
 configure_cbuffer(char *cobhan_buffer, size_t length) {
   if (unlikely(verbose_flag)) {
-    debug_log("configure_cbuffer", "configure_cbuffer(" +
+    debug_log(__func__, "configure_cbuffer(" +
                                        format_ptr(cobhan_buffer) + ", " +
                                        std::to_string(length) + ")");
   }
@@ -48,22 +48,9 @@ configure_cbuffer(char *cobhan_buffer, size_t length) {
 
   // Write canary values
   char *data_ptr = cbuffer_data_ptr(cobhan_buffer);
-#ifdef LOG_CANARY_WRITES
-  if (unlikely(verbose_flag)) {
-    debug_log("configure_cbuffer",
-              "Writing first canary at " + format_ptr(data_ptr + length + 1));
-  }
-#endif
 
   // First canary value is a int32_t 0 which gives us four NULLs
   *((int32_t *)(data_ptr + length + 1)) = 0;
-#ifdef LOG_CANARY_WRITES
-  if (unlikely(verbose_flag)) {
-    debug_log("configure_cbuffer",
-              "Writing second canary at " +
-                  format_ptr(data_ptr + length + 1 + sizeof(int32_t)));
-  }
-#endif
 
   // Second canary value is a int32_t 0xdeadbeef
   *((int32_t *)(data_ptr + length + 1 + sizeof(int32_t))) = canary_constant;
@@ -80,7 +67,7 @@ __attribute__((always_inline)) inline bool check_canary_ptr(char *canary_ptr) {
   if (zero_value != 0) {
     std::string error_msg =
         "Canary check failed: " + std::to_string(zero_value) + " != 0";
-    error_log("canary_check_cbuffer", error_msg);
+    error_log(__func__, error_msg);
     return false;
   }
   int32_t canary_value = *((int32_t *)(canary_ptr + sizeof(int32_t)));
@@ -88,7 +75,7 @@ __attribute__((always_inline)) inline bool check_canary_ptr(char *canary_ptr) {
     std::string error_msg =
         "Canary check failed: " + std::to_string(canary_value) +
         " != " + std::to_string(canary_constant);
-    error_log("canary_check_cbuffer", error_msg);
+    error_log(__func__, error_msg);
     return false;
   }
   return true;
@@ -98,12 +85,10 @@ __attribute__((always_inline)) inline std::unique_ptr<char[]>
 heap_allocate_cbuffer(const char *variable_name, size_t size_bytes) {
   size_t cobhan_buffer_allocation_size =
       calculate_cobhan_buffer_allocation_size(size_bytes);
+
   if (unlikely(verbose_flag)) {
-    std::string log_msg =
-        "heap_allocate_cbuffer(" + std::to_string(size_bytes) +
-        ") (heap) cobhan_buffer_allocation_size: " +
-        std::to_string(cobhan_buffer_allocation_size) + " for " + variable_name;
-    debug_log("allocate_cbuffer", log_msg);
+    debug_log_new(__func__, variable_name,
+                  cobhan_buffer_allocation_size);
   }
 
   char *cobhan_buffer = new (std::nothrow) char[cobhan_buffer_allocation_size];
@@ -111,7 +96,7 @@ heap_allocate_cbuffer(const char *variable_name, size_t size_bytes) {
     std::string error_msg = "new[" +
                             std::to_string(cobhan_buffer_allocation_size) +
                             "] returned null";
-    error_log("allocate_cbuffer", error_msg);
+    error_log(__func__, error_msg);
     return nullptr;
   }
   std::unique_ptr<char[]> cobhan_buffer_unique_ptr(cobhan_buffer);
@@ -120,7 +105,7 @@ heap_allocate_cbuffer(const char *variable_name, size_t size_bytes) {
 }
 
 #define ALLOCATE_CBUFFER_UNIQUE_PTR(cobhan_buffer, buffer_size, unique_ptr,    \
-                                    function_name)                             \
+                                    max_stack_alloc_size, function_name)       \
   do {                                                                         \
     if (buffer_size < max_stack_alloc_size) {                                  \
       /* If the buffer is small enough, allocate it on the stack */            \
@@ -142,9 +127,11 @@ heap_allocate_cbuffer(const char *variable_name, size_t size_bytes) {
     }                                                                          \
   } while (0);
 
-#define ALLOCATE_CBUFFER(cobhan_buffer, buffer_size, function_name)            \
+#define ALLOCATE_CBUFFER(cobhan_buffer, buffer_size, max_stack_alloc_size,     \
+                         function_name)                                        \
   std::unique_ptr<char[]> cobhan_buffer##_unique_ptr;                          \
   ALLOCATE_CBUFFER_UNIQUE_PTR(cobhan_buffer, buffer_size,                      \
-                              cobhan_buffer##_unique_ptr, function_name);
+                              cobhan_buffer##_unique_ptr,                      \
+                              max_stack_alloc_size, function_name);
 
 #endif

package/src/cobhan_napi_interop.h

@@ -6,12 +6,6 @@
 #include <napi.h>
 #include <string>
 
-extern size_t est_intermediate_key_overhead;
-
-const size_t est_encryption_overhead = 48;
-const size_t est_envelope_overhead = 185;
-const double base64_overhead = 1.34;
-
 std::string napi_status_to_string(napi_status status) {
   switch (status) {
   case napi_ok:
@@ -63,28 +57,6 @@ std::string napi_status_to_string(napi_status status) {
   }
 }
 
-__attribute__((always_inline)) inline size_t
-estimate_asherah_output_size_bytes(size_t data_byte_len,
-                                   size_t partition_byte_len) {
-  // Add one rather than using std::ceil to round up
-  double est_data_byte_len =
-      (double(data_byte_len + est_encryption_overhead) * base64_overhead) + 1;
-
-  size_t asherah_output_size_bytes =
-      size_t(est_envelope_overhead + est_intermediate_key_overhead +
-             partition_byte_len + est_data_byte_len);
-  if (unlikely(verbose_flag)) {
-    std::string log_msg =
-        "estimate_asherah_output_size(" + std::to_string(data_byte_len) + ", " +
-        std::to_string(partition_byte_len) +
-        ") est_data_byte_len: " + std::to_string(est_data_byte_len) +
-        " asherah_output_size_bytes: " +
-        std::to_string(asherah_output_size_bytes);
-    debug_log("estimate_asherah_output_size", log_msg);
-  }
-  return asherah_output_size_bytes;
-}
-
 __attribute__((always_inline)) inline size_t
 nstring_utf8_byte_length(Napi::Env &env, Napi::String &str) {
   napi_status status;
@@ -92,7 +64,7 @@ nstring_utf8_byte_length(Napi::Env &env, Napi::String &str) {
 
   status = napi_get_value_string_utf8(env, str, nullptr, 0, &utf8_length);
   if (unlikely(status != napi_ok)) {
-    error_log("nstring_utf8_length",
+    error_log(__func__,
               "napi_get_value_string_utf8 length check failed: " +
                   napi_status_to_string(status));
     return (size_t)(-1);
@@ -104,21 +76,21 @@ nstring_utf8_byte_length(Napi::Env &env, Napi::String &str) {
 __attribute__((always_inline)) inline char *
 copy_nstring_to_cbuffer(Napi::Env &env, Napi::String &str,
                         size_t str_utf8_byte_length, char *cobhan_buffer,
-                        size_t *byte_length = nullptr) {
+                        size_t *byte_length) {
 
   size_t cobhan_buffer_size_bytes = cbuffer_byte_length(cobhan_buffer);
   if (unlikely(cobhan_buffer_size_bytes <= 0)) {
-    error_log("copy_nstring_to_cbuffer", "Invalid cobhan buffer byte length");
+    error_log(__func__, "Invalid cobhan buffer byte length");
     return nullptr;
   }
 
   if (cobhan_buffer_size_bytes < str_utf8_byte_length) {
-    error_log("copy_nstring_to_cbuffer", "String too large for cobhan buffer");
+    error_log(__func__, "String too large for cobhan buffer");
     return nullptr;
   }
 
   if (unlikely(verbose_flag)) {
-    debug_log("copy_nstring_to_cbuffer",
+    debug_log(__func__,
               "Copying " + std::to_string(str_utf8_byte_length) + " bytes to " +
                   format_ptr(cbuffer_data_ptr(cobhan_buffer)) + " - " +
                   format_ptr((cbuffer_data_ptr(cobhan_buffer) +
@@ -133,14 +105,14 @@ copy_nstring_to_cbuffer(Napi::Env &env, Napi::String &str,
   status = napi_get_value_string_utf8(env, str, cbuffer_data_ptr(cobhan_buffer),
                                       str_utf8_byte_length + 1, &copied_bytes);
   if (unlikely(status != napi_ok)) {
-    error_log("copy_nstring_to_cbuffer",
+    error_log(__func__,
               "Napi utf8 string conversion failure: " +
                   napi_status_to_string(status));
     return nullptr;
   }
 
   if (unlikely(copied_bytes != str_utf8_byte_length)) {
-    error_log("copy_nstring_to_cbuffer",
+    error_log(__func__,
               "Did not copy expected number of bytes " +
                   std::to_string(str_utf8_byte_length) + " copied " +
                   std::to_string(copied_bytes));
@@ -149,8 +121,7 @@ copy_nstring_to_cbuffer(Napi::Env &env, Napi::String &str,
 
   configure_cbuffer(cobhan_buffer, copied_bytes);
 
-  if (byte_length != nullptr)
-    *byte_length = copied_bytes;
+  *byte_length = copied_bytes;
   return cobhan_buffer;
 }
 
@@ -160,7 +131,7 @@ cbuffer_to_nstring(Napi::Env &env, char *cobhan_buffer) {
 
   int32_t cobhan_buffer_size_bytes = cbuffer_byte_length(cobhan_buffer);
   if (cobhan_buffer_size_bytes <= 0) {
-    log_error_and_throw("cbuffer_to_nstring",
+    log_error_and_throw(__func__,
                         "Invalid cobhan buffer byte length");
   }
 
@@ -169,7 +140,7 @@ cbuffer_to_nstring(Napi::Env &env, char *cobhan_buffer) {
       env, cbuffer_data_ptr(cobhan_buffer), cobhan_buffer_size_bytes, &output);
 
   if (unlikely(status != napi_ok)) {
-    log_error_and_throw("cbuffer_to_nstring",
+    log_error_and_throw(__func__,
                         "napi_create_string_utf8 failed: " +
                             napi_status_to_string(status));
   }
@@ -181,18 +152,7 @@ __attribute__((always_inline)) inline Napi::Buffer<unsigned char>
 cbuffer_to_nbuffer(Napi::Env &env, char *cobhan_buffer) {
   int32_t cobhan_buffer_byte_length = cbuffer_byte_length(cobhan_buffer);
   if (unlikely(cobhan_buffer_byte_length <= 0)) {
-    log_error_and_throw("cbuffer_to_nbuffer",
-                        "Invalid cobhan buffer byte length");
-  }
-
-  if (unlikely(verbose_flag)) {
-    debug_log("cbuffer_to_nbuffer",
-              "cbuffer_byte_length: " +
-                  std::to_string(cobhan_buffer_byte_length));
-  }
-
-  if (unlikely(cobhan_buffer_byte_length <= 0)) {
-    log_error_and_throw("cbuffer_to_nbuffer",
+    log_error_and_throw(__func__,
                         "Invalid cobhan buffer byte length");
   }
 
@@ -200,9 +160,9 @@ cbuffer_to_nbuffer(Napi::Env &env, char *cobhan_buffer) {
       env, (const unsigned char *)cbuffer_data_ptr(cobhan_buffer),
       cobhan_buffer_byte_length);
 
-  if (unlikely(verbose_flag)) {
-    debug_log("cbuffer_to_nbuffer",
-              "nbuffer.ByteLength(): " + std::to_string(nbuffer.ByteLength()));
+  if (unlikely(nbuffer.ByteLength() != (size_t)cobhan_buffer_byte_length)) {
+    log_error_and_throw(__func__,
+                        "Failed to copy cobhan buffer to napi buffer");
   }
 
   return nbuffer;
@@ -214,16 +174,25 @@ copy_nbuffer_to_cbuffer(Napi::Env &env, Napi::Buffer<unsigned char> &nbuffer,
 
   int32_t cobhan_buffer_size_bytes = cbuffer_byte_length(cobhan_buffer);
   if (unlikely(cobhan_buffer_size_bytes <= 0)) {
-    error_log("copy_nbuffer_to_cbuffer", "Invalid cobhan buffer byte length");
+    error_log(__func__, "Invalid cobhan buffer byte length");
     return nullptr;
   }
 
   size_t nbuffer_byte_length = nbuffer.ByteLength();
   if (nbuffer_byte_length > INT32_MAX ||
       cobhan_buffer_size_bytes < (int32_t)nbuffer_byte_length) {
-    error_log("copy_nbuffer_to_cbuffer", "Buffer too large for cobhan buffer");
+    error_log(__func__, "Buffer too large for cobhan buffer");
     return nullptr;
   }
+
+  if (unlikely(verbose_flag)) {
+    debug_log(__func__,
+              "Copying " + std::to_string(nbuffer_byte_length) + " bytes to " +
+                  format_ptr(cbuffer_data_ptr(cobhan_buffer)) + " - " +
+                  format_ptr((cbuffer_data_ptr(cobhan_buffer) +
+                              nbuffer_byte_length)));
+  }
+
   memcpy(cbuffer_data_ptr(cobhan_buffer), nbuffer.Data(), nbuffer_byte_length);
   configure_cbuffer(cobhan_buffer, nbuffer_byte_length);
   return cobhan_buffer;
@@ -232,7 +201,7 @@ copy_nbuffer_to_cbuffer(Napi::Env &env, Napi::Buffer<unsigned char> &nbuffer,
 // These are macros due to the use of alloca()
 
 #define NAPI_STRING_TO_CBUFFER(env, napi_string, cobhan_buffer, bytes_copied,  \
-                               function_name)                                  \
+                               max_stack_alloc_size, function_name)            \
   std::unique_ptr<char[]> napi_string##_unique_ptr;                            \
   do {                                                                         \
     /* Determine size */                                                       \
@@ -247,7 +216,8 @@ copy_nbuffer_to_cbuffer(Napi::Env &env, Napi::Buffer<unsigned char> &nbuffer,
     }                                                                          \
     /* Allocate */                                                             \
     ALLOCATE_CBUFFER_UNIQUE_PTR(cobhan_buffer, napi_string##_utf8_byte_length, \
-                                napi_string##_unique_ptr, function_name);      \
+                                napi_string##_unique_ptr,                      \
+                                max_stack_alloc_size, function_name);          \
     /* Copy */                                                                 \
     cobhan_buffer = copy_nstring_to_cbuffer(env, napi_string,                  \
                                             napi_string##_utf8_byte_length,    \
@@ -259,7 +229,7 @@ copy_nbuffer_to_cbuffer(Napi::Env &env, Napi::Buffer<unsigned char> &nbuffer,
   } while (0);
 
 #define NAPI_BUFFER_TO_CBUFFER(env, napi_buffer, cobhan_buffer, bytes_copied,  \
-                               function_name)                                  \
+                               max_stack_alloc_size, function_name)            \
   std::unique_ptr<char[]> napi_buffer##_unique_ptr;                            \
   do {                                                                         \
     /* Determine size */                                                       \
@@ -269,7 +239,8 @@ copy_nbuffer_to_cbuffer(Napi::Env &env, Napi::Buffer<unsigned char> &nbuffer,
     }                                                                          \
     /* Allocate */                                                             \
     ALLOCATE_CBUFFER_UNIQUE_PTR(cobhan_buffer, napi_buffer##_byte_length,      \
-                                napi_buffer##_unique_ptr, function_name);      \
+                                napi_buffer##_unique_ptr,                      \
+                                max_stack_alloc_size, function_name);          \
     /* Copy */                                                                 \
     cobhan_buffer = copy_nbuffer_to_cbuffer(env, napi_buffer, cobhan_buffer);  \
     if (unlikely(cobhan_buffer == nullptr)) {                                  \

package/src/logging.h

@@ -38,6 +38,16 @@ debug_log_alloca(const char *function_name, const char *variable_name,
   }
 }
 
+__attribute__((always_inline)) inline void
+debug_log_new(const char *function_name, const char *variable_name,
+              size_t length) {
+  if (unlikely(verbose_flag)) {
+    std::cerr << "asherah-node: [DEBUG] " << function_name << ": Calling new["
+              << length << "] (heap) for " << variable_name << std::endl
+              << std::flush;
+  }
+}
+
 __attribute__((always_inline)) inline void error_log(const char *function_name,
                                                      const char *message) {
   if (unlikely(verbose_flag)) {

package/src/cobhan_napi_interop.cc

@@ -1,2 +0,0 @@
-#include <stddef.h>
-__attribute__((used)) size_t est_intermediate_key_overhead = 0;