From f401767c04a24677e11a3b6c4e3590e8b2e06e88 Mon Sep 17 00:00:00 2001
From: Andrey Andreev <narf@devilix.net>
Date: Wed, 5 Feb 2014 18:51:15 +0200
Subject: CI_Encryption: More MCrypt/OpenSSL compatibility and get rid of the
 MCRYPT_MODE_* constants

---
 system/libraries/Encryption.php | 86 +++++++++++++++++++++++++++++++++--------
 1 file changed, 69 insertions(+), 17 deletions(-)

(limited to 'system/libraries/Encryption.php')

diff --git a/system/libraries/Encryption.php b/system/libraries/Encryption.php
index d1aed7399..51e390c91 100644
--- a/system/libraries/Encryption.php
+++ b/system/libraries/Encryption.php
@@ -81,6 +81,35 @@ class CI_Encryption {
 	 */
 	protected $_drivers = array();
 
+	/**
+	 * List of available modes
+	 *
+	 * @var	array
+	 */
+	protected $_modes = array(
+		'mcrypt' => array(
+			'cbc' => 'cbc',
+			'ecb' => 'ecb',
+			'ofb' => 'nofb',
+			'ofb8' => 'ofb',
+			'cfb' => 'ncfb',
+			'cfb8' => 'cfb',
+			'ctr' => 'ctr',
+			'stream' => 'stream'
+		),
+		'openssl' => array(
+			'cbc' => 'cbc',
+			'ecb' => 'ecb',
+			'ofb' => 'ofb',
+			'cfb' => 'cfb',
+			'cfb8' => 'cfb8',
+			'ctr' => 'ctr',
+			'stream' => '',
+			'gcm' => 'gcm',
+			'xts' => 'xts'
+		)
+	);
+
 	/**
 	 * List of supported HMAC algorightms
 	 *
@@ -116,12 +145,6 @@ class CI_Encryption {
 		{
 			return show_error('Encryption: Unable to find an available encryption driver.');
 		}
-		// Our configuration validates against the existence of MCRYPT_MODE_* constants,
-		// but MCrypt supports CTR mode without actually having a constant for it, so ...
-		elseif ($this->_drivers['mcrypt'] && ! defined('MCRYPT_MODE_CTR'))
-		{
-			define('MCRYPT_MODE_CTR', 'ctr');
-		}
 
 		$this->initialize($params);
 
@@ -204,13 +227,14 @@ class CI_Encryption {
 
 		if ( ! empty($params['mode']))
 		{
-			if ( ! defined('MCRYPT_MODE_'.$params['mode']))
+			$params['mode'] = strtolower($params['mode']);
+			if ( ! isset($this->_modes['mcrypt'][$params['mode']]))
 			{
 				log_message('error', 'Encryption: MCrypt mode '.strtotupper($params['mode']).' is not available.');
 			}
 			else
 			{
-				$this->_mode = constant('MCRYPT_MODE_'.$params['mode']);
+				$this->_mode = $this->_modes['mcrypt'][$params['mode']];
 			}
 		}
 
@@ -254,13 +278,21 @@ class CI_Encryption {
 
 		if ( ! empty($params['mode']))
 		{
-			$this->_mode = strtolower($params['mode']);
+			$params['mode'] = strtolower($params['mode']);
+			if ( ! isset($this->_modes['openssl'][$params['mode']]))
+			{
+				log_message('error', 'Encryption: OpenSSL mode '.strtotupper($params['mode']).' is not available.');
+			}
+			else
+			{
+				$this->_mode = $this->_modes['openssl'][$params['mode']];
+			}
 		}
 
 		if (isset($this->_cipher, $this->_mode))
 		{
-			// OpenSSL methods aren't suffixed with '-stream' for this mode
-			$handle = ($this->_mode === 'stream')
+			// This is mostly for the stream mode, which doesn't get suffixed in OpenSSL
+			$handle = empty($this->_mode)
 				? $this->_cipher
 				: $this->_cipher.'-'.$this->_mode;
 
@@ -356,10 +388,13 @@ class CI_Encryption {
 		}
 
 		// Use PKCS#7 padding in order to ensure compatibility with OpenSSL
-		// and other implementations outside of PHP
-		$block_size = mcrypt_enc_get_block_size($params['handle']);
-		$pad = $block_size - (strlen($data) % $block_size);
-		$data .= str_repeat(chr($pad), $pad);
+		// and other implementations outside of PHP.
+		if (in_array(strtolower(mcrypt_enc_get_modes_name($params['handle'])), array('cbc', 'ecb'), TRUE))
+		{
+			$block_size = mcrypt_enc_get_block_size($params['handle']);
+			$pad = $block_size - (strlen($data) % $block_size);
+			$data .= str_repeat(chr($pad), $pad);
+		}
 
 		// Work-around for yet another strange behavior in MCrypt.
 		//
@@ -526,6 +561,11 @@ class CI_Encryption {
 		}
 
 		$data = mdecrypt_generic($params['handle'], $data);
+		// Remove PKCS#7 padding, if necessary
+		if (in_array(strtolower(mcrypt_enc_get_modes_name($params['handle'])), array('cbc', 'ecb'), TRUE))
+		{
+			$data = substr($data, 0, -ord($data[strlen($data)-1]));
+		}
 
 		mcrypt_generic_deinit($params['handle']);
 		if ($params['handle'] !== $this->_handle)
@@ -533,8 +573,7 @@ class CI_Encryption {
 			mcrypt_module_close($params['handle']);
 		}
 
-		// Remove PKCS#7 padding
-		return substr($data, 0, -ord($data[strlen($data)-1]));
+		return $data;
 	}
 
 	// --------------------------------------------------------------------
@@ -664,6 +703,19 @@ class CI_Encryption {
 			);
 		}
 
+		if (isset($params['mode']))
+		{
+			$params['mode'] = strtolower($params['mode']);
+			if ( ! isset($this->_modes[$this->_driver][$params['mode']]))
+			{
+				return FALSE;
+			}
+			else
+			{
+				$params['mode'] = $this->_modes[$this->_driver][$params['mode']];
+			}
+		}
+
 		$params = array(
 			'handle' => NULL,
 			'cipher' => isset($params['cipher']) ? $params['cipher'] : $this->_cipher,
-- 
cgit v1.2.3-24-g4f1b