Bug #81491 [Opn]: Incorrectly using libsodium for argon2 hashing

Edit report at https://bugs.php.net/bug.php?id=81491&edit=1 ID: 81491 User updated by: dpock at liquidweb dot com Reported by: dpock at liquidweb dot com Summary: Incorrectly using libsodium for argon2 hashing Status: Open Type: Bug Package: *Compile Issues PHP Version: 8.1Git-2021-09-30 (Git) Block user comment: N Private report: N New Comment: After further investigation I found the root cause to be that HAVE_ARGON2LIB was not being defined when the argon2 config flag is set. I've updated the patch in the PR to reflect this here: https://github.com/php/php-src/pull/7538 Previous Comments: ------------------------------------------------------------------------ [2021-09-30 17:32:52] dpock at liquidweb dot com Description: ------------ It appears that PHP-8.1 branch is no longer compiling libargon2 support correctly. The effect of this vary depending on if libsodium is present too. When libsodium is present, the issue is observed are: * Cannot use threads option when hashing with argon2, * PASSWORD_ARGON2_PROVIDER reports as 'sodium' When libsodium is not present, the issue observed is: * Error stating argon2 is not supported --- Note: Left OS blank as this affects my Mac, as well as linux based GitHub runners. --- I have 'confirmed' this bug by compiling PHP 8.0 and PHP 8.1 using the same settings. When using PHP 8.0 w/o sodium I can still use argon2, and similarly the threads option works when hashing. I've also made a "PR" that confirms PHP 8.1 works when I revert a commit to load argon2 via pkg-config rather than config flags. This PR is here: https://github.com/php/php-src/pull/7538 Test script: --------------- This bug was initially found by Dries Vints via failing CI tests here: https://github.com/laravel/framework/runs/3599702797#step:8:126 He was observing the issue with "threads" value greater than 1 causing an error. This is behavior you'd only expect if PHP were compiled with ONLY libsodium. However the GitHub runner's in use should be compiling with BOTH libsodium and libargon2. We can be confident they are compiling in this manner as PHP 8.0 runners (from the same source) are working correctly. Expected result: ---------------- PHP should know it has access to both libsodium and libargon2 when compiled in this manner. As such, when PHP compiles with both libs, we should see: * PASSWORD_ARGON2_PROVIDER should be 'standard', and * password_hash should accept threads > 1 when using argon2. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81491&edit=1