[php-src] Issue #10208: openssl with aes not thread safe!
| From: | mokraemer | Date: | Mon, 02 Jan 2023 14:09:30 +0000 |
| Subject: | [php-src] Issue #10208: openssl with aes not thread safe! | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-243312@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/10208
Author: mokraemer
### Description
Running php-fpm with multiple instances. Due to the changes of openssl 3, I changed the encryption
from blowfish to "aes-128-gcm". If this is run in a frequent environment (encrypt session
data), it fails with different errors of files unable to open, ...
The following code:
```php
$data='test';
$key=substr('abcdefghijklmnopqrstuvwxyz',0,16);
$iv=random_bytes((int) openssl_cipher_iv_length('aes-128-gcm'));
$tag='';
$ret = (string) openssl_encrypt($data, 'aes-128-gcm',$key, OPENSSL_RAW_DATA, $iv, $tag);
if(($err = openssl_error_string())){
echo $err;
}else{
echo 'ok';
}
<?php
```
Resulted in this output:
```
error:2406F079:random number generator:RAND_load_file:Cannot open file
error:24070079:random number generator:RAND_write_file:Cannot open file
error:0909006C:PEM routines:get_name:no start line
error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
```
But I expected this output instead:
```
ok
```
This only happens, if executed in frequent used environment - in php-fpm. If relevant: opcache is
used.
### PHP Version
PHP 8.1.13
### Operating System
Mageia 8 (Linux)