Re: com php-src: Use /dev/urandom as the default mcrypt_create_iv() source: NEWS UPGRADING ext/mcrypt/mcrypt.c

This is good enough. I'll close PR. Thank you, Nikita. -- Yasuo Ohgaki yohgaki@ohgaki.net On Tue, Mar 11, 2014 at 10:06 PM, Nikita Popov <nikic@php.net> wrote: > Commit: fd5fbba98cdc800c9f25b6213ed72bd24792ecde > Author: Nikita Popov <nikic@php.net> Tue, 11 Mar 2014 13:42:16 > +0100 > Parents: a117e6b93740e1c05ba8926c3f8938a9ad0cb631 > Branches: PHP-5.6 master > > Link: > > http://git.php.net/?p=php-src.git;a=commitdiff;h=fd5fbba98cdc800c9f25b6213ed72bd24792ecde > > Log: > Use /dev/urandom as the default mcrypt_create_iv() source > > Also fixes the ARGINFO for mcrypt_create_iv() and adds missing > UPGRADING entries. > > Changed paths: > M NEWS > M UPGRADING > M ext/mcrypt/mcrypt.c > > > Diff: > diff --git a/NEWS b/NEWS > index 915120c..7b664cf 100644 > --- a/NEWS > +++ b/NEWS > @@ -23,7 +23,7 @@ PHP > NEWS > CVE-2013-7327). (Tomas Hoger, Remi). > > - Hash: > - . Fixed buf #66698 (Missing FNV1a32 and FNV1a64 hash functions). > + . Fixed bug #66698 (Missing FNV1a32 and FNV1a64 hash functions). > (Michael M Slusarz). > > - Mail: > @@ -33,6 +33,7 @@ PHP > NEWS > . No longer allow invalid key sizes, invalid IV sizes or missing > required IV > in mcrypt_encrypt, mcrypt_decrypt and the deprecated mode functions. > (Nikita) > + . Use /dev/urandom as the default source for mcrypt_create_iv(). > (Nikita) > > - MySQLi: > . Fixed bug #66762 (Segfault in mysqli_stmt::bind_result() when link > closed) > diff --git a/UPGRADING b/UPGRADING > index 40d30fd..4c05ee4 100755 > --- a/UPGRADING > +++ b/UPGRADING > @@ -41,6 +41,11 @@ PHP 5.6 UPGRADE NOTES > context options, so most users should be unaffected by this transparent > security enhancement. (https://wiki.php.net/rfc/tls-peer-verification) > > +- Mcrypt: > + The mcrypt_encrypt(), mcrypt_decrypt() and mcrypt_{MODE}() functions no > + longer accept keys or IVs with incorrect sizes. Furthermore an IV is now > + required if the used block cipher mode requires it. > + > ======================================== > 2. New Features > ======================================== > @@ -159,6 +164,10 @@ PHP 5.6 UPGRADE NOTES > crypt() will now raise an E_NOTICE error if the salt parameter is > omitted. > See: https://wiki.php.net/rfc/crypt_function_salt > > +- Mcrypt: > + The $source parameter of mcrypt_create_iv() now defaults to > + MCRYPT_DEV_URANDOM instead of MCRYPT_DEV_RANDOM. > + > - XMLReader: > XMLReader::getAttributeNs and XMLReader::getAttributeNo now return NULL > if > the attribute could not be found, just like XMLReader::getAttribute. > diff --git a/ext/mcrypt/mcrypt.c b/ext/mcrypt/mcrypt.c > index 70a458d..5fc632b 100644 > --- a/ext/mcrypt/mcrypt.c > +++ b/ext/mcrypt/mcrypt.c > @@ -232,7 +232,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mcrypt_ofb, 0, 0, 5) > ZEND_ARG_INFO(0, iv) > ZEND_END_ARG_INFO() > > -ZEND_BEGIN_ARG_INFO_EX(arginfo_mcrypt_create_iv, 0, 0, 2) > +ZEND_BEGIN_ARG_INFO_EX(arginfo_mcrypt_create_iv, 0, 0, 1) > ZEND_ARG_INFO(0, size) > ZEND_ARG_INFO(0, source) > ZEND_END_ARG_INFO() > @@ -313,6 +313,12 @@ ZEND_GET_MODULE(mcrypt) > #define MCRYPT_ENCRYPT 0 > #define MCRYPT_DECRYPT 1 > > +typedef enum { > + RANDOM = 0, > + URANDOM, > + RAND > +} iv_source; > + > #define MCRYPT_GET_INI > \ > cipher_dir_string = MCG(algorithms_dir); > \ > module_dir_string = MCG(modes_dir); > @@ -384,9 +390,9 @@ static PHP_MINIT_FUNCTION(mcrypt) /* {{{ */ > REGISTER_LONG_CONSTANT("MCRYPT_DECRYPT", 1, CONST_PERSISTENT); > > /* sources for mcrypt_create_iv */ > - REGISTER_LONG_CONSTANT("MCRYPT_DEV_RANDOM", 0, CONST_PERSISTENT); > - REGISTER_LONG_CONSTANT("MCRYPT_DEV_URANDOM", 1, CONST_PERSISTENT); > - REGISTER_LONG_CONSTANT("MCRYPT_RAND", 2, CONST_PERSISTENT); > + REGISTER_LONG_CONSTANT("MCRYPT_DEV_RANDOM", RANDOM, > CONST_PERSISTENT); > + REGISTER_LONG_CONSTANT("MCRYPT_DEV_URANDOM", URANDOM, > CONST_PERSISTENT); > + REGISTER_LONG_CONSTANT("MCRYPT_RAND", RAND, CONST_PERSISTENT); > > /* ciphers */ > MCRYPT_ENTRY2_2_4(3DES, "tripledes"); > @@ -495,12 +501,6 @@ PHP_MINFO_FUNCTION(mcrypt) /* {{{ */ > } > /* }}} */ > > -typedef enum { > - RANDOM = 0, > - URANDOM, > - RAND > -} iv_source; > - > /* {{{ proto resource mcrypt_module_open(string cipher, string > cipher_directory, string mode, string mode_directory) > Opens the module of the algorithm and the mode to be used */ > PHP_FUNCTION(mcrypt_module_open) > @@ -1393,7 +1393,7 @@ PHP_FUNCTION(mcrypt_ofb) > PHP_FUNCTION(mcrypt_create_iv) > { > char *iv; > - long source = RANDOM; > + long source = URANDOM; > long size; > int n = 0; > > > -- > PHP CVS Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php > >