Comments (25)
from halite.
@Elbana Did you, perchance, install the PECL extension against an older version of libsodium then upgrade libsodium? If so, uninstall then reinstall the PECL extension, which was probably compiled against an older version.
from halite.
function_exists('\Sodium\crypto_box_seal') return false when it has leading slash but function_exists('Sodium\crypto_box_seal') it return true
That's... interesting. The leading slash just says "start from the global namespace". i.e.
namespace Foo\Sodium {
function crypto_box_seal() {
// backdoor!
}
}
namepsace Foo {
function bar() {
$x = Sodium\crypto_box_seal(/* ... */);
}
function baz() {
$x = \Sodium\crypto_box_seal(/* ... */);
}
}
The only difference between the two is that baz()
is explicit, but bar()
will call Foo\Sodium\crypto_box_seal()
first. Assuming no maliciously named function (in a namespace) exists, they should both resolve to the same destination.
from halite.
the function is working when i comment the check for the function exist but for some reason function_exists return false always , is there anything we can do around this check ?
from halite.
I don't know. That sounds like a PHP bug. What version of PHP are you running?
from halite.
I am using 5.6
from halite.
I cannot reproduce (5.6, 7.0)
BTW, try to use
'\\Sodium\\crypto_box_seal'
instead of
'\Sodium\crypto_box_seal'
from halite.
Hi remicollet, it is already used inside Asymmetric\Crypto::seal with double slashes I am just calling seal method but getting this error
from halite.
can we use is_callable() instead of function_existes() ?
from halite.
@Elbana Which PHP version are you using so that I can try to reproduce?
from halite.
Hi @clayfreeman I am using 5.6.23 thanks.
from halite.
@Elbana Could you run \ParagonIE\Halite::isLibsodiumSetupCorrectly(true);
and paste the output as well?
from halite.
That method didn't exist in the version 1 branch, which is the only one that supported PHP 5.
function isLibsodiumSetupCorrectly($echo = false)
{
// Require libsodium 1.0.9
$major = \Sodium\library_version_major();
$minor = \Sodium\library_version_minor();
if ($major < 9 || ($major === 9 && $minor < 2)) {
if ($echo) {
echo 'Halite needs libsodium 1.0.9 or higher. You have: ',
\Sodium\version_string(), "\n";
}
return false;
}
return true;
}
from halite.
root@ubuntu:~/project# php main.php
PHP CLI 5.6.11-1ubuntu3.4
Check if function exists with global namespace: true
Check if function exists without global namespace: true
<?php
require_once(__DIR__.'/vendor/autoload.php');
echo "PHP CLI ".phpversion()."\n";
echo "Check if function exists with global namespace: ";
echo var_export(function_exists('\\Sodium\\crypto_box_seal'), true)."\n";
echo "Check if function exists without global namespace: ";
echo var_export(function_exists('Sodium\\crypto_box_seal'), true)."\n";
Unable to reproduce on Ubuntu 15.10 with PHP 5.6.11 using CLI, latest tag on libsodium's repo, and latest version of PECL libsodium.
from halite.
Thanks guys for your help really appreciate it
isLibsodiumSetupCorrectly() true
var_dump([
\Sodium\library_version_major(),
\Sodium\library_version_minor(),
\Sodium\version_string()
]);
array (size=3)
0 => int 9
1 => int 2
2 => string '1.0.10' (length=6)
PHP CLI 5.6.23-1+deprecated+dontuse+deb.sury.org~trusty+1
Check if function exists with global namespace: false
Check if function exists without global namespace: true
from halite.
@Elbana It appears as though you're trying to use the PHP 7 branch with PHP 5, at least from what @paragonie-scott said earlier in this thread:
That method didn't exist in the version 1 branch, which is the only one that supported PHP 5.
Make sure that you're using at most v1.5.0 of Halite; anything newer supports PHP 7 only.
from halite.
Hi @clayfreeman I am using Halite v1.5.0 I just copied the method to my files.
from halite.
uninstall ok: channel://pecl.php.net/libsodium-1.0.6
install ok: channel://pecl.php.net/libsodium-1.0.6
still the same
from halite.
- Uninstall PECL libsodium.
- Uninstall libsodium.
- Compile libsodium stable (1.0.10) from source.
- Install PECL libsodium.
EDIT: Sorry if that seemed terse; I typed that this morning before a meeting. If these steps don't work, then there's likely a weird quirk with your copy of PHP.
from halite.
I have the same issue and apparently it's related to the suhosin module... I don't know why for the moment however.
# cat /rginstall/Test.php
<?php
require_once(__DIR__.'/vendor/autoload.php');
echo "PHP CLI ".phpversion()."\n";
if (extension_loaded('suhosin')) {
echo "With suhosin enable\n";
} else {
echo "With suhosin disable\n";
}
echo "Check if function exists with global namespace: ";
echo var_export(function_exists('\\Sodium\\crypto_box_seal'), true)."\n";
echo "Check if function exists without global namespace: ";
echo var_export(function_exists('Sodium\\crypto_box_seal'), true)."\n";
//var_dump(get_extension_funcs('libsodium'));
The output is:
PHP CLI 5.6.21-1+donate.sury.org~trusty+4
With suhosin disable
Check if function exists with global namespace: true
Check if function exists without global namespace: true
PHP CLI 5.6.21-1+donate.sury.org~trusty+4
With suhosin enable
Check if function exists with global namespace: false
Check if function exists without global namespace: true
from halite.
Oh, interesting!
from halite.
Any idea how to fix it? Couldn't we use is_callable() instead of function_exists() maybe ? I'm not sure this will be patch on the suhosin side soon and I think a lot of people use both suhosin and halite...
from halite.
is_callable()
works in Suhosin as expected? If so, I'll release a patch for 1.x and 2.x that makes this change.
from halite.
Proposed changes:
If you could please confirm that this fixes the problem for you, I'll tag & sign new releases.
from halite.
@paragonie-scott This does fix the issue for me thanks guys for looking into this and thanks @Vincent-- for pointing the issue.
from halite.
Related Issues (20)
- getKeyDataFromString hash validation fail HOT 8
- Invalid message authentication code HOT 1
- export/import string Asymmetric-Key Encryption keypair? HOT 3
- password protected secretKey? And: change password without changing publicKey? HOT 2
- Switch to ChaCha20 for symmetric encryption HOT 6
- What if you already have a RSA 2048 key and you want to use it instead of generating a new key? HOT 2
- Use EC brainpoolP256r1 key for encryption/decryption HOT 6
- Asymmetric authenticated file encryption/decryption HOT 3
- Create a different key pr environment HOT 3
- PHP 8.0 < 8.1 -- real slow due to XChaCha20 polyfill HOT 8
- halite for Python HOT 2
- php opcache.preload won't work because of conditional functions HOT 2
- Decrypting a file to output buffer fails HOT 1
- 'Expected hexadecimal character' exception from $cookie->fetch() after upgrade
- Is there a reason why the result of Symmetric::encrypt() always starts with 'MUIFA'? HOT 1
- Make use of PHP 8.2's #[\SensitiveParameter] to improve security
- Invalid message authentication code HOT 1
- invalid version tag when migrating from halite 4.8.0 to 5.1.0
- Uncaught PHP Exception RangeException: \"Expected hexadecimal character\ on symfony HOT 1
- Question: Can this library be used to decrypt Web Push Notifications from Mastodon?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from halite.