Sessions and encrypted cookies problem

[eluser]Derek Jones[/eluser]
Thanks. This is what really convinces me that this is a bug with the compiled encryption library on the server, and not with CI's code.

Message: mcrypt_decrypt() [function.mcrypt-decrypt]: The IV parameter must be as long as the blocksize

Your IV is 32 characters, your block size is 32 characters so the error is not consistent with reality. Additionally, ECB mode shouldn't even be trying to use the IV, since only CBC, CFB, OFB, and stream modes use an IV to initialize the algorithm.

My recommendation would be to search the bug trackers of both libmcrypt and the server's OS distro vendor for potential known issues and/or patches. Alternatively, you might try recompiling PHP with an older version of libmcrypt, or try using an encryption mode other than ECB on this server and see if that works.

[eluser]Olf[/eluser]
Thank you for participating.

I also already are embracing the fact that once a library libmcrypt askance at my hosting. Wrote a letter to my hosting provider, but so far has disabled encryption.

Can I be in the future by CI to track the performance of the library at hosting?

And whether the situation would change if the rewrite function mcrypt_encode() under the AIP mcrypt_module_open()?

[eluser]Derek Jones[/eluser]

Can I be in the future by CI to track the performance of the library at hosting?

I'm sorry, Olf, I do not understand this question very well.

And whether the situation would change if the rewrite function mcrypt_encode() under the AIP mcrypt_module_open()?

You could try, but I think the first thing I would try is to use $this->encrypt->set_mode() with a different mcrypt mode so it doesn't use ECB. Keep in mind that if you're using encrypted sessions and autoloading sessions, you'll have to make sure this is set in the Encryption library before it's used.

[eluser]Sam Dark[/eluser]
Recently _g00d_ at Russian forums tried to disable mcrypt:

Code:

function CI_Encrypt()
   {
      $this->CI =& get_instance();
      //$this->_mcrypt_exists = ( ! function_exists('mcrypt_encrypt')) ? FALSE : TRUE;
                $this->_mcrypt_exists = FALSE;
      log_message('debug', "Encrypt Class Initialized");
   }

and it does not helped.

His config:

Code:

$config['encryption_key'] = "asd9f87asdfj09sd8fhsd8fa";
$config['sess_cookie_name']      = 'documents_session';
$config['sess_expiration']      = 7200;
$config['sess_encrypt_cookie']          = TRUE;
$config['sess_use_database']            = TRUE;
$config['sess_table_name']      = 'documents_sessions';
$config['sess_match_ip']      = FALSE;
$config['sess_match_useragent']         = TRUE;
$config['sess_time_to_update']       = 300;

$config['cookie_prefix']   = "";
$config['cookie_domain']   = "";
$config['cookie_path']      = "/";

$config['global_xss_filtering'] = TRUE;

Success session starting log:

Code:

DEBUG - 2009-02-18 14:35:06 --> Config Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Hooks Class Initialized
DEBUG - 2009-02-18 14:35:06 --> URI Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Router Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Output Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Input Class Initialized
DEBUG - 2009-02-18 14:35:06 --> XSS Filtering completed
DEBUG - 2009-02-18 14:35:06 --> Global POST and COOKIE data sanitized
DEBUG - 2009-02-18 14:35:06 --> Language Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Loader Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: url_helper
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: dknt_helper
DEBUG - 2009-02-18 14:35:06 --> Database Driver Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Session Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: string_helper
DEBUG - 2009-02-18 14:35:06 --> Encrypt Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Session garbage collection performed.
DEBUG - 2009-02-18 14:35:06 --> Session routines successfully run
DEBUG - 2009-02-18 14:35:06 --> Controller Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: form_helper
DEBUG - 2009-02-18 14:35:06 --> Helper loaded: html_helper
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> Model Class Initialized
DEBUG - 2009-02-18 14:35:06 --> File loaded: /var/www/localhost/htdocs/documents/system/application/views/upload_form.php
DEBUG - 2009-02-18 14:35:06 --> Final output sent to browser
DEBUG - 2009-02-18 14:35:06 --> Total execution time: 0.0737

Failure log (another server):

Code:

DEBUG - 2009-02-16 13:51:06 --> Config Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Hooks Class Initialized
DEBUG - 2009-02-16 13:51:06 --> URI Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Router Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Output Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Input Class Initialized
DEBUG - 2009-02-16 13:51:06 --> XSS Filtering completed
DEBUG - 2009-02-16 13:51:06 --> Global POST and COOKIE data sanitized
DEBUG - 2009-02-16 13:51:06 --> Language Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Loader Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: url_helper
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: dknt_helper
DEBUG - 2009-02-16 13:51:06 --> Database Driver Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Controller Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Session Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: string_helper
DEBUG - 2009-02-16 13:51:06 --> Encrypt Class Initialized
DEBUG - 2009-02-16 13:51:06 --> A session cookie was not found.
DEBUG - 2009-02-16 13:51:06 --> Session routines successfully run
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: form_helper
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: cookie_helper
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Model Class Initialized
DEBUG - 2009-02-16 13:51:06 --> Helper loaded: html_helper
DEBUG - 2009-02-16 13:51:06 --> File loaded: /var/www/localhost/htdocs/documents/system/application/views/upload_form.php
DEBUG - 2009-02-16 13:51:06 --> Final output sent to browser
DEBUG - 2009-02-16 13:51:06 --> Total execution time: 0.0709

[eluser]Sam Dark[/eluser]
DEBUG - 2009-02-16 13:51:06 --> A session cookie was not found. should mean something.

[eluser]Derek Jones[/eluser]
Sam, check the code, that means the cookie's not even found. Encryption's not in play there. Is the cookie being set? If not, why? Can you reproduce?

[eluser]Sam Dark[/eluser]
It's session lib, not a manual cookie setting. It's working at one server and not working at another exactly like the issue with IV parameter.

Could it be that if cookie is not found, it caused mcrypt to generate wrong IV and the entire issue is not about mcrypt?

It can be reproduced in one environment and can't in another.

[eluser]Derek Jones[/eluser]
I understand that it's the session library, but that error is logged when there's no session cookie available - it occurs before and is unrelated to encryption, and in fact when that check fails and that error is logged, Session:ess_read() immediately returns and the code which would attempt to decrypt the session cookie isn't even executed.

[eluser]Unknown[/eluser]
I had the same error, but in my situation everything worked good (without errors) until I had changed mbstring.func_overload in my php.ini from 0 to 2. Of course, I set it back to 0 and now CI works as before. Sorry for my English.

[eluser]Derek Jones[/eluser]
That sounds plausible, ginonly, since that takes over string handlers in a way that will likely break encoded data.