lots of updates to stream filter + expanded unit tests

Author: terrafrost

lib/mcrypt.php

@@ -853,6 +853,22 @@ class phpseclib_mcrypt_filter extends php_user_filter
          */
         private $op;
 
+        /**
+         * Buffer for ECB / CBC
+         *
+         * @var string
+         * @access private
+         */
+        private $buffer = '';
+
+        /**
+         * Cipher block length
+         *
+         * @var int
+         * @access private
+         */
+        private $block_length = '';
+
         /**
          * Called when applying the filter
          *
@@ -869,16 +885,28 @@ class phpseclib_mcrypt_filter extends php_user_filter
          */
         function filter($in, $out, &$consumed, $closing)
         {
+            $newlen = 0;
+            $block_mode = $this->cipher->mode == Base::MODE_CBC || $this->cipher->mode == Base::MODE_ECB;
             while ($bucket = stream_bucket_make_writeable($in)) {
-                $bucket->data = $this->opt ?
+                if ($block_mode) {
+                    $bucket->data = $this->buffer . $bucket->data;
+                    $extra = strlen($bucket->data) % $this->block_length;
+                    if ($extra) {
+                        $this->buffer = substr($bucket->data, -$extra);
+                        $bucket->data = substr($bucket->data, 0, -$extra);
+                    }
+                }
+
+                $bucket->data = $this->op ?
                     $this->cipher->encrypt($bucket->data) :
                     $this->cipher->decrypt($bucket->data);
+                $newlen+= strlen($bucket->data);
                 $consumed+= $bucket->datalen;
+
                 stream_bucket_append($out, $bucket);
             }
 
-            // can also return PSFS_FEED_ME and PSFS_ERR_FATAL
-            return PSFS_PASS_ON;
+            return $block_mode && $newlen < $this->block_length ? PSFS_FEED_ME : PSFS_PASS_ON;
         }
 
         /**
@@ -910,7 +938,7 @@ function onCreate()
                 substr($this->filtername, 10) :
                 $this->filtername;
             $parts = explode('.', $filtername);
-            if ($parts != 2) {
+            if (count($parts) != 2) {
                 user_error('stream_filter_append(): Could not open encryption module');
                 return false;
             }
@@ -929,11 +957,13 @@ function onCreate()
                 return false;
             }
 
-            $cipher->setKey($key);
-            $cipher->setIV($iv);
+            $cipher->enableContinuousBuffer();
+            $cipher->setKey($this->params['key']);
+            $cipher->setIV($this->params['iv']);
 
             $this->op = $parts[0] == 'mcrypt';
             $this->cipher = $cipher;
+            $this->block_length = phpseclib_mcrypt_enc_get_iv_size($cipher);
 
             return true;
         }

tests/MCryptCompatTest.php

@@ -19,9 +19,9 @@ public function testAESBasicSuccess()
         // a plaintext / ciphertext of length 1 is of an insufficient length for cbc mode
         $plaintext = str_repeat('a', 16);
 
-        $mcrypt = bin2hex(mcrypt_encrypt('rijndael-128', $key, $plaintext, 'cbc', $iv));
-        $compat = bin2hex(phpseclib_mcrypt_encrypt('rijndael-128', $key, $plaintext, 'cbc', $iv));
-        $this->assertEquals($mcrypt, $compat);
+        $mcrypt = mcrypt_encrypt('rijndael-128', $key, $plaintext, 'cbc', $iv);
+        $compat = phpseclib_mcrypt_encrypt('rijndael-128', $key, $plaintext, 'cbc', $iv);
+        $this->assertEquals(bin2hex($mcrypt), bin2hex($compat));
 
         $ciphertext = $mcrypt;
 
@@ -112,26 +112,59 @@ public function testNullPadding()
     public function testStream()
     {
         $passphrase = 'My secret';
+        $plaintext = 'Secret secret secret data';
+
+        $iv = substr(md5('iv' . $passphrase, true), 0, 8);
+        $key = substr(md5('pass1' . $passphrase, true) .
+                      md5('pass2' . $passphrase, true), 0, 24);
+        $opts = array('iv' => $iv, 'key' => $key);
 
-        $iv = substr(md5('iv'.$passphrase, true), 0, 8);
-        $key = substr(md5('pass1'.$passphrase, true) .
-                      md5('pass2'.$passphrase, true), 0, 24);
-        $opts = array('iv'=>$iv, 'key'=>$key);
+        $expected = substr($plaintext . $plaintext, 0, 48);
 
         $fp = fopen('php://memory', 'wb+');
         stream_filter_append($fp, 'mcrypt.tripledes', STREAM_FILTER_WRITE, $opts);
-        fwrite($fp, 'Secret secret secret data');
+        fwrite($fp, $plaintext . $plaintext);
+        rewind($fp);
+        $reference = bin2hex(fread($fp, 1024));
+        fclose($fp);
+
+        $fp = fopen('php://memory', 'wb+');
+        stream_filter_append($fp, 'mcrypt.tripledes', STREAM_FILTER_WRITE, $opts);
+        fwrite($fp, $plaintext);
+        fwrite($fp, $plaintext);
         rewind($fp);
         $mcrypt = bin2hex(fread($fp, 1024));
+        stream_filter_append($fp, 'mdecrypt.tripledes', STREAM_FILTER_READ, $opts);
+        rewind($fp);
+        $decrypted = fread($fp, 1024);
         fclose($fp);
 
+        // this demonstrates that streams operate in continuous mode
+        $this->assertEquals($reference, $mcrypt);
+
+        // this demonstrates how to decrypt encrypted data
+        $this->assertEquals($expected, $decrypted);
+
         $fp = fopen('php://memory', 'wb+');
         stream_filter_append($fp, 'phpseclib.mcrypt.tripledes', STREAM_FILTER_WRITE, $opts);
-        fwrite($fp, 'Secret secret secret data');
+        fwrite($fp, $plaintext);
+        fwrite($fp, $plaintext);
         rewind($fp);
         $compat = bin2hex(fread($fp, 1024));
+        stream_filter_append($fp, 'phpseclib.mdecrypt.tripledes', STREAM_FILTER_READ, $opts);
+        rewind($fp);
+        $decrypted = fread($fp, 1024);
         fclose($fp);
 
+        // this demonstrates that mcrypt's stream and phpseclib's stream's have identical output
         $this->assertEquals($mcrypt, $compat);
+
+        // this demonstrates that phpseclib's stream successfully decrypts the encrypted string
+        // since both mcrypt and phpseclib successfully decrypt to the same thing the outputs can be assumed to be matching
+        $this->assertEquals($expected, $decrypted);
+
+        // in the case of cbc the length is a multiple of the block size. extra characters are added
+        // when enough are present for another block to be added
+        $this->assertNotEquals(strlen($mcrypt), strlen($plaintext) * 2);
     }
 }