I think I found the reason. In the class BackWPup_Encryption_OpenSSL BackWPup tries to detect cipher methods of OpenSSL (method cipher_method() ) . This is later used to encrypt and decrypt all kinds of passwords in BackWPup. I tested the previous version (Ubuntu 18.04 image) vs. current version (Ubuntu 19.04 image). The Dockerfile to generate the image did not change, I’ve just set a new base image (FROM ubuntu:disco instead of ubuntu:bionic).
Here is the output of some tests of the 18.04 version:
root@dc48b862fbd2:/phptest# php -v
PHP 7.2.10-0ubuntu0.18.04.1 (cli) (built: Sep 13 2018 13:45:02) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.10-0ubuntu0.18.04.1, Copyright (c) 1999-2018, by Zend Technologies
root@dc48b862fbd2:/phptest# php -i | grep -i openssl
SSL Version => OpenSSL/1.1.0g
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.1.0g 2 Nov 2017
OpenSSL Header Version => OpenSSL 1.1.0g 2 Nov 2017
Openssl default config => /usr/lib/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value
Native OpenSSL support => enabled
So OpenSSL is enabled and should work.
Then I extracted the code fragment of cipher_method():
At first, a list of all cipher methods is created by openssl_get_cipher_methods(). After that, BackWPup tries to match one of three “preferred methods”:
$preferred = array( 'AES-256-CTR', 'AES-128-CTR', 'AES-192-CTR' );
If one of these methods, i.e. strings is found in the list, it will be returned and stored as class property.
With the above version the first found method is AES-256-CTR.
Now the results of the newer Ubuntu 19.04 image:
root@d894c15e6329:/phptest# php -v
PHP 7.2.17-0ubuntu0.19.04.1 (cli) (built: Apr 18 2019 18:01:25) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.17-0ubuntu0.19.04.1, Copyright (c) 1999-2018, by Zend Technologies
root@d894c15e6329:/phptest# php -i | grep -i openssl
SSL Version => OpenSSL/1.1.1b
libSSH Version => libssh/0.8.6/openssl/zlib
openssl
OpenSSL support => enabled
OpenSSL Library Version => OpenSSL 1.1.1b 26 Feb 2019
OpenSSL Header Version => OpenSSL 1.1.1b 26 Feb 2019
Openssl default config => /usr/lib/ssl/openssl.cnf
openssl.cafile => no value => no value
openssl.capath => no value => no value
Native OpenSSL support => enabled
OpenSSL is enabled again, the versions are updated, This seems ok again.
But when I run the test with this version, nothing is returned! None of the “preferred methods” is found.
In this case BackWPup uses the first cipher method found in the list – in my case it is “aes-128-cbc“.
So decrypting a password which was encrypted with a different cipher must go wrong.
The reason is that the upperclass versions of cipher names are missing. This is a known issue (or bug?) with OpenSSL 1.1.1, see https://www.php.net/manual/de/function.openssl-get-cipher-methods.php, first comment, and more on https://github.com/oerdnj/deb.sury.org/issues/990 and the referenced issues.
Maybe this helps if somebody runs into similar problems after updating OpenSSL.
Kind regards,
Ralf
