introduce wrapped_openssl_seal() and wrapped_openssl_open()

[weizenspreu]

This commit introduces wrapped_openssl_seal() and wrapped_openssl_open() with a custom implementation so that RC4 can be supported with OpenSSL v3 without having to reactivate legacy ciphers in the OpenSSL config. The wrapped functions could also be a basis to replace openssl_seal() and openssl_open() with something more modern that maybe uses OAEP padding as well as authenticated encryption.

This commit specifically fixes Nextcloud Server issue #32003.

[github-advanced-security]

Psalm found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.

[kesselb]

Thanks for your pull request 👍

Sounds like a good plan to introduce a fallback when the cipher is not available.

I wonder if we could use some code from https://github.com/nextcloud/3rdparty/blob/master/phpseclib/phpseclib/phpseclib/Crypt/RC4.php?

[weizenspreu]

I wonder if we could use some code from https://github.com/nextcloud/3rdparty/blob/master/phpseclib/phpseclib/phpseclib/Crypt/RC4.php?

If someone feels like it they are free to rewrite the code to use the phpseclib implementation instead.

[come-nc]

I would prefer to switch to phpseclib implementation of RC4 to avoid running our own.
Also, I would always use the wrapped version of seal and remove the fallback.

I can look into that later this week.

[solracsf]

Does this still make sense after #36173 ?

[weizenspreu]

@solracsf No, #36173 is a modified version of this pull request here.