From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 882221FF0DF for ; Thu, 05 Nov 2026 12:07:57 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 5EC0A2147A; Thu, 05 Nov 2026 12:07:55 +0100 (CET) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox-backup] pbs-key-config: ensure password-protected key is long enough Date: Thu, 5 Nov 2026 12:07:25 +0100 Message-ID: <20261105110750.805444-1-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793876871132 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.658 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: H4UFM7HJWNY4NHOGKSPVAWJKZUXBEMGI X-Message-ID-Hash: H4UFM7HJWNY4NHOGKSPVAWJKZUXBEMGI X-MailFrom: f.gruenbichler@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: while openssl fails if provided an empty slice, the resulting error message points at the password instead of the key. checking for at least one byte of data ensures plain and password-protected keys are distinguished. Signed-off-by: Fabian Grünbichler --- pbs-key-config/src/lib.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs index 7b87b4ea9..0cffdf008 100644 --- a/pbs-key-config/src/lib.rs +++ b/pbs-key-config/src/lib.rs @@ -211,7 +211,7 @@ impl KeyConfig { let derived_key = kdf.derive_key(&passphrase)?; - if raw_data.len() < 32 { + if raw_data.len() < EXPECTED_KEY_LEN + 1 { bail!("Unable to decrypt key - short data"); } let iv = &raw_data[0..16]; -- 2.47.3