[PATCH proxmox-backup 0/2] fix potential panic on key decryption

[PATCH proxmox-backup 0/2] fix potential panic on key decryption

[Christian Ebner]

This patches address a useless key length check on a fixed size array
slice as well as an insufficient length check when decrypting the key
data via KeyConfig::decrypt(). The latter will result in a panic when
source and target length mismatch and is now handled as error.

Christian Ebner (2):
  pbs-key-config: drop useless length check enforce by type
  fix: pbs-key-config: do not panic on short decrypted keys

 pbs-key-config/src/lib.rs | 43 +++++++++++++++++++++++++++++++--------
 1 file changed, 35 insertions(+), 8 deletions(-)

-- 
2.47.3

[PATCH proxmox-backup 1/2] pbs-key-config: drop useless length check enforce by type

[Christian Ebner]

The fixed size byte slice passed as parameter to the method call
already enfoces the length of 32, so checking that is not required.

Drop the useless check.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-key-config/src/lib.rs | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
index b8e00d227..3147845ca 100644
--- a/pbs-key-config/src/lib.rs
+++ b/pbs-key-config/src/lib.rs
@@ -125,10 +125,6 @@ impl KeyConfig {
 
     /// Creates a new instance, protect raw_key with passphrase.
     pub fn with_key(raw_key: &[u8; 32], passphrase: &[u8], kdf: Kdf) -> Result<Self, Error> {
-        if raw_key.len() != 32 {
-            bail!("got strange key length ({} != 32)", raw_key.len())
-        }
-
         let salt = proxmox_sys::linux::random_data(32)?;
 
         let kdf = match kdf {
-- 
2.47.3

[PATCH proxmox-backup 2/2] fix: pbs-key-config: do not panic on short decrypted keys

[Christian Ebner]

KeyConfig::decrypt() insufficiently check the key length after
decryption or when the key is already in plain text, potentially
leading to a panic as copy_from_slice() expects the source and
target slice length to match, panic'ing otherwise [0].

While this cannot be triggered for encrypted keys as long as
openssl::symm::decrypt_aead() returns the expected data and fails on
errors, plain keys can easily trigger the panic by loading a corrupt
key file.

Check for expected key size when loading a plain or encrypted key, as
well as when copying to the fixed size array after decryption or
copying of already plain key.

By defining the expected length as constant, checks and error
reporting are kept in sync.

[0] https://doc.rust-lang.org/std/primitive.slice.html#method.copy_from_slice

Reported-by: Martin Vlach <mr.huge@seznam.cz>
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-key-config/src/lib.rs | 39 +++++++++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
index 3147845ca..2dd232601 100644
--- a/pbs-key-config/src/lib.rs
+++ b/pbs-key-config/src/lib.rs
@@ -14,6 +14,8 @@ use pbs_api_types::{Fingerprint, Kdf, KeyInfo};
 
 use pbs_tools::crypt_config::CryptConfig;
 
+const EXPECTED_KEY_LEN: usize = 32;
+
 /// Key derivation function configuration
 #[derive(Deserialize, Serialize, Clone, Debug)]
 pub enum KeyDerivationConfig {
@@ -34,7 +36,7 @@ pub enum KeyDerivationConfig {
 impl KeyDerivationConfig {
     /// Derive a key from provided passphrase
     pub fn derive_key(&self, passphrase: &[u8]) -> Result<[u8; 32], Error> {
-        let mut key = [0u8; 32];
+        let mut key = [0u8; EXPECTED_KEY_LEN];
 
         match self {
             KeyDerivationConfig::Scrypt { n, r, p, salt } => {
@@ -100,7 +102,7 @@ impl From<&KeyConfig> for KeyInfo {
 impl KeyConfig {
     /// Creates a new key using random data, protected by passphrase.
     pub fn new(passphrase: &[u8], kdf: Kdf) -> Result<([u8; 32], Self), Error> {
-        let mut key = [0u8; 32];
+        let mut key = [0u8; EXPECTED_KEY_LEN];
         proxmox_sys::linux::fill_with_random_data(&mut key)?;
         let key_config = Self::with_key(&key, passphrase, kdf)?;
         Ok((key, key_config))
@@ -175,6 +177,18 @@ impl KeyConfig {
     pub fn load<P: AsRef<Path>>(path: P) -> Result<KeyConfig, Error> {
         let keydata = file_get_contents(path)?;
         let key_config: KeyConfig = serde_json::from_reader(&keydata[..])?;
+        if key_config.kdf.is_none() && key_config.data.len() != EXPECTED_KEY_LEN {
+            bail!(
+                "unexpected key length ({} != {EXPECTED_KEY_LEN})",
+                key_config.data.len()
+            )
+        } else if key_config.kdf.is_some() && key_config.data.len() < 32 {
+            bail!(
+                "unexpected short data for key ({} < 32)",
+                key_config.data.len()
+            );
+        }
+
         Ok(key_config)
     }
 
@@ -215,8 +229,12 @@ impl KeyConfig {
             raw_data.clone()
         };
 
-        let mut result = [0u8; 32];
-        result.copy_from_slice(&key);
+        let result: [u8; EXPECTED_KEY_LEN] = key.as_slice().try_into().map_err(|_err| {
+            format_err!(
+                "unexpected key length {} (expected {EXPECTED_KEY_LEN})",
+                key.len(),
+            )
+        })?;
 
         let crypt_config = CryptConfig::new(result)?;
         let fingerprint = Fingerprint::new(crypt_config.fingerprint());
@@ -378,6 +396,19 @@ fn encrypt_decrypt_test() -> Result<(), Error> {
     Ok(())
 }
 
+#[test]
+fn plain_key_length_check() -> Result<(), Error> {
+    let key: [u8; 32] = [0x11; 32];
+    let empty_passphrase = || -> Result<Vec<u8>, Error> { Ok(Vec::new()) };
+
+    let mut key_config = KeyConfig::without_password(key).unwrap();
+    assert!(key_config.decrypt(&empty_passphrase).is_ok());
+    key_config.data = vec![0x11; 31]; // short raw key data
+    assert!(key_config.decrypt(&empty_passphrase).is_err());
+
+    Ok(())
+}
+
 #[test]
 fn fingerprint_checks() -> Result<(), Error> {
     let key = KeyConfig {
-- 
2.47.3