[PATCH proxmox-backup 2/2] fix: pbs-key-config: do not panic on short decrypted keys

[Christian Ebner <c.ebner@proxmox.com>]

KeyConfig::decrypt() insufficiently check the key length after
decryption or when the key is already in plain text, potentially
leading to a panic as copy_from_slice() expects the source and
target slice length to match, panic'ing otherwise [0].

While this cannot be triggered for encrypted keys as long as
openssl::symm::decrypt_aead() returns the expected data and fails on
errors, plain keys can easily trigger the panic by loading a corrupt
key file.

Check for expected key size when loading a plain or encrypted key, as
well as when copying to the fixed size array after decryption or
copying of already plain key.

By defining the expected length as constant, checks and error
reporting are kept in sync.

[0] https://doc.rust-lang.org/std/primitive.slice.html#method.copy_from_slice

Reported-by: Martin Vlach <mr.huge@seznam.cz>
Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
 pbs-key-config/src/lib.rs | 39 +++++++++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/pbs-key-config/src/lib.rs b/pbs-key-config/src/lib.rs
index 3147845ca..2dd232601 100644
--- a/pbs-key-config/src/lib.rs
+++ b/pbs-key-config/src/lib.rs
@@ -14,6 +14,8 @@ use pbs_api_types::{Fingerprint, Kdf, KeyInfo};
 
 use pbs_tools::crypt_config::CryptConfig;
 
+const EXPECTED_KEY_LEN: usize = 32;
+
 /// Key derivation function configuration
 #[derive(Deserialize, Serialize, Clone, Debug)]
 pub enum KeyDerivationConfig {
@@ -34,7 +36,7 @@ pub enum KeyDerivationConfig {
 impl KeyDerivationConfig {
     /// Derive a key from provided passphrase
     pub fn derive_key(&self, passphrase: &[u8]) -> Result<[u8; 32], Error> {
-        let mut key = [0u8; 32];
+        let mut key = [0u8; EXPECTED_KEY_LEN];
 
         match self {
             KeyDerivationConfig::Scrypt { n, r, p, salt } => {
@@ -100,7 +102,7 @@ impl From<&KeyConfig> for KeyInfo {
 impl KeyConfig {
     /// Creates a new key using random data, protected by passphrase.
     pub fn new(passphrase: &[u8], kdf: Kdf) -> Result<([u8; 32], Self), Error> {
-        let mut key = [0u8; 32];
+        let mut key = [0u8; EXPECTED_KEY_LEN];
         proxmox_sys::linux::fill_with_random_data(&mut key)?;
         let key_config = Self::with_key(&key, passphrase, kdf)?;
         Ok((key, key_config))
@@ -175,6 +177,18 @@ impl KeyConfig {
     pub fn load<P: AsRef<Path>>(path: P) -> Result<KeyConfig, Error> {
         let keydata = file_get_contents(path)?;
         let key_config: KeyConfig = serde_json::from_reader(&keydata[..])?;
+        if key_config.kdf.is_none() && key_config.data.len() != EXPECTED_KEY_LEN {
+            bail!(
+                "unexpected key length ({} != {EXPECTED_KEY_LEN})",
+                key_config.data.len()
+            )
+        } else if key_config.kdf.is_some() && key_config.data.len() < 32 {
+            bail!(
+                "unexpected short data for key ({} < 32)",
+                key_config.data.len()
+            );
+        }
+
         Ok(key_config)
     }
 
@@ -215,8 +229,12 @@ impl KeyConfig {
             raw_data.clone()
         };
 
-        let mut result = [0u8; 32];
-        result.copy_from_slice(&key);
+        let result: [u8; EXPECTED_KEY_LEN] = key.as_slice().try_into().map_err(|_err| {
+            format_err!(
+                "unexpected key length {} (expected {EXPECTED_KEY_LEN})",
+                key.len(),
+            )
+        })?;
 
         let crypt_config = CryptConfig::new(result)?;
         let fingerprint = Fingerprint::new(crypt_config.fingerprint());
@@ -378,6 +396,19 @@ fn encrypt_decrypt_test() -> Result<(), Error> {
     Ok(())
 }
 
+#[test]
+fn plain_key_length_check() -> Result<(), Error> {
+    let key: [u8; 32] = [0x11; 32];
+    let empty_passphrase = || -> Result<Vec<u8>, Error> { Ok(Vec::new()) };
+
+    let mut key_config = KeyConfig::without_password(key).unwrap();
+    assert!(key_config.decrypt(&empty_passphrase).is_ok());
+    key_config.data = vec![0x11; 31]; // short raw key data
+    assert!(key_config.decrypt(&empty_passphrase).is_err());
+
+    Ok(())
+}
+
 #[test]
 fn fingerprint_checks() -> Result<(), Error> {
     let key = KeyConfig {
-- 
2.47.3