Configurable sender trust checking on decrypting

bindings/matrix-sdk-crypto-ffi/src/machine.rs

@@ -17,6 +17,7 @@ use matrix_sdk_crypto::{
     decrypt_room_key_export, encrypt_room_key_export,
     olm::ExportedRoomKey,
     store::{BackupDecryptionKey, Changes},
+    types::decryption::{DecryptionSettings, TrustRequirement},
     LocalTrust, OlmMachine as InnerMachine, ToDeviceRequest, UserIdentities,
 };
 use ruma::{
@@ -884,7 +885,13 @@ impl OlmMachine {
         let event: Raw<_> = serde_json::from_str(&event)?;
         let room_id = RoomId::parse(room_id)?;
 
-        let decrypted = self.runtime.block_on(self.inner.decrypt_room_event(&event, &room_id))?;
+        let decryption_settings =
+            DecryptionSettings { trust_requirement: TrustRequirement::Untrusted };
+        let decrypted = self.runtime.block_on(self.inner.decrypt_room_event(
+            &event,
+            &room_id,
+            &decryption_settings,
+        ))?;
 
         if handle_verification_events {
             if let Ok(AnyTimelineEvent::MessageLike(e)) = decrypted.event.deserialize() {

crates/matrix-sdk-base/src/client.rs

@@ -28,8 +28,10 @@ use futures_util::Stream;
 use matrix_sdk_common::instant::Instant;
 #[cfg(feature = "e2e-encryption")]
 use matrix_sdk_crypto::{
-    store::DynCryptoStore, CollectStrategy, EncryptionSettings, EncryptionSyncChanges, OlmError,
-    OlmMachine, ToDeviceRequest,
+    store::DynCryptoStore,
+    types::decryption::{DecryptionSettings, TrustRequirement},
+    CollectStrategy, EncryptionSettings, EncryptionSyncChanges, OlmError, OlmMachine,
+    ToDeviceRequest,
 };
 #[cfg(feature = "e2e-encryption")]
 use ruma::events::{
@@ -298,8 +300,10 @@ impl BaseClient {
         let olm = self.olm_machine().await;
         let Some(olm) = olm.as_ref() else { return Ok(None) };
 
+        let decryption_settings =
+            DecryptionSettings { trust_requirement: TrustRequirement::Untrusted };
         let event: SyncTimelineEvent =
-            olm.decrypt_room_event(event.cast_ref(), room_id).await?.into();
+            olm.decrypt_room_event(event.cast_ref(), room_id, &decryption_settings).await?.into();
 
         if let Ok(AnySyncTimelineEvent::MessageLike(e)) = event.event.deserialize() {
             match &e {

crates/matrix-sdk-common/src/deserialized_responses.rs

@@ -21,6 +21,7 @@ use ruma::{
     DeviceKeyAlgorithm, OwnedDeviceId, OwnedEventId, OwnedUserId,
 };
 use serde::{Deserialize, Serialize};
+use thiserror::Error;
 
 use crate::debug::{DebugRawEvent, DebugStructExt};
 
@@ -30,6 +31,7 @@ const UNVERIFIED_IDENTITY: &str = "Encrypted by an unverified user.";
 const UNSIGNED_DEVICE: &str = "Encrypted by a device not verified by its owner.";
 const UNKNOWN_DEVICE: &str = "Encrypted by an unknown or deleted device.";
 pub const SENT_IN_CLEAR: &str = "Not encrypted.";
+const PREVIOUSLY_VERIFIED: &str = "Encrypted by a previously-verified user.";
 
 /// Represents the state of verification for a decrypted message sent by a
 /// device.
@@ -88,12 +90,12 @@ impl VerificationState {
         match self {
             VerificationState::Verified => ShieldState::None,
             VerificationState::Unverified(level) => match level {
-                VerificationLevel::UnverifiedIdentity | VerificationLevel::UnsignedDevice => {
-                    ShieldState::Red {
-                        code: ShieldStateCode::UnverifiedIdentity,
-                        message: UNVERIFIED_IDENTITY,
-                    }
-                }
+                VerificationLevel::UnverifiedIdentity
+                | VerificationLevel::PreviouslyVerified
+                | VerificationLevel::UnsignedDevice => ShieldState::Red {
+                    code: ShieldStateCode::UnverifiedIdentity,
+                    message: UNVERIFIED_IDENTITY,
+                },
                 VerificationLevel::None(link) => match link {
                     DeviceLinkProblem::MissingDevice => ShieldState::Red {
                         code: ShieldStateCode::UnknownDevice,
@@ -122,10 +124,16 @@ impl VerificationState {
                 VerificationLevel::UnverifiedIdentity => {
                     // If you didn't show interest in verifying that user we don't
                     // nag you with an error message.
-                    // TODO: We should detect identity rotation of a previously trusted identity and
-                    // then warn see https://github.com/matrix-org/matrix-rust-sdk/issues/1129
                     ShieldState::None
                 }
+                VerificationLevel::PreviouslyVerified => {
+                    // This is a high warning. The sender was previously
+                    // verified, but changed their identity.
+                    ShieldState::Red {
+                        code: ShieldStateCode::PreviouslyVerified,
+                        message: PREVIOUSLY_VERIFIED,
+                    }
+                }
                 VerificationLevel::UnsignedDevice => {
                     // This is a high warning. The sender hasn't verified his own device.
                     ShieldState::Red {
@@ -159,20 +167,28 @@ impl VerificationState {
 
 /// The sub-enum containing detailed information on why a message is considered
 /// to be unverified.
-#[derive(Clone, Debug, Deserialize, Serialize, PartialEq, Eq)]
+#[derive(Clone, Debug, Error, Deserialize, Serialize, PartialEq, Eq)]
 pub enum VerificationLevel {
     /// The message was sent by a user identity we have not verified.
+    #[error("The sender's identity was not verified")]
     UnverifiedIdentity,
 
+    /// The message was sent by a user who was previously verified, but changed
+    /// their identity, and we have not yet verified the new identity.
+    #[error("The sender's identity was previously verified but has changed")]
+    PreviouslyVerified,
+
     /// The message was sent by a device not linked to (signed by) any user
     /// identity.
+    #[error("The sending device was not signed by the user's identity")]
     UnsignedDevice,
 
     /// We weren't able to link the message back to any device. This might be
     /// because the message claims to have been sent by a device which we have
     /// not been able to obtain (for example, because the device was since
     /// deleted) or because the key to decrypt the message was obtained from
     /// an insecure source.
+    #[error("The sending device is not known")]
     None(DeviceLinkProblem),
 }
 
@@ -227,6 +243,8 @@ pub enum ShieldStateCode {
     UnverifiedIdentity,
     /// An unencrypted event in an encrypted room.
     SentInClear,
+    /// The sender was previously verified but changed their identity.
+    PreviouslyVerified,
 }
 
 /// The algorithm specific information of a decrypted event.

crates/matrix-sdk-crypto/CHANGELOG.md

@@ -32,6 +32,9 @@ Changes:
 
 Breaking changes:
 
+- `OlmMachine::decrypt_room_event` now takes an `EncryptionSettings` argument.
+  ([#3701](https://github.com/matrix-org/matrix-rust-sdk/pull/3701))
+
 - Add a new `error_on_verified_user_problem` property to
   `CollectStrategy::DeviceBasedStrategy`, which, when set, causes
   `OlmMachine::share_room_key` to fail with an error if any verified users on

crates/matrix-sdk-crypto/src/error.rs

@@ -14,6 +14,7 @@
 
 use std::collections::BTreeMap;
 
+use matrix_sdk_common::deserialized_responses::VerificationLevel;
 use ruma::{CanonicalJsonError, IdParseError, OwnedDeviceId, OwnedRoomId, OwnedUserId};
 use serde::{ser::SerializeMap, Serializer};
 use serde_json::Error as SerdeError;
@@ -115,6 +116,10 @@ pub enum MegolmError {
     /// The storage layer returned an error.
     #[error(transparent)]
     Store(#[from] CryptoStoreError),
+
+    /// The sender's cross-signing identity isn't trusted
+    #[error("message quarantined because sender's cross-signing identity is not trusted: {0}")]
+    SenderIdentity(#[from] VerificationLevel),
 }
 
 /// Decryption failed because of a mismatch between the identity keys of the

crates/matrix-sdk-crypto/src/machine/mod.rs

@@ -77,6 +77,7 @@ use crate::{
         StoreCache, StoreTransaction,
     },
     types::{
+        decryption::{DecryptionSettings, TrustRequirement},
         events::{
             olm_v1::{AnyDecryptedOlmEvent, DecryptedRoomKeyEvent},
             room::encrypted::{
@@ -934,8 +935,6 @@ impl OlmMachine {
         &self,
         room_id: &RoomId,
     ) -> OlmResult<()> {
-        use crate::olm::SenderData;
-
         let (_, session) = self
             .inner
             .group_session_manager
@@ -957,8 +956,6 @@ impl OlmMachine {
         &self,
         room_id: &RoomId,
     ) -> OlmResult<InboundGroupSession> {
-        use crate::olm::SenderData;
-
         let (_, session) = self
             .inner
             .group_session_manager
@@ -1570,11 +1567,69 @@ impl OlmMachine {
         self.get_encryption_info(&session, &event.sender).await
     }
 
+    /// Check whether the sender of a Megolm session is trusted, based on the
+    /// verification state.
+    ///
+    /// This is used by `check_sender_trust_requirement`, and ensures that the
+    /// sending device is cross-signed.
+    fn check_sender_trusted(&self, encryption_info: &EncryptionInfo) -> MegolmResult<()> {
+        match &encryption_info.verification_state {
+            // Device is cross-signed, and identity is verified
+            VerificationState::Verified => Ok(()),
+            // Device is cross-signed, but identity is not verified
+            VerificationState::Unverified(VerificationLevel::UnverifiedIdentity) => Ok(()),
+            // Device is not cross-signed
+            VerificationState::Unverified(verification_level) => {
+                Err(MegolmError::SenderIdentity(verification_level.clone()))
+            }
+        }
+    }
+
+    /// Check that the sender of a Megolm session satisfies the trust
+    /// requirement from the decryption settings.
+    fn check_sender_trust_requirement(
+        &self,
+        session: &InboundGroupSession,
+        encryption_info: &EncryptionInfo,
+        decryption_settings: &DecryptionSettings,
+    ) -> MegolmResult<()> {
+        match decryption_settings.trust_requirement {
+            TrustRequirement::Untrusted => Ok(()),
+
+            TrustRequirement::CrossSignedOrLegacy => match &session.sender_data {
+                // Reject if the sender was previously verified, but changed
+                // their identity and is not verified any more.
+                SenderData::SenderKnown {
+                    master_key_verified: false,
+                    previously_verified: true,
+                    ..
+                } => Err(MegolmError::SenderIdentity(VerificationLevel::PreviouslyVerified)),
+                SenderData::SenderKnown { .. } => Ok(()),
+                SenderData::DeviceInfo { legacy_session: true, .. } => Ok(()),
+                SenderData::UnknownDevice { legacy_session: true, .. } => Ok(()),
+                _ => self.check_sender_trusted(encryption_info),
+            },
+
+            TrustRequirement::CrossSigned => match &session.sender_data {
+                // Reject if the sender was previously verified, but changed
+                // their identity and is not verified any more.
+                SenderData::SenderKnown {
+                    master_key_verified: false,
+                    previously_verified: true,
+                    ..
+                } => Err(MegolmError::SenderIdentity(VerificationLevel::PreviouslyVerified)),
+                SenderData::SenderKnown { .. } => Ok(()),
+                _ => self.check_sender_trusted(encryption_info),
+            },
+        }
+    }
+
     async fn decrypt_megolm_events(
         &self,
         room_id: &RoomId,
         event: &EncryptedEvent,
         content: &SupportedEventEncryptionSchemes<'_>,
+        decryption_settings: &DecryptionSettings,
     ) -> MegolmResult<(JsonObject, EncryptionInfo)> {
         let session =
             self.get_inbound_group_session_or_error(room_id, content.session_id()).await?;
@@ -1590,6 +1645,13 @@ impl OlmMachine {
         match result {
             Ok((decrypted_event, _)) => {
                 let encryption_info = self.get_encryption_info(&session, &event.sender).await?;
+
+                self.check_sender_trust_requirement(
+                    &session,
+                    &encryption_info,
+                    decryption_settings,
+                )?;
+
                 Ok((decrypted_event, encryption_info))
             }
             Err(error) => Err(
@@ -1648,8 +1710,9 @@ impl OlmMachine {
         &self,
         event: &Raw<EncryptedEvent>,
         room_id: &RoomId,
+        decryption_settings: &DecryptionSettings,
     ) -> MegolmResult<TimelineEvent> {
-        self.decrypt_room_event_inner(event, room_id, true).await
+        self.decrypt_room_event_inner(event, room_id, true, decryption_settings).await
     }
 
     #[instrument(name = "decrypt_room_event", skip_all, fields(?room_id, event_id, origin_server_ts, sender, algorithm, session_id, sender_key))]
@@ -1658,6 +1721,7 @@ impl OlmMachine {
         event: &Raw<EncryptedEvent>,
         room_id: &RoomId,
         decrypt_unsigned: bool,
+        decryption_settings: &DecryptionSettings,
     ) -> MegolmResult<TimelineEvent> {
         let event = event.deserialize()?;
 
@@ -1685,7 +1749,8 @@ impl OlmMachine {
         };
 
         Span::current().record("session_id", content.session_id());
-        let result = self.decrypt_megolm_events(room_id, &event, &content).await;
+        let result =
+            self.decrypt_megolm_events(room_id, &event, &content, decryption_settings).await;
 
         if let Err(e) = &result {
             #[cfg(feature = "automatic-room-key-forwarding")]
@@ -1710,8 +1775,9 @@ impl OlmMachine {
         let mut unsigned_encryption_info = None;
         if decrypt_unsigned {
             // Try to decrypt encrypted unsigned events.
-            unsigned_encryption_info =
-                self.decrypt_unsigned_events(&mut decrypted_event, room_id).await;
+            unsigned_encryption_info = self
+                .decrypt_unsigned_events(&mut decrypted_event, room_id, decryption_settings)
+                .await;
         }
 
         let event = serde_json::from_value::<Raw<AnyTimelineEvent>>(decrypted_event.into())?;
@@ -1737,6 +1803,7 @@ impl OlmMachine {
         &self,
         main_event: &mut JsonObject,
         room_id: &RoomId,
+        decryption_settings: &DecryptionSettings,
     ) -> Option<BTreeMap<UnsignedEventLocation, UnsignedDecryptionResult>> {
         let unsigned = main_event.get_mut("unsigned")?.as_object_mut()?;
         let mut unsigned_encryption_info: Option<
@@ -1746,7 +1813,9 @@ impl OlmMachine {
         // Search for an encrypted event in `m.replace`, an edit.
         let location = UnsignedEventLocation::RelationsReplace;
         let replace = location.find_mut(unsigned);
-        if let Some(decryption_result) = self.decrypt_unsigned_event(replace, room_id).await {
+        if let Some(decryption_result) =
+            self.decrypt_unsigned_event(replace, room_id, decryption_settings).await
+        {
             unsigned_encryption_info
                 .get_or_insert_with(Default::default)
                 .insert(location, decryption_result);
@@ -1757,7 +1826,7 @@ impl OlmMachine {
         let location = UnsignedEventLocation::RelationsThreadLatestEvent;
         let thread_latest_event = location.find_mut(unsigned);
         if let Some(decryption_result) =
-            self.decrypt_unsigned_event(thread_latest_event, room_id).await
+            self.decrypt_unsigned_event(thread_latest_event, room_id, decryption_settings).await
         {
             unsigned_encryption_info
                 .get_or_insert_with(Default::default)
@@ -1778,6 +1847,7 @@ impl OlmMachine {
         &'a self,
         event: Option<&'a mut Value>,
         room_id: &'a RoomId,
+        decryption_settings: &'a DecryptionSettings,
     ) -> BoxFuture<'a, Option<UnsignedDecryptionResult>> {
         Box::pin(async move {
             let event = event?;
@@ -1791,7 +1861,10 @@ impl OlmMachine {
             }
 
             let raw_event = serde_json::from_value(event.clone()).ok()?;
-            match self.decrypt_room_event_inner(&raw_event, room_id, false).await {
+            match self
+                .decrypt_room_event_inner(&raw_event, room_id, false, decryption_settings)
+                .await
+            {
                 Ok(decrypted_event) => {
                     // Replace the encrypted event.
                     *event = serde_json::to_value(decrypted_event.event).ok()?;
@@ -2359,6 +2432,12 @@ fn sender_data_to_verification_state(
             VerificationState::Unverified(VerificationLevel::UnsignedDevice),
             Some(device_keys.device_id),
         ),
+        SenderData::SenderKnown {
+            master_key_verified: false,
+            previously_verified: true,
+            device_id,
+            ..
+        } => (VerificationState::Unverified(VerificationLevel::PreviouslyVerified), device_id),
         SenderData::SenderKnown { master_key_verified: false, device_id, .. } => {
             (VerificationState::Unverified(VerificationLevel::UnverifiedIdentity), device_id)
         }