fix(direct): pad 1:1 application plaintexts inside MLS

src/ffi_api/engine/direct.rs

@@ -1329,12 +1329,7 @@ impl CoreEngine {
         )?;
         let protected_bytes = protected_message.to_json_bytes()?;
         self.rotate_direct_pcs_before_encrypting(&conversation_id)?;
-        let payload = self
-            .state
-            .mls_adapter
-            .as_mut()
-            .ok_or_else(|| CoreError::invalid_state("mls adapter is not initialized"))?
-            .encrypt_application(&conversation_id, &protected_bytes)?;
+        let payload = self.encrypt_direct_application(&conversation_id, &protected_bytes)?;
         self.keep_unconfirmed_frame(&conversation_id, &protected_bytes, Vec::new());
         let envelopes = recipient_device_ids
             .iter()
@@ -2000,12 +1995,7 @@ impl CoreEngine {
             sent_at,
         )?;
         let bytes = protected.to_json_bytes()?;
-        let payload = self
-            .state
-            .mls_adapter
-            .as_mut()
-            .ok_or_else(|| CoreError::invalid_state("mls adapter is not initialized"))?
-            .encrypt_application(conversation_id, &bytes)?;
+        let payload = self.encrypt_direct_application(conversation_id, &bytes)?;
         if resent_after_a_race(kind) {
             self.keep_unconfirmed_frame(conversation_id, &bytes, storage_refs.clone());
         }
@@ -2077,12 +2067,8 @@ impl CoreEngine {
         let recipient_device_ids = self.recipient_device_ids(conversation_id)?;
         let mut envelopes = Vec::new();
         for frame in frames {
-            let payload = self
-                .state
-                .mls_adapter
-                .as_mut()
-                .ok_or_else(|| CoreError::invalid_state("mls adapter is not initialized"))?
-                .encrypt_application(conversation_id, frame.protected.as_bytes())?;
+            let payload =
+                self.encrypt_direct_application(conversation_id, frame.protected.as_bytes())?;
             for device_id in &recipient_device_ids {
                 envelopes.push(self.build_envelope_with_storage_refs(
                     conversation_id,
@@ -2097,6 +2083,23 @@ impl CoreEngine {
         Ok(())
     }
 
+    /// The one place a 1:1 application plaintext reaches MLS: padded first,
+    /// whatever its kind, so that its length shows only its block count (see
+    /// [`crate::lane_wrap::pad_application_plaintext`]). What is kept for a
+    /// resend stays unpadded and comes back through here.
+    fn encrypt_direct_application(
+        &mut self,
+        conversation_id: &str,
+        protected: &[u8],
+    ) -> CoreResult<crate::mls_adapter::OutboundMlsMessage> {
+        let padded = crate::lane_wrap::pad_application_plaintext(protected)?;
+        self.state
+            .mls_adapter
+            .as_mut()
+            .ok_or_else(|| CoreError::invalid_state("mls adapter is not initialized"))?
+            .encrypt_application(conversation_id, &padded)
+    }
+
     pub(super) fn enqueue_or_create_direct_app(
         &mut self,
         peer_user_id: &str,
@@ -2208,7 +2211,16 @@ impl CoreEngine {
             };
         }
 
-        match ProtectedAppMessage::from_json_slice(&application.plaintext) {
+        // Padded on the send side to a length that shows only its block count
+        // (`encrypt_direct_application`); anything else did not come from it.
+        let Some(protected_bytes) =
+            crate::lane_wrap::strip_application_padding(&application.plaintext)
+        else {
+            return ApplicationPlaintextDecision::RejectedProtocol {
+                reason: "application plaintext is not padded".into(),
+            };
+        };
+        match ProtectedAppMessage::from_json_slice(protected_bytes) {
             Ok(protected) => {
                 if protected.sender_user_id != mls_sender.user_id
                     || protected.sender_device_id != mls_sender.device_id

src/ffi_api/engine/mod.rs

@@ -3668,10 +3668,21 @@ mod protected_application_message_tests {
         .expect("protected bytes")
     }
 
+    /// What MLS hands back for `plaintext` sent on the 1:1 path: padded, as
+    /// `encrypt_direct_application` pads it.
     fn decrypted(
         plaintext: Vec<u8>,
         user_id: &str,
         device_id: &str,
+    ) -> DecryptedApplicationMessage {
+        let padded = crate::lane_wrap::pad_application_plaintext(&plaintext);
+        decrypted_unpadded(padded.expect("pad"), user_id, device_id)
+    }
+
+    fn decrypted_unpadded(
+        plaintext: Vec<u8>,
+        user_id: &str,
+        device_id: &str,
     ) -> DecryptedApplicationMessage {
         DecryptedApplicationMessage {
             plaintext,
@@ -3824,6 +3835,26 @@ mod protected_application_message_tests {
             ApplicationPlaintextDecision::RejectedProtocol { .. }
         ));
     }
+
+    #[test]
+    fn an_unpadded_protected_plaintext_is_rejected() {
+        let mut engine = CoreEngine::default();
+        seed_direct_conversation(&mut engine);
+        let decision = engine.evaluate_direct_application_plaintext(
+            &sample_record(),
+            "user:bob",
+            "device:bob:phone",
+            decrypted_unpadded(
+                protected_plaintext(vec!["device:bob:phone".into()]),
+                "user:alice",
+                "device:alice:phone",
+            ),
+        );
+        assert!(matches!(
+            decision,
+            ApplicationPlaintextDecision::RejectedProtocol { .. }
+        ));
+    }
 }
 
 #[cfg(test)]

src/ffi_api/tests.rs

@@ -18304,7 +18304,9 @@ pub(crate) mod tests {
             .expect("late e")
         {
             IngestResult::AppliedApplication(application) => {
-                let plaintext = String::from_utf8(application.plaintext).expect("utf8");
+                let protected = crate::lane_wrap::strip_application_padding(&application.plaintext)
+                    .expect("padded");
+                let plaintext = std::str::from_utf8(protected).expect("utf8");
                 assert!(plaintext.contains("late-e"));
                 assert!(application.from_previous_epoch);
             }