Bump version to 0.3

- Now support all Gajim versions — from 1.0.3 to 1.1.99 (trunk) - Added python3-potr library to otrplugin distribution (it does not have external dependencies) - Code restructurized and reworked (again...) Fixes: - Now we will create OTR Instance only once for account - Fixed crash when we failed to get window control (chat is closed i.e.) - Will not break MAM and conferences anymore New: - XHTML support - Errors notifications as well as status changes - Retransmit last message after OTR channel init - Correct close all active OTR channels when going offline Wontfix: - I still love you. Always and Forever ♥
4 years ago · a05f8c4bf1
--- a/keystore.py
+++ b/keystore.py
@ -13,36 +13,35 @@
 # GNU General Public License for more details.
 #
 # You can always obtain full license text at <http://www.gnu.org/licenses/>.

 import os
 import sqlite3
 from collections import namedtuple

 class Keystore:

    __TABLE_LAYOUT__ = '''
        CREATE TABLE IF NOT EXISTS keystore (jid TEXT, privatekey TEXT, fingerprint TEXT, trust INTEGER, timestamp INTEGER, comment TEXT, UNIQUE(privatekey)); CREATE UNIQUE INDEX IF NOT EXISTS jid_fingerprint ON keystore (jid, fingerprint);
    '''    
    
    SCHEMA = '''
        PRAGMA synchronous=FULL;
        CREATE TABLE IF NOT EXISTS keystore (jid TEXT, privatekey TEXT, fingerprint TEXT, trust INTEGER, timestamp INTEGER, comment TEXT, UNIQUE(privatekey)); 
        CREATE UNIQUE INDEX IF NOT EXISTS jid_fingerprint ON keystore (jid, fingerprint);
    '''   
     
    def __init__(self, db):
        self._db = sqlite3.connect(db, isolation_level=None)
        self._db.row_factory = lambda cur,row : namedtuple("Row", [col[0] for col in cur.description])(*row)
        self._db.execute("PRAGMA synchronous=FULL;")
        self._db.executescript(self.__TABLE_LAYOUT__)

    def load(self, item = {'fingerprint IS NOT NULL; --': None}):
        sql = "SELECT * FROM keystore WHERE " + " AND ".join(["%s = '%s'" % (str(key), str(value)) for key,value in item.items()])
        if next(iter(item.values())): return self._db.execute(sql).fetchone()  # return fetchone() if `item` arg is set  
        return self._db.execute(sql).fetchall() or () # else return fetchall() or empty iterator
        self._db.executescript(self.SCHEMA)

    def save(self, item):
        sql = "REPLACE INTO keystore(%s) VALUES(%s)" % (",".join(item.keys()), ",".join(["'%s'" % x for x in item.values()]) )
        return self._db.execute(sql)
    def __del__(self):
        self._db.close()

    def forgot(self, item):
        sql = "DELETE FROM keystore WHERE " + " AND ".join(["%s='%s'" % (str(key),str(value)) for key,value in item.items()])
        return self._db.execute(sql)
    # fetch all entries with known fingerprints: `load()` or specific entry `load(jid = jid)`
    def load(self, **args):
        sql = "SELECT * FROM keystore WHERE %s" % (not args and "fingerprint IS NOT NULL" or " AND ".join(["{0}='{1}'".format(*arg) for arg in args.items()]))
        return (args) and self._db.execute(sql).fetchone() or self._db.execute(sql).fetchall() 

    def close(self):
        self._db.close()
    # save entry to database: save(jid=jid, fingerprint=fingerprint)
    def save(self, **args):
        sql = "REPLACE INTO keystore({0}) VALUES({1})".format(",".join(args.keys()), ",".join(["'%s'"%s for s in args.values()]))
        self._db.execute(sql)

    # delete entry from database: `delete(jid=jid) `    
    def delete(self, **args):
        sql = "DELETE FROM keystore WHERE %s" % " AND ".join(["{0}='{1}'".format(*a) for a in args.items()])
        self._db.execute(sql)
--- a/manifest.ini
+++ b/manifest.ini
@ -1,9 +1,9 @@
 [info]
 name: otrplugin
 short_name: otrplugin
 version: 0.2
 version: 0.3
 description: Off-the-Record encryption
 authors: Pavel R <pd@narayana.im>
 homepage: https://dev.narayana.im/gajim-otrplugin
 min_gajim_version: 1.1
 max_gajim_version: 1.3
 min_gajim_version: 1.0.3
 max_gajim_version: 1.1.99
--- a/otr.py
+++ b/otr.py
@ -15,56 +15,43 @@
 #
 # You can always obtain full license text at <http://www.gnu.org/licenses/>.

 import os
 import time
 import logging
 from potr import context, crypt
 import os, sys
 sys.path.append(os.path.dirname(__file__))

 from inspect import signature
 from gajim.common import const, app, helpers, configpaths
 from gajim.session import ChatControlSession
 from nbxmpp.protocol import Message, JID
 from otrplugin.potr import context, crypt, proto
 from otrplugin.keystore import Keystore

 # OTR channel class
 class Channel(context.Context): 
    def __init__(self, account, peer): 
        super(Channel, self).__init__(account, peer)
        self.getPolicy = OTR.DEFAULT_POLICY.get # default OTR flags 
        self.trustName = peer.getStripped()  # peer name 
        self.stream = account.stream # XMPP stream
        self.ctl = account.getControl(peer.getStripped()) # chat window control 
        self.resend = []
    
    def println(self, line, kind='status', **kwargs):
        try: self.ctl.conv_textview.print_conversation_line(line, kind=kind, tim=None, jid=None, name='', **kwargs)
        except TypeError: self.ctl.conv_textview.print_conversation_line(line, kind=kind, tim=None, name='', **kwargs) # gajim git fix
        return line

    def inject(self, msg, appdata={}):
        thread = appdata.get('thread', ChatControlSession.generate_thread_id(None))
 # Prototype of OTR Channel (secure conversations between Gajim user (Alice) and Gajim peer (Bob)
 class OTRChannel(context.Context):
    # this method may be called self.sendMessage() when we need to send some data to our <peer> via XMPP
    def inject(self,msg,appdata=None):
        stanza = Message(to=self.peer, body=msg.decode(), typ='chat')
        stanza.setThread(thread)
        self.stream.send_stanza(stanza)

    def setState(self, newstate):
        state, self.state = self.state, newstate 
        if self.getCurrentTrust() is None:
            self.println("OTR: new fingerprint received [%s]" % self.getCurrentKey())
            self.setCurrentTrust(0)
        if newstate == context.STATE_ENCRYPTED and state != newstate: 
            self.println("OTR: %s conversation started [%s]" % (self.getCurrentTrust() and 'trusted' or '**untrusted**', self.getCurrentKey()) )
        elif newstate == context.STATE_FINISHED and state != newstate:  # channel closed 
            self.println("OTR: conversation closed.") 


 # OTR class
 class OTR(context.Account):    
    contextclass = Channel

    # OTR const
    ENCRYPTION_NAME = 'OTR'
    ENCRYPTION_DATA = helpers.AdditionalDataDict({'encrypted':{'name': ENCRYPTION_NAME}})
    PROTOCOL = 'XMPP'
    MMS = 1000
        stanza.setThread(appdata or ChatControlSession.generate_thread_id(None))
        self.user.stream.send_stanza(stanza)

    # this method called on channel state change 
    def setState(self,state=0): 
        if state and state != self.state: 
            self.getCurrentTrust() is None and self.setCurrentTrust(0) != 0 and self.printl(OTR.TRUSTED[None].format(fprint=self.getCurrentKey())) # new fingerprint
            self.printl(OTR.STATUS[state].format(peer=self.peer,trust=OTR.TRUSTED[self.getCurrentTrust()],fprint=self.getCurrentKey())) # state is changed
        self.state = state
    
    # print  some text to chat window 
    def printl(self,line):
        println = self.user.getControl(self.peer) and self.user.getControl(self.peer).conv_textview.print_conversation_line
        println and println("OTR: "+line,kind='status',name='',tim='',**('jid' in signature(println).parameters and {'jid':None} or {}))

    @staticmethod 
    def getPolicy(policy): return OTR.DEFAULT_POLICY.get(policy)

 # OTR instance for Gajim user (Alice)
 class OTR(context.Account):
    PROTO = ('XMPP', 1024)
    ENCRYPTION_NAME = ('OTR')
    DEFAULT_POLICY = {
        'REQUIRE_ENCRYPTION': True,
        'ALLOW_V1': False,
@ -73,100 +60,86 @@ class OTR(context.Account):
        'WHITESPACE_START_AKE': True,
        'ERROR_START_AKE': True,
    }
    SESSION_START = '?OTRv2?\nI would like to start ' \
        'an Off-the-Record private conversation. However, you ' \
        'do not have a plugin to support that.\nSee '\
        'https://otr.cypherpunks.ca/ for more information.'
    
    def __init__(self, account, logger = None):
        super(OTR, self).__init__(account, OTR.PROTOCOL, OTR.MMS)
        self.log = logger
        self.ctxs, self.ctls = {}, {}
    TRUSTED = {None:"new fingerprint received: *{fprint}*", 0:"untrusted", 1:"trusted", 2:"authenticated"}
    STATUS = {
        context.STATE_PLAINTEXT:     "(re-)starting encrypted conversation with {peer}..",
        context.STATE_ENCRYPTED:     "{trust} encrypted conversation started (fingerprint: {fprint})", 
        context.STATE_FINISHED:      "encrypted conversation with {peer} closed (fingerprint: {fprint})",
        context.UnencryptedMessage:  "this message is *not encrypted*: {msg}",
        context.NotEncryptedError:   "unable to process message (channel lost)",
        context.ErrorReceived:       "received error message: {err}",
        crypt.InvalidParameterError: "unable to decrypt message (key/signature mismatch)",
    }

    def __init__(self,plugin,account):
        super(OTR,self).__init__(account,*OTR.PROTO)
        self.plugin = plugin
        self.log = plugin.log
        self.account = account 
        self.stream = app.connections[account]
        self.jid = self.stream.get_own_jid()
        self.keystore = Keystore(os.path.join(configpaths.get('MY_DATA'), 'otr_' + self.jid.getStripped() + '.db'))
        self.loadTrusts()
    
    # overload some default methods #
    def getControl(self, peer):
        ctrl = self.ctls.setdefault(peer, app.interface.msg_win_mgr.get_control(peer, self.account))
        return ctrl

    def getContext(self, peer):
        ctx = self.ctxs.setdefault(peer, Channel(self, peer))
        ctx = ctx.state == context.STATE_FINISHED and self.ctxs.pop(peer).disconnect() or self.ctxs.setdefault(peer, Channel(self, peer))
        return ctx 
    # get chat control 
    def getControl(self,peer):
        ctl = app.interface.msg_win_mgr.get_control(peer.getStripped(),self.account)
        return ctl
        
    def loadPrivkey(self):
        my = self.keystore.load({'jid': str(self.jid)})
        return crypt.PK.parsePrivateKey(bytes.fromhex(my.privatekey))[0] if my and my.privatekey else None    
    # get OTR context (encrypted dialog between Alice and Bob)
    def getContext(self,peer):
        peer in self.ctxs and self.ctxs[peer].state == context.STATE_FINISHED and self.ctxs.pop(peer).disconnect() # close dead channels
        self.ctxs[peer] = self.ctxs.get(peer) or OTRChannel(self,peer)
        return self.ctxs[peer]

    # load my private key
    def loadPrivkey(self):
        my = self.keystore.load(jid=self.jid)
        return (my and my.privatekey) and crypt.PK.parsePrivateKey(bytes.fromhex(my.privatekey))[0]
    
    # save my privatekey
    def savePrivkey(self):
        return self.keystore.save({'jid': self.jid, 'privatekey': self.getPrivkey().serializePrivateKey().hex()})
        self.keystore.save(jid=self.jid,privatekey=self.getPrivkey().serializePrivateKey().hex())

    # load known fingerprints
    def loadTrusts(self):
        for c in self.keystore.load(): self.setTrust(c.jid, c.fingerprint, c.trust)
        for peer in self.keystore.load(): self.setTrust(peer.jid,peer.fingerprint,peer.trust)
    
    # save known fingerprints
    def saveTrusts(self):
        for jid, keys in self.trusts.items(): 
            for fingerprint, trust in keys.items(): self.keystore.save({'jid': jid, 'fingerprint': fingerprint, 'trust': trust})
        for peer,fingerprints in self.trusts.items(): 
            for fingerprint,trust in fingerprints.items(): self.keystore.save(jid=peer,fingerprint=fingerprint,trust=trust)


    # decrypt & receive
    def _decrypt(self, event, callback):
    # decrypt message
    def decrypt(self,event,callback):
        peer = event.stanza.getFrom()
        channel, ctl = self.getContext(peer), self.getControl(peer)
        try:
            peer = event.stanza.getFrom()
            channel = self.getContext(peer)
            text, tlvs = channel.receiveMessage(event.msgtxt.encode(), appdata = {'thread': event.stanza.getThread()}) 
            text = text and text.decode() or ""
        except context.UnencryptedMessage:
            self.log.error('** got plain text over encrypted channel ** %s' % stanza.getBody())
            channel.println("OTR: received plain message [%s]" % event.stanza.getBody())
        except context.ErrorReceived as e:
            self.log.error('** otr error ** %s' % e)
            channel.println("OTR: received error [%s]" % e)
        except crypt.InvalidParameterError:
            self.log.error('** unreadable message **')
            channel.println("OTR: received unreadable message (session expired?)")
        except context.NotEncryptedError:
            self.log.error('** otr session lost **')
            channel.println("OTR: session lost.")

        # resent messages after channel open 
        if channel.resend and channel.state == context.STATE_ENCRYPTED:
            message = channel.resend.pop()
            channel.sendMessage(**message)
            channel.println(message['msg'].decode(), kind='outgoing', encrypted=self.ENCRYPTION_NAME, additional_data=self.ENCRYPTION_DATA)
        
        event.xhtml = None
        event.msgtxt = text
        event.encrypted = self.ENCRYPTION_NAME
        event.additional_data = self.ENCRYPTION_DATA 
        
        callback(event)


    # encrypt & send
    def _encrypt(self, event, callback):
            text, tlvs = channel.receiveMessage(event.msgtxt.encode(),appdata=event.stanza.getThread()) or b''
        except (context.UnencryptedMessage,context.NotEncryptedError,context.ErrorReceived,crypt.InvalidParameterError) as e:
            self.log.error("** got exception while decrypting message: %s" % e)
            channel.printl(OTR.STATUS[e].format(msg=event.msgtxt,err=e.args[0].error))
        else:
            event.msgtxt = text and text.decode() or ""
            event.encrypted = OTR.ENCRYPTION_NAME
            event.additional_data["encrypted"] = {"name":OTR.ENCRYPTION_NAME}
            callback(event)
        finally:
            if channel.mayRetransmit and channel.state and ctl: channel.mayRetransmit = ctl.send_message(channel.lastMessage.decode())

    # encrypt message
    def encrypt(self,event,callback):
        peer = event.msg_iq.getTo()
        channel, ctl = self.getContext(peer), event.control
        if event.xhtml: return ctl.send_message(event.message) # skip xhtml messages 
        try:
            peer = event.msg_iq.getTo()
            channel = self.getContext(peer)
            session = event.session or ChatControlSession(self.stream, peer, None, 'chat')
            encrypted = channel.sendMessage(sendPolicy = context.FRAGMENT_SEND_ALL_BUT_LAST, msg = event.message.encode(), appdata = {'thread': session.thread_id}) or b''
        except context.NotEncryptedError:
            self.log.error("** unable to encrypt message **")
            channel.println('OTR: unable to start conversation')
            return
        
        # resend lost message after session start
        if encrypted == OTR.SESSION_START.encode(): 
            channel.println('OTR: trying to start encrypted conversation')
            channel.resend += [{'sendPolicy': context.FRAGMENT_SEND_ALL, 'msg': event.message.encode(), 'appdata': {'thread': session.thread_id}}]
            event.message = ''

        event.encrypted = 'OTR'
        event.additional_data['encrypted'] = {'name': 'OTR'}
        event.msg_iq.setBody(encrypted.decode())

        callback(event)
            encrypted = channel.sendMessage(context.FRAGMENT_SEND_ALL_BUT_LAST,event.message.encode(),appdata=event.msg_iq.getThread()) or b''
            message = (encrypted != self.getDefaultQueryMessage(OTR.DEFAULT_POLICY.get)) and event.message or "" 
        except context.NotEncryptedError as e:
            self.log.error("** got exception while encrypting message: %s" % e)
            channel.printl(peer,OTR.STATUS[e])
        else:
            event.msg_iq.setBody(encrypted.decode()) # encrypted data goes here 
            event.message = message  # message that will be displayed in our chat goes here
            event.encrypted, event.additional_data["encrypted"] = OTR.ENCRYPTION_NAME, {"name":OTR.ENCRYPTION_NAME} # some mandatory encryption flags
            callback(event)
--- a/plugin.py
+++ b/plugin.py
@ -14,50 +14,48 @@
 #
 # You can always obtain full license text at <http://www.gnu.org/licenses/>.

 # TODO: OTR state notifications
 # TODO: Fingerprints authentication GUI
 # TODO: SMP authentication GUI

 ERROR = None

 import logging
 from gajim.common  import app
 from gajim.plugins import GajimPlugin
 try: from otrplugin.otr import OTR
 except: ERROR = 'Error importing python3-potr module. Make sure it is installed.'

 log = logging.getLogger('gajim.p.otr')
 from gajim.common  import app
 from otrplugin.otr import OTR

 class OTRPlugin(GajimPlugin): 
    log = logging.getLogger('gajim.p.otr')

    def init(self):
        self.encryption_name = OTR.ENCRYPTION_NAME
        self.encryption_name = 'OTR'
        self.description = 'Provides Off-the-Record encryption'
        self.activatable = not ERROR
        self.available_text = ERROR
        self.sessions = {}
        self.session = lambda account: self.sessions.setdefault(account, OTR(account, logger = log))
        self.instances = {}
        self.get_instance = lambda acct: self.instances.get(acct) or self.instances.setdefault(acct,OTR(self,acct))
        self.events_handlers = { 
            'before-change-show': (10, self._on_status_change), 
        }
        self.gui_extension_points = {
            'encrypt' + self.encryption_name: (self._encrypt_message, None),
            'decrypt': (self._decrypt_message, None),
        }
        
    
    @staticmethod
    def activate_encryption(ctl): 
        return True

        
    @staticmethod 
    def encrypt_file(file, account, callback): 
        callback(file)

    def _encrypt_message(self, con, event, callback):
        if not event.message or event.type_ != 'chat': return # drop empty or non-chat messages 
        log.debug('encrypting message: %s' % event)
        otr = self.session(event.account)
        otr._encrypt(event, callback)

    def _decrypt_message(self, con, event, callback):
        if event.name == 'mam-message-received': event.msgtxt = ''   # drop mam messages because we cannot decrypt it post-factum 
        if not event.msgtxt or not event.msgtxt.startswith("?OTR"): return  # drop messages without OTR tag
        log.debug('received otr message: %s' % event)
        otr = self.session(event.account)
        otr._decrypt(event, callback)
    def _encrypt_message(self,con,event,callback):
        if not event.message or event.type_ != 'chat': return # drop empty and non-chat messages  
        self.get_instance(event.conn.name).encrypt(event,callback)

    def _decrypt_message(self,con,event,callback):
        if (event.encrypted) or (event.name[0:2] == 'gc') or not (event.msgtxt or '').startswith('?OTR'): return  # skip non-OTR messages..
        if (event.name[0:3] == 'mam'): return setattr(event,'msgtxt','') # skip MAM messages (we can not decrypt OTR out of session)..
        if (app.config.get_per('encryption','%s-%s'%(event.conn.name,event.jid),'encryption')!=self.encryption_name): return # skip all when encryption not set to OTR
        self.get_instance(event.conn.name).decrypt(event,callback)

    def _on_status_change(self,event):
        if event.show == 'offline':             
            for ctx in self.get_instance(event.conn.name).ctxs.values(): ctx.state and ctx.disconnect()
--- a/potr/init.py
+++ b/potr/init.py
@ -0,0 +1,27 @@
 #    Copyright 2011-2012 Kjell Braden <afflux@pentabarf.de>
 #
 #    This file is part of the python-potr library.
 #
 #    python-potr is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU Lesser General Public License as published by
 #    the Free Software Foundation; either version 3 of the License, or
 #    any later version.
 #
 #    python-potr is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #    GNU Lesser General Public License for more details.
 #
 #    You should have received a copy of the GNU Lesser General Public License
 #    along with this library.  If not, see <http://www.gnu.org/licenses/>.

 # some python3 compatibilty
 from __future__ import unicode_literals

 from potr import context
 from potr import proto
 from potr.utils import human_hash

 ''' version is: (major, minor, patch, sub) with sub being one of 'alpha',
 'beta', 'final' '''
 VERSION = (1, 0, 3, 'alpha')
--- a/potr/compatcrypto/init.py
+++ b/potr/compatcrypto/init.py
@ -0,0 +1,21 @@
 #    Copyright 2012 Kjell Braden <afflux@pentabarf.de>
 #
 #    This file is part of the python-potr library.
 #
 #    python-potr is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU Lesser General Public License as published by
 #    the Free Software Foundation; either version 3 of the License, or
 #    any later version.
 #
 #    python-potr is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #    GNU Lesser General Public License for more details.
 #
 #    You should have received a copy of the GNU Lesser General Public License
 #    along with this library.  If not, see <http://www.gnu.org/licenses/>.


 from potr.compatcrypto.common import *

 from potr.compatcrypto.pycrypto import *
--- a/potr/compatcrypto/pycache/init.cpython-37.pyc
+++ b/potr/compatcrypto/pycache/init.cpython-37.pyc
--- a/potr/compatcrypto/pycache/common.cpython-37.pyc
+++ b/potr/compatcrypto/pycache/common.cpython-37.pyc
--- a/potr/compatcrypto/pycache/pycrypto.cpython-37.pyc
+++ b/potr/compatcrypto/pycache/pycrypto.cpython-37.pyc
--- a/potr/compatcrypto/common.py
+++ b/potr/compatcrypto/common.py
@ -0,0 +1,108 @@
 #    Copyright 2012 Kjell Braden <afflux@pentabarf.de>
 #
 #    This file is part of the python-potr library.
 #
 #    python-potr is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU Lesser General Public License as published by
 #    the Free Software Foundation; either version 3 of the License, or
 #    any later version.
 #
 #    python-potr is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #    GNU Lesser General Public License for more details.
 #
 #    You should have received a copy of the GNU Lesser General Public License
 #    along with this library.  If not, see <http://www.gnu.org/licenses/>.

 # some python3 compatibilty
 from __future__ import unicode_literals

 import logging
 import struct

 from potr.utils import human_hash, bytes_to_long, unpack, pack_mpi

 DEFAULT_KEYTYPE = 0x0000
 pkTypes = {}
 def registerkeytype(cls):
    if cls.keyType is None:
        raise TypeError('registered key class needs a type value')
    pkTypes[cls.keyType] = cls
    return cls

 def generateDefaultKey():
    return pkTypes[DEFAULT_KEYTYPE].generate()

 class PK(object):
    keyType = None

    @classmethod
    def generate(cls):
        raise NotImplementedError

    @classmethod
    def parsePayload(cls, data, private=False):
        raise NotImplementedError

    def sign(self, data):
        raise NotImplementedError
    def verify(self, data):
        raise NotImplementedError
    def fingerprint(self):
        raise NotImplementedError

    def serializePublicKey(self):
        return struct.pack(b'!H', self.keyType) \
                + self.getSerializedPublicPayload()

    def getSerializedPublicPayload(self):
        buf = b''
        for x in self.getPublicPayload():
            buf += pack_mpi(x)
        return buf

    def getPublicPayload(self):
        raise NotImplementedError

    def serializePrivateKey(self):
        return struct.pack(b'!H', self.keyType) \
                + self.getSerializedPrivatePayload()

    def getSerializedPrivatePayload(self):
        buf = b''
        for x in self.getPrivatePayload():
            buf += pack_mpi(x)
        return buf

    def getPrivatePayload(self):
        raise NotImplementedError

    def cfingerprint(self):
        return '{0:040x}'.format(bytes_to_long(self.fingerprint()))

    @classmethod
    def parsePrivateKey(cls, data):
        implCls, data = cls.getImplementation(data)
        logging.debug('Got privkey of type %r', implCls)
        return implCls.parsePayload(data, private=True)

    @classmethod
    def parsePublicKey(cls, data):
        implCls, data = cls.getImplementation(data)
        logging.debug('Got pubkey of type %r', implCls)
        return implCls.parsePayload(data)

    def __str__(self):
        return human_hash(self.cfingerprint())
    def __repr__(self):
        return '<{cls}(fpr=\'{fpr}\')>'.format(
                cls=self.__class__.__name__, fpr=str(self))

    @staticmethod
    def getImplementation(data):
        typeid, data = unpack(b'!H', data)
        cls = pkTypes.get(typeid, None)
        if cls is None:
            raise NotImplementedError('unknown typeid %r' % typeid)
        return cls, data
--- a/potr/compatcrypto/pycrypto.py
+++ b/potr/compatcrypto/pycrypto.py
@ -0,0 +1,149 @@
 #    Copyright 2012 Kjell Braden <afflux@pentabarf.de>
 #
 #    This file is part of the python-potr library.
 #
 #    python-potr is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU Lesser General Public License as published by
 #    the Free Software Foundation; either version 3 of the License, or
 #    any later version.
 #
 #    python-potr is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #    GNU Lesser General Public License for more details.
 #
 #    You should have received a copy of the GNU Lesser General Public License
 #    along with this library.  If not, see <http://www.gnu.org/licenses/>.

 try:
  import Crypto
 except ImportError:
  import crypto as Crypto

 from Crypto import Cipher
 from Crypto.Hash import SHA256 as _SHA256
 from Crypto.Hash import SHA as _SHA1
 from Crypto.Hash import HMAC as _HMAC
 from Crypto.PublicKey import DSA
 import Crypto.Random.random
 from numbers import Number

 from potr.compatcrypto import common
 from potr.utils import read_mpi, bytes_to_long, long_to_bytes

 def SHA256(data):
    return _SHA256.new(data).digest()

 def SHA1(data):
    return _SHA1.new(data).digest()

 def SHA1HMAC(key, data):
    return _HMAC.new(key, msg=data, digestmod=_SHA1).digest()

 def SHA256HMAC(key, data):
    return _HMAC.new(key, msg=data, digestmod=_SHA256).digest()

 def AESCTR(key, counter=0):
    if isinstance(counter, Number):
        counter = Counter(counter)
    if not isinstance(counter, Counter):
        raise TypeError
    return Cipher.AES.new(key, Cipher.AES.MODE_CTR, counter=counter)

 class Counter(object):
    def __init__(self, prefix):
        self.prefix = prefix
        self.val = 0

    def inc(self):
        self.prefix += 1
        self.val = 0

    def __setattr__(self, attr, val):
        if attr == 'prefix':
            self.val = 0
        super(Counter, self).__setattr__(attr, val)

    def __repr__(self):
        return '<Counter(p={p!r},v={v!r})>'.format(p=self.prefix, v=self.val)

    def byteprefix(self):
        return long_to_bytes(self.prefix, 8)

    def __call__(self):
        bytesuffix = long_to_bytes(self.val, 8)
        self.val += 1
        return self.byteprefix() + bytesuffix

@common.registerkeytype
 class DSAKey(common.PK):
    keyType = 0x0000

    def __init__(self, key=None, private=False):
        self.priv = self.pub = None

        if not isinstance(key, tuple):
            raise TypeError('4/5-tuple required for key')

        if len(key) == 5 and private:
            self.priv = DSA.construct(key)
            self.pub = self.priv.publickey()
        elif len(key) == 4 and not private:
            self.pub = DSA.construct(key)
        else:
            raise TypeError('wrong number of arguments for ' \
                    'private={0!r}: got {1} '
                    .format(private, len(key)))

    def getPublicPayload(self):
        return (self.pub.p, self.pub.q, self.pub.g, self.pub.y)

    def getPrivatePayload(self):
        return (self.priv.p, self.priv.q, self.priv.g, self.priv.y, self.priv.x)

    def fingerprint(self):
        return SHA1(self.getSerializedPublicPayload())

    def sign(self, data):
        # 2 <= K <= q
        K = randrange(2, self.priv.q)
        r, s = self.priv.sign(data, K)
        return long_to_bytes(r, 20) + long_to_bytes(s, 20)

    def verify(self, data, sig):
        r, s = bytes_to_long(sig[:20]), bytes_to_long(sig[20:])
        return self.pub.verify(data, (r, s))

    def __hash__(self):
        return bytes_to_long(self.fingerprint())

    def __eq__(self, other):
        if not isinstance(other, type(self)):
            return False
        return self.fingerprint() == other.fingerprint()

    def __ne__(self, other):
        return not (self == other)

    @classmethod
    def generate(cls):
        privkey = DSA.generate(1024)
        return cls((privkey.key.y, privkey.key.g, privkey.key.p, privkey.key.q,
                privkey.key.x), private=True)

    @classmethod
    def parsePayload(cls, data, private=False):
        p, data = read_mpi(data)
        q, data = read_mpi(data)
        g, data = read_mpi(data)
        y, data = read_mpi(data)
        if private:
            x, data = read_mpi(data)
            return cls((y, g, p, q, x), private=True), data
        return cls((y, g, p, q), private=False), data

 def getrandbits(k):
    return Crypto.Random.random.getrandbits(k)

 def randrange(start, stop):
    return Crypto.Random.random.randrange(start, stop)
--- a/potr/context.py
+++ b/potr/context.py
@ -0,0 +1,574 @@
 #    Copyright 2011-2012 Kjell Braden <afflux@pentabarf.de>
 #
 #    This file is part of the python-potr library.
 #
 #    python-potr is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU Lesser General Public License as published by
 #    the Free Software Foundation; either version 3 of the License, or
 #    any later version.
 #
 #    python-potr is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #    GNU Lesser General Public License for more details.
 #
 #    You should have received a copy of the GNU Lesser General Public License
 #    along with this library.  If not, see <http://www.gnu.org/licenses/>.

 # some python3 compatibilty
 from __future__ import unicode_literals

 try:
    type(basestring)
 except NameError:
    # all strings are unicode in python3k
    basestring = str
    unicode = str

 # callable is not available in python 3.0 and 3.1
 try:
    type(callable)
 except NameError:
    from collections import Callable
    def callable(x):
        return isinstance(x, Callable)


 import base64
 import logging
 import struct

 logger = logging.getLogger(__name__)

 from potr import crypt
 from potr import proto
 from potr import compatcrypto

 from time import time

 EXC_UNREADABLE_MESSAGE = 1
 EXC_FINISHED = 2

 HEARTBEAT_INTERVAL = 60
 STATE_PLAINTEXT = 0
 STATE_ENCRYPTED = 1
 STATE_FINISHED = 2
 FRAGMENT_SEND_ALL = 0
 FRAGMENT_SEND_ALL_BUT_FIRST = 1
 FRAGMENT_SEND_ALL_BUT_LAST = 2

 OFFER_NOTSENT = 0
 OFFER_SENT = 1
 OFFER_REJECTED = 2
 OFFER_ACCEPTED = 3

 class Context(object):
    def __init__(self, account, peername):
        self.user = account
        self.peer = peername
        self.policy = {}
        self.crypto = crypt.CryptEngine(self)
        self.tagOffer = OFFER_NOTSENT
        self.mayRetransmit = 0
        self.lastSend = 0
        self.lastMessage = None
        self.state = STATE_PLAINTEXT
        self.trustName = self.peer

        self.fragmentInfo = None
        self.fragment = None
        self.discardFragment()

    def getPolicy(self, key):
        raise NotImplementedError

    def inject(self, msg, appdata=None):
        raise NotImplementedError

    def policyOtrEnabled(self):
        return self.getPolicy('ALLOW_V2') or self.getPolicy('ALLOW_V1')

    def discardFragment(self):
        self.fragmentInfo = (0, 0)
        self.fragment = []

    def fragmentAccumulate(self, message):
        '''Accumulate a fragmented message. Returns None if the fragment is
        to be ignored, returns a string if the message is ready for further
        processing'''

        params = message.split(b',')
        if len(params) < 5 or not params[1].isdigit() or not params[2].isdigit():
            logger.warning('invalid formed fragmented message: %r', params)
            self.discardFragment()
            return message


        K, N = self.fragmentInfo
        try:
            k = int(params[1])
            n = int(params[2])
        except ValueError:
            logger.warning('invalid formed fragmented message: %r', params)
            self.discardFragment()
            return message

        fragData = params[3]

        logger.debug(params)

        if n >= k == 1:
            # first fragment
            self.discardFragment()
            self.fragmentInfo = (k, n)
            self.fragment.append(fragData)
        elif N == n >= k > 1 and k == K+1:
            # accumulate
            self.fragmentInfo = (k, n)
            self.fragment.append(fragData)
        else:
            # bad, discard
            self.discardFragment()
            logger.warning('invalid fragmented message: %r', params)
            return message

        if n == k > 0:
            assembled = b''.join(self.fragment)
            self.discardFragment()
            return assembled

        return None

    def removeFingerprint(self, fingerprint):
        self.user.removeFingerprint(self.trustName, fingerprint)

    def setTrust(self, fingerprint, trustLevel):
        ''' sets the trust level for the given fingerprint.
        trust is usually:
            - the empty string for known but untrusted keys
            - 'verified' for manually verified keys
            - 'smp' for smp-style verified keys '''
        self.user.setTrust(self.trustName, fingerprint, trustLevel)

    def getTrust(self, fingerprint, default=None):
        return self.user.getTrust(self.trustName, fingerprint, default)

    def setCurrentTrust(self, trustLevel):
        self.setTrust(self.crypto.theirPubkey.cfingerprint(), trustLevel)

    def getCurrentKey(self):
        return self.crypto.theirPubkey

    def getCurrentTrust(self):
        ''' returns a 2-tuple: first element is the current fingerprint,
            second is:
            - None if the key is unknown yet
            - a non-empty string if the key is trusted
            - an empty string if the key is untrusted '''
        if self.crypto.theirPubkey is None:
            return None
        return self.getTrust(self.crypto.theirPubkey.cfingerprint(), None)

    def receiveMessage(self, messageData, appdata=None):
        IGN = None, []

        if not self.policyOtrEnabled():
            raise NotOTRMessage(messageData)

        message = self.parse(messageData)

        if message is None:
            # nothing to see. move along.
            return IGN

        logger.debug(repr(message))

        if self.getPolicy('SEND_TAG'):
            if isinstance(message, basestring):
                # received a plaintext message without tag
                # we should not tag anymore
                self.tagOffer = OFFER_REJECTED
            else:
                # got something OTR-ish, cool!
                self.tagOffer = OFFER_ACCEPTED

        if isinstance(message, proto.Query):
            self.handleQuery(message, appdata=appdata)

            if isinstance(message, proto.TaggedPlaintext):
                # it's actually a plaintext message
                if self.state != STATE_PLAINTEXT or \
                        self.getPolicy('REQUIRE_ENCRYPTION'):
                    # but we don't want plaintexts
                    raise UnencryptedMessage(message.msg)

                raise NotOTRMessage(message.msg)

            return IGN

        if isinstance(message, proto.AKEMessage):
            self.crypto.handleAKE(message, appdata=appdata)
            return IGN

        if isinstance(message, proto.DataMessage):
            ignore = message.flags & proto.MSGFLAGS_IGNORE_UNREADABLE

            if self.state != STATE_ENCRYPTED:
                self.sendInternal(proto.Error(
                        'You sent encrypted data, but I wasn\'t expecting it.'
                        .encode('utf-8')), appdata=appdata)
                if ignore:
                    return IGN
                raise NotEncryptedError(EXC_UNREADABLE_MESSAGE)

            try:
                plaintext, tlvs = self.crypto.handleDataMessage(message)
                self.processTLVs(tlvs, appdata=appdata)
                if plaintext and self.lastSend < time() - HEARTBEAT_INTERVAL:
                    self.sendInternal(b'', appdata=appdata)
                return plaintext or None, tlvs
            except crypt.InvalidParameterError:
                if ignore:
                    return IGN
                logger.exception('decryption failed')
                raise
        if isinstance(message, basestring):
            if self.state != STATE_PLAINTEXT or \
                    self.getPolicy('REQUIRE_ENCRYPTION'):
                raise UnencryptedMessage(message)

        if isinstance(message, proto.Error):
            raise ErrorReceived(message)

        raise NotOTRMessage(messageData)

    def sendInternal(self, msg, tlvs=[], appdata=None):
        self.sendMessage(FRAGMENT_SEND_ALL, msg, tlvs=tlvs, appdata=appdata,
                flags=proto.MSGFLAGS_IGNORE_UNREADABLE)

    def sendMessage(self, sendPolicy, msg, flags=0, tlvs=[], appdata=None):
        if self.policyOtrEnabled():
            self.lastSend = time()

            if isinstance(msg, proto.OTRMessage):
                # we want to send a protocol message (probably internal)
                # so we don't need further protocol encryption
                # also we can't add TLVs to arbitrary protocol messages
                if tlvs:
                    raise TypeError('can\'t add tlvs to protocol message')
            else:
                # we got plaintext to send. encrypt it
                msg = self.processOutgoingMessage(msg, flags, tlvs)

            if isinstance(msg, proto.OTRMessage) \
                    and not isinstance(msg, proto.Query):
                # if it's a query message, it must not get fragmented
                return self.sendFragmented(bytes(msg), policy=sendPolicy, appdata=appdata)
            else:
                msg = bytes(msg)
        return msg

    def processOutgoingMessage(self, msg, flags, tlvs=[]):
        isQuery = self.parseExplicitQuery(msg) is not None
        if isQuery:
            return self.user.getDefaultQueryMessage(self.getPolicy)

        if self.state == STATE_PLAINTEXT:
            if self.getPolicy('REQUIRE_ENCRYPTION'):
                if not isQuery:
                    self.lastMessage = msg
                    self.lastSend = time()
                    self.mayRetransmit = 2
                    # TODO notify
                    msg = self.user.getDefaultQueryMessage(self.getPolicy)
                return msg
            if self.getPolicy('SEND_TAG') and \
                self.tagOffer != OFFER_REJECTED and \
                self.shouldTagMessage(msg):
                self.tagOffer = OFFER_SENT
                versions = set()
                if self.getPolicy('ALLOW_V1'):
                    versions.add(1)
                if self.getPolicy('ALLOW_V2'):
                    versions.add(2)
                return proto.TaggedPlaintext(msg, versions)
            return msg
        if self.state == STATE_ENCRYPTED:
            msg = self.crypto.createDataMessage(msg, flags, tlvs)
            self.lastSend = time()
            return msg
        if self.state == STATE_FINISHED:
            raise NotEncryptedError(EXC_FINISHED)

    def disconnect(self, appdata=None):
        if self.state != STATE_FINISHED:
            self.sendInternal(b'', tlvs=[proto.DisconnectTLV()], appdata=appdata)
            self.setState(STATE_PLAINTEXT)
            self.crypto.finished()
        else:
            self.setState(STATE_PLAINTEXT)

    def setState(self, newstate):
        self.state = newstate

    def _wentEncrypted(self):
        self.setState(STATE_ENCRYPTED)

    def sendFragmented(self, msg, policy=FRAGMENT_SEND_ALL, appdata=None):
        mms = self.maxMessageSize(appdata)
        msgLen = len(msg)
        if mms != 0 and msgLen > mms:
            fms = mms - 19
            fragments = [ msg[i:i+fms] for i in range(0, msgLen, fms) ]

            fc = len(fragments)

            if fc > 65535:
                raise OverflowError('too many fragments')

            for fi in range(len(fragments)):
                ctr = unicode(fi+1) + ',' + unicode(fc) + ','
                fragments[fi] = b'?OTR,' + ctr.encode('ascii') \
                        + fragments[fi] + b','

            if policy == FRAGMENT_SEND_ALL:
                for f in fragments:
                    self.inject(f, appdata=appdata)
                return None
            elif policy == FRAGMENT_SEND_ALL_BUT_FIRST:
                for f in fragments[1:]:
                    self.inject(f, appdata=appdata)
                return fragments[0]
            elif policy == FRAGMENT_SEND_ALL_BUT_LAST:
                for f in fragments[:-1]:
                    self.inject(f, appdata=appdata)
                return fragments[-1]

        else:
            if policy == FRAGMENT_SEND_ALL:
                self.inject(msg, appdata=appdata)
                return None
            else:
                return msg

    def processTLVs(self, tlvs, appdata=None):
        for tlv in tlvs:
            if isinstance(tlv, proto.DisconnectTLV):
                logger.info('got disconnect tlv, forcing finished state')
                self.setState(STATE_FINISHED)
                self.crypto.finished()
                # TODO cleanup
                continue
            if isinstance(tlv, proto.SMPTLV):
                self.crypto.smpHandle(tlv, appdata=appdata)
                continue
            logger.info('got unhandled tlv: {0!r}'.format(tlv))

    def smpAbort(self, appdata=None):
        if self.state != STATE_ENCRYPTED:
            raise NotEncryptedError
        self.crypto.smpAbort(appdata=appdata)

    def smpIsValid(self):
        return self.crypto.smp and self.crypto.smp.prog != crypt.SMPPROG_CHEATED

    def smpIsSuccess(self):
        return self.crypto.smp.prog == crypt.SMPPROG_SUCCEEDED \
                if self.crypto.smp else None

    def smpGotSecret(self, secret, question=None, appdata=None):
        if self.state != STATE_ENCRYPTED:
            raise NotEncryptedError
        self.crypto.smpSecret(secret, question=question, appdata=appdata)

    def smpInit(self, secret, question=None, appdata=None):
        if self.state != STATE_ENCRYPTED:
            raise NotEncryptedError
        self.crypto.smp = None
        self.crypto.smpSecret(secret, question=question, appdata=appdata)

    def handleQuery(self, message, appdata=None):
        if 2 in message.versions and self.getPolicy('ALLOW_V2'):
            self.authStartV2(appdata=appdata)
        elif 1 in message.versions and self.getPolicy('ALLOW_V1'):
            self.authStartV1(appdata=appdata)

    def authStartV1(self, appdata=None):
        raise NotImplementedError()

    def authStartV2(self, appdata=None):
        self.crypto.startAKE(appdata=appdata)

    def parseExplicitQuery(self, message):
        otrTagPos = message.find(proto.OTRTAG)

        if otrTagPos == -1:
            return None

        indexBase = otrTagPos + len(proto.OTRTAG)

        if len(message) <= indexBase:
            return None

        compare = message[indexBase]

        hasq = compare == b'?'[0]
        hasv = compare == b'v'[0]

        if not hasq and not hasv:
            return None

        hasv |= len(message) > indexBase+1 and message[indexBase+1] == b'v'[0]
        if hasv:
            end = message.find(b'?', indexBase+1)
        else:
            end = indexBase+1
        return message[indexBase:end]

    def parse(self, message, nofragment=False):
        otrTagPos = message.find(proto.OTRTAG)
        if otrTagPos == -1:
            if proto.MESSAGE_TAG_BASE in message:
                return proto.TaggedPlaintext.parse(message)
            else:
                return message

        indexBase = otrTagPos + len(proto.OTRTAG)

        if len(message) <= indexBase:
            return message

        compare = message[indexBase]

        if nofragment is False and compare == b','[0]:
            message = self.fragmentAccumulate(message[indexBase:])
            if message is None:
                return None
            else:
                return self.parse(message, nofragment=True)
        else:
            self.discardFragment()

        queryPayload = self.parseExplicitQuery(message)
        if queryPayload is not None:
            return proto.Query.parse(queryPayload)

        if compare == b':'[0] and len(message) > indexBase + 4:
            try:
                infoTag = base64.b64decode(message[indexBase+1:indexBase+5])
                classInfo = struct.unpack(b'!HB', infoTag)

                cls = proto.messageClasses.get(classInfo, None)
                if cls is None:
                    return message

                logger.debug('{user} got msg {typ!r}' \
                        .format(user=self.user.name, typ=cls))
                return cls.parsePayload(message[indexBase+5:])
            except (TypeError, struct.error):
                logger.exception('could not parse OTR message %s', message)
                return message

        if message[indexBase:indexBase+7] == b' Error:':
            return proto.Error(message[indexBase+7:])

        return message

    def maxMessageSize(self, appdata=None):
        """Return the max message size for this context."""
        return self.user.maxMessageSize

    def getExtraKey(self, extraKeyAppId=None, extraKeyAppData=None, appdata=None):
        """ retrieves the generated extra symmetric key.

        if extraKeyAppId is set, notifies the chat partner about intended
        usage (additional application specific information can be supplied in
        extraKeyAppData).

        returns the 256 bit symmetric key """

        if self.state != STATE_ENCRYPTED:
            raise NotEncryptedError
        if extraKeyAppId is not None:
            tlvs = [proto.ExtraKeyTLV(extraKeyAppId, extraKeyAppData)]
            self.sendInternal(b'', tlvs=tlvs, appdata=appdata)
        return self.crypto.extraKey

    def shouldTagMessage(self, msg):
        """Hook to decide whether to tag a message based on its contents."""
        return True

 class Account(object):
    contextclass = Context
    def __init__(self, name, protocol, maxMessageSize, privkey=None):
        self.name = name
        self.privkey = privkey
        self.policy = {}
        self.protocol = protocol
        self.ctxs = {}
        self.trusts = {}
        self.maxMessageSize = maxMessageSize
        self.defaultQuery = '?OTRv{versions}?\nI would like to start ' \
                'an Off-the-Record private conversation. However, you ' \
                'do not have a plugin to support that.\nSee '\
                'https://otr.cypherpunks.ca/ for more information.'

    def __repr__(self):
        return '<{cls}(name={name!r})>'.format(cls=self.__class__.__name__,
                name=self.name)

    def getPrivkey(self, autogen=True):
        if self.privkey is None:
            self.privkey = self.loadPrivkey()
        if self.privkey is None:
            if autogen is True:
                self.privkey = compatcrypto.generateDefaultKey()
                self.savePrivkey()
            else:
                raise LookupError
        return self.privkey

    def loadPrivkey(self):
        raise NotImplementedError

    def savePrivkey(self):
        raise NotImplementedError

    def saveTrusts(self):
        raise NotImplementedError

    def getContext(self, uid, newCtxCb=None):
        if uid not in self.ctxs:
            self.ctxs[uid] = self.contextclass(self, uid)
            if callable(newCtxCb):
                newCtxCb(self.ctxs[uid])
        return self.ctxs[uid]

    def getDefaultQueryMessage(self, policy):
        v  = '2' if policy('ALLOW_V2') else ''
        msg = self.defaultQuery.format(versions=v)
        return msg.encode('ascii')

    def setTrust(self, key, fingerprint, trustLevel):
        if key not in self.trusts:
            self.trusts[key] = {}
        self.trusts[key][fingerprint] = trustLevel
        self.saveTrusts()

    def getTrust(self, key, fingerprint, default=None):
        if key not in self.trusts:
            return default
        return self.trusts[key].get(fingerprint, default)

    def removeFingerprint(self, key, fingerprint):
        if key in self.trusts and fingerprint in self.trusts[key]:
            del self.trusts[key][fingerprint]

 class NotEncryptedError(RuntimeError):
    pass
 class UnencryptedMessage(RuntimeError):
    pass
 class ErrorReceived(RuntimeError):
    pass
 class NotOTRMessage(RuntimeError):
    pass
--- a/potr/crypt.py
+++ b/potr/crypt.py
@ -0,0 +1,801 @@
 #    Copyright 2011-2012 Kjell Braden <afflux@pentabarf.de>
 #
 #    This file is part of the python-potr library.
 #
 #    python-potr is free software; you can redistribute it and/or modify
 #    it under the terms of the GNU Lesser General Public License as published by
 #    the Free Software Foundation; either version 3 of the License, or
 #    any later version.
 #
 #    python-potr is distributed in the hope that it will be useful,
 #    but WITHOUT ANY WARRANTY; without even the implied warranty of
 #    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 #    GNU Lesser General Public License for more details.
 #
 #    You should have received a copy of the GNU Lesser General Public License
 #    along with this library.  If not, see <http://www.gnu.org/licenses/>.

 # some python3 compatibilty
 from __future__ import unicode_literals

 import logging
 import struct


 from potr.compatcrypto import SHA256, SHA1, SHA1HMAC, SHA256HMAC, \
        Counter, AESCTR, PK, getrandbits, randrange
 from potr.utils import bytes_to_long, long_to_bytes, pack_mpi, read_mpi
 from potr import proto

 logger = logging.getLogger(__name__)

 STATE_NONE = 0
 STATE_AWAITING_DHKEY = 1
 STATE_AWAITING_REVEALSIG = 2
 STATE_AWAITING_SIG = 4
 STATE_V1_SETUP = 5


 DH_MODULUS = 2410312426921032588552076022197566074856950548502459942654116941958108831682612228890093858261341614673227141477904012196503648957050582631942730706805009223062734745341073406696246014589361659774041027169249453200378729434170325843778659198143763193776859869524088940195577346119843545301547043747207749969763750084308926339295559968882457872412993810129130294592999947926365264059284647209730384947211681434464714438488520940127459844288859336526896320919633919
 DH_MODULUS_2 = DH_MODULUS-2
 DH_GENERATOR = 2
 DH_BITS = 1536
 DH_MAX = 2**DH_BITS
 SM_ORDER = (DH_MODULUS - 1) // 2

 def check_group(n):
    return 2 <= n <= DH_MODULUS_2
 def check_exp(n):
    return 1 <= n < SM_ORDER

 def SHA256HMAC160(key, data):
    return SHA256HMAC(key, data)[:20]

 class DH(object):
    @classmethod
    def set_params(cls, prime, gen):
        cls.prime = prime
        cls.gen = gen

    def __init__(self):
        self.priv = randrange(2, 2**320)
        self.pub = pow(self.gen, self.priv, self.prime)

 DH.set_params(DH_MODULUS, DH_GENERATOR)

 class DHSession(object):
    def __init__(self, sendenc, sendmac, rcvenc, rcvmac):
        self.sendenc = sendenc
        self.sendmac = sendmac
        self.rcvenc = rcvenc
        self.rcvmac = rcvmac
        self.sendctr = Counter(0)
        self.rcvctr = Counter(0)
        self.sendmacused = False
        self.rcvmacused = False

    def __repr__(self):
        return '<{cls}(send={s!r},rcv={r!r})>' \
                .format(cls=self.__class__.__name__,
                        s=self.sendmac, r=self.rcvmac)

    @classmethod
    def create(cls, dh, y):
        s = pow(y, dh.priv, DH_MODULUS)
        sb = pack_mpi(s)

        if dh.pub > y:
            sendbyte = b'\1'
            rcvbyte = b'\2'
        else:
            sendbyte = b'\2'
            rcvbyte = b'\1'

        sendenc = SHA1(sendbyte + sb)[:16]
        sendmac = SHA1(sendenc)
        rcvenc = SHA1(rcvbyte + sb)[:16]
        rcvmac = SHA1(rcvenc)
        return cls(sendenc, sendmac, rcvenc, rcvmac)

 class CryptEngine(object):
    def __init__(self, ctx):
        self.ctx = ctx
        self.ake = None

        self.sessionId = None
        self.sessionIdHalf = False
        self.theirKeyid = 0
        self.theirY = None
        self.theirOldY = None

        self.ourOldDHKey = None
        self.ourDHKey = None
        self.ourKeyid = 0

        self.sessionkeys = {0:{0:None, 1:None}, 1:{0:None, 1:None}}
        self.theirPubkey = None
        self.savedMacKeys = []

        self.smp = None
        self.extraKey = None

    def revealMacs(self, ours=True):
        if ours:
            dhs = self.sessionkeys[1].values()
        else:
            dhs = ( v[1] for v in self.sessionkeys.values() )
        for v in dhs:
            if v is not None:
                if v.rcvmacused:
                    self.savedMacKeys.append(v.rcvmac)
                if v.sendmacused:
                    self.savedMacKeys.append(v.sendmac)

    def rotateDHKeys(self):
        self.revealMacs(ours=True)
        self.ourOldDHKey = self.ourDHKey
        self.sessionkeys[1] = self.sessionkeys[0].copy()
        self.ourDHKey = DH()
        self.ourKeyid += 1

        self.sessionkeys[0][0] = None if self.theirY is None else \
                DHSession.create(self.ourDHKey, self.theirY)
        self.sessionkeys[0][1] = None if self.theirOldY is None else \
                DHSession.create(self.ourDHKey, self.theirOldY)

        logger.debug('{0}: Refreshing ourkey to {1} {2}'.format(
                self.ctx.user.name, self.ourKeyid, self.sessionkeys))

    def rotateYKeys(self, new_y):
        self.theirOldY = self.theirY
        self.revealMacs(ours=False)
        self.sessionkeys[0][1] = self.sessionkeys[0][0]
        self.sessionkeys[1][1] = self.sessionkeys[1][0]
        self.theirY = new_y
        self.theirKeyid += 1

        self.sessionkeys[0][0] = DHSession.create(self.ourDHKey, self.theirY)
        self.sessionkeys[1][0] = DHSession.create(self.ourOldDHKey, self.theirY)

        logger.debug('{0}: Refreshing theirkey to {1} {2}'.format(
                self.ctx.user.name, self.theirKeyid, self.sessionkeys))

    def handleDataMessage(self, msg):
        if self.saneKeyIds(msg) is False:
            raise InvalidParameterError

        sesskey = self.sessionkeys[self.ourKeyid - msg.rkeyid] \
                [self.theirKeyid - msg.skeyid]

        logger.debug('sesskeys: {0!r}, our={1}, r={2}, their={3}, s={4}' \
                .format(self.sessionkeys, self.ourKeyid, msg.rkeyid,
                        self.theirKeyid, msg.skeyid))

        if msg.mac != SHA1HMAC(sesskey.rcvmac, msg.getMacedData()):
            logger.error('HMACs don\'t match')
            raise InvalidParameterError
        sesskey.rcvmacused = True

        newCtrPrefix = bytes_to_long(msg.ctr)
        if newCtrPrefix <= sesskey.rcvctr.prefix:
            logger.error('CTR must increase (old %r, new %r)',
                    sesskey.rcvctr.prefix, newCtrPrefix)
            raise InvalidParameterError

        sesskey.rcvctr.prefix = newCtrPrefix

        logger.debug('handle: enc={0!r} mac={1!r} ctr={2!r}' \
                .format(sesskey.rcvenc, sesskey.rcvmac, sesskey.rcvctr))

        plaintextData = AESCTR(sesskey.rcvenc, sesskey.rcvctr) \
                .decrypt(msg.encmsg)

        if b'\0' in plaintextData:
            plaintext, tlvData = plaintextData.split(b'\0', 1)
            tlvs = proto.TLV.parse(tlvData)
        else:
            plaintext = plaintextData
            tlvs = []

        if msg.rkeyid == self.ourKeyid:
            self.rotateDHKeys()
        if msg.skeyid == self.theirKeyid:
            self.rotateYKeys(bytes_to_long(msg.dhy))

        return plaintext, tlvs

    def smpSecret(self, secret, question=None, appdata=None):
        if self.smp is None:
            logger.debug('Creating SMPHandler')
            self.smp = SMPHandler(self)

        self.smp.gotSecret(secret, question=question, appdata=appdata)

    def smpHandle(self, tlv, appdata=None):
        if self.smp is None:
            logger.debug('Creating SMPHandler')
            self.smp = SMPHandler(self)
        self.smp.handle(tlv, appdata=appdata)

    def smpAbort(self, appdata=None):
        if self.smp is None:
            logger.debug('Creating SMPHandler')
            self.smp = SMPHandler(self)
        self.smp.abort(appdata=appdata)

    def createDataMessage(self, message, flags=0, tlvs=None):
        # check MSGSTATE
        if self.theirKeyid == 0:
            raise InvalidParameterError

        if tlvs is None:
            tlvs = []

        sess = self.sessionkeys[1][0]
        sess.sendctr.inc()

        logger.debug('create: enc={0!r} mac={1!r} ctr={2!r}' \
                .format(sess.sendenc, sess.sendmac, sess.sendctr))

        # plaintext + TLVS
        plainBuf = message + b'\0' + b''.join([ bytes(t) for t in tlvs])
        encmsg = AESCTR(sess.sendenc, sess.sendctr).encrypt(plainBuf)

        msg = proto.DataMessage(flags, self.ourKeyid-1, self.theirKeyid,
                long_to_bytes(self.ourDHKey.pub), sess.sendctr.byteprefix