[openpgp] Inital commit
This commit is contained in:
Philipp Hörist
0
openpgp/modules/__init__.py
Normal file
0
openpgp/modules/__init__.py
Normal file
538
openpgp/modules/openpgp.py
Normal file
538
openpgp/modules/openpgp.py
Normal file
@@ -0,0 +1,538 @@
|
||||
# Copyright (C) 2018 Philipp Hörist <philipp AT hoerist.com>
|
||||
#
|
||||
# This file is part of Gajim.
|
||||
#
|
||||
# Gajim is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published
|
||||
# by the Free Software Foundation; version 3 only.
|
||||
#
|
||||
# Gajim is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Gajim. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# XEP-0373: OpenPGP for XMPP
|
||||
|
||||
import time
|
||||
import logging
|
||||
from pathlib import Path
|
||||
from base64 import b64decode, b64encode
|
||||
|
||||
from nbxmpp import Node, isResultNode
|
||||
|
||||
from gajim.common import app
|
||||
from gajim.common import configpaths
|
||||
from gajim.common.connection_handlers_events import MessageNotSentEvent
|
||||
|
||||
from openpgp.modules import util
|
||||
from openpgp.modules.util import NS_OPENPGP_PUBLIC_KEYS
|
||||
from openpgp.modules.util import NS_OPENPGP
|
||||
from openpgp.modules.util import Key
|
||||
from openpgp.modules.util import Trust
|
||||
from openpgp.modules.util import VerifyFailed
|
||||
from openpgp.modules.util import DecryptionFailed
|
||||
from openpgp.backend.sql import Storage
|
||||
from openpgp.backend.pygpg import PGPContext
|
||||
|
||||
|
||||
log = logging.getLogger('gajim.plugin_system.openpgp')
|
||||
|
||||
|
||||
ENCRYPTION_NAME = 'OpenPGP'
|
||||
|
||||
# Module name
|
||||
name = 'OpenPGP'
|
||||
zeroconf = False
|
||||
|
||||
|
||||
class KeyData:
|
||||
'''
|
||||
Holds all data related to a certain key
|
||||
'''
|
||||
def __init__(self, contact_data):
|
||||
self._contact_data = contact_data
|
||||
self.fingerprint = None
|
||||
self.active = False
|
||||
self._trust = Trust.UNKNOWN
|
||||
self.timestamp = None
|
||||
self.comment = None
|
||||
self.has_pubkey = False
|
||||
|
||||
@property
|
||||
def trust(self):
|
||||
return self._trust
|
||||
|
||||
@trust.setter
|
||||
def trust(self, value):
|
||||
if value not in (Trust.NOT_TRUSTED,
|
||||
Trust.UNKNOWN,
|
||||
Trust.BLIND,
|
||||
Trust.VERIFIED):
|
||||
raise ValueError('Trust value not allowed: %s' % value)
|
||||
self._trust = value
|
||||
self._contact_data.set_trust(self.fingerprint, self._trust)
|
||||
|
||||
@classmethod
|
||||
def from_key(cls, contact_data, key, trust):
|
||||
keydata = cls(contact_data)
|
||||
keydata.fingerprint = key.fingerprint
|
||||
keydata.timestamp = key.date
|
||||
keydata.active = True
|
||||
keydata._trust = trust
|
||||
return keydata
|
||||
|
||||
@classmethod
|
||||
def from_row(cls, contact_data, row):
|
||||
keydata = cls(contact_data)
|
||||
keydata.fingerprint = row.fingerprint
|
||||
keydata.timestamp = row.timestamp
|
||||
keydata.comment = row.comment
|
||||
keydata._trust = row.trust
|
||||
keydata.active = row.active
|
||||
return keydata
|
||||
|
||||
def delete(self):
|
||||
self._contact_data.delete_key(self.fingerprint)
|
||||
|
||||
|
||||
class ContactData:
|
||||
'''
|
||||
Holds all data related to a contact
|
||||
'''
|
||||
def __init__(self, jid, storage, pgp):
|
||||
self.jid = jid
|
||||
self._key_store = {}
|
||||
self._storage = storage
|
||||
self._pgp = pgp
|
||||
|
||||
@property
|
||||
def userid(self):
|
||||
if self._jid is None:
|
||||
raise ValueError('JID not set')
|
||||
return 'xmpp:%s' % self._jid
|
||||
|
||||
@property
|
||||
def default_trust(self):
|
||||
for key in self._key_store:
|
||||
if key.trust in (Trust.NOT_TRUSTED, Trust.BLIND):
|
||||
return Trust.UNKNOWN
|
||||
return Trust.BLIND
|
||||
|
||||
def db_values(self):
|
||||
for key in self._key_store.values():
|
||||
yield (self.jid,
|
||||
key.fingerprint,
|
||||
key.active,
|
||||
key.trust,
|
||||
key.timestamp,
|
||||
key.comment)
|
||||
|
||||
def add_from_key(self, key):
|
||||
try:
|
||||
keydata = self._key_store[key.fingerprint]
|
||||
except KeyError:
|
||||
keydata = KeyData.from_key(self, key, self.default_trust)
|
||||
self._key_store[key.fingerprint] = keydata
|
||||
log.info('Add from key: %s %s', self.jid, keydata.fingerprint)
|
||||
return keydata
|
||||
|
||||
def add_from_db(self, row):
|
||||
try:
|
||||
keydata = self._key_store[row.fingerprint]
|
||||
except KeyError:
|
||||
keydata = KeyData.from_row(self, row)
|
||||
self._key_store[row.fingerprint] = keydata
|
||||
log.info('Add from row: %s %s', self.jid, row.fingerprint)
|
||||
return keydata
|
||||
|
||||
def process_keylist(self, keylist):
|
||||
log.info('Process keylist: %s %s', self.jid, keylist)
|
||||
|
||||
if keylist is None:
|
||||
for keydata in self._key_store.values():
|
||||
keydata.active = False
|
||||
self._storage.save_contact(self.db_values())
|
||||
return []
|
||||
|
||||
missing_pub_keys = []
|
||||
fingerprints = set([key.fingerprint for key in keylist])
|
||||
if fingerprints == self._key_store.keys():
|
||||
log.info('No updates found')
|
||||
for key in self._key_store.values():
|
||||
if not key.has_pubkey:
|
||||
missing_pub_keys.append(key.fingerprint)
|
||||
return missing_pub_keys
|
||||
|
||||
for keydata in self._key_store.values():
|
||||
keydata.active = False
|
||||
|
||||
for key in keylist:
|
||||
try:
|
||||
keydata = self._key_store[key.fingerprint]
|
||||
keydata.active = True
|
||||
if not keydata.has_pubkey:
|
||||
missing_pub_keys.append(keydata.fingerprint)
|
||||
except KeyError:
|
||||
keydata = self.add_from_key(key)
|
||||
missing_pub_keys.append(keydata.fingerprint)
|
||||
|
||||
self._storage.save_contact(self.db_values())
|
||||
return missing_pub_keys
|
||||
|
||||
def set_public_key(self, fingerprint):
|
||||
try:
|
||||
keydata = self._key_store[fingerprint]
|
||||
except KeyError:
|
||||
log.warning('Set public key on unknown fingerprint',
|
||||
self.jid, fingerprint)
|
||||
else:
|
||||
keydata.has_pubkey = True
|
||||
log.info('Set public key: %s %s', self.jid, fingerprint)
|
||||
|
||||
def get_keys(self, only_trusted=True):
|
||||
keys = list(self._key_store.values())
|
||||
if not only_trusted:
|
||||
return keys
|
||||
return [k for k in keys if k.active and k.trust in (Trust.VERIFIED,
|
||||
Trust.BLIND)]
|
||||
|
||||
def set_trust(self, fingerprint, trust):
|
||||
self._storage.set_trust(self.jid, fingerprint, trust)
|
||||
|
||||
def delete_key(self, fingerprint):
|
||||
self._storage.delete_key(self.jid, fingerprint)
|
||||
self._pgp.delete_key(fingerprint)
|
||||
del self._key_store[fingerprint]
|
||||
|
||||
|
||||
class PGPContacts:
|
||||
'''
|
||||
Holds all contacts available for PGP encryption
|
||||
'''
|
||||
def __init__(self, pgp, storage):
|
||||
self._contacts = {}
|
||||
self._storage = storage
|
||||
self._pgp = pgp
|
||||
self._load_from_storage()
|
||||
self._load_from_keyring()
|
||||
|
||||
def _load_from_keyring(self):
|
||||
log.info('Load keys from keyring')
|
||||
keyring = self._pgp.get_keys()
|
||||
for key in keyring:
|
||||
log.info('Found: %s %s', key.jid, key.fingerprint)
|
||||
self.set_public_key(key.jid, key.fingerprint)
|
||||
|
||||
def _load_from_storage(self):
|
||||
log.info('Load contacts from storage')
|
||||
rows = self._storage.load_contacts()
|
||||
if rows is None:
|
||||
return
|
||||
|
||||
for row in rows:
|
||||
log.info('Found: %s %s', row.jid, row.fingerprint)
|
||||
try:
|
||||
contact_data = self._contacts[row.jid]
|
||||
except KeyError:
|
||||
contact_data = ContactData(row.jid, self._storage, self._pgp)
|
||||
contact_data.add_from_db(row)
|
||||
self._contacts[row.jid] = contact_data
|
||||
else:
|
||||
contact_data.add_from_db(row)
|
||||
|
||||
def process_keylist(self, jid, keylist):
|
||||
try:
|
||||
contact_data = self._contacts[jid]
|
||||
except KeyError:
|
||||
contact_data = ContactData(jid, self._storage, self._pgp)
|
||||
missing_pub_keys = contact_data.process_keylist(keylist)
|
||||
self._contacts[jid] = contact_data
|
||||
else:
|
||||
missing_pub_keys = contact_data.process_keylist(keylist)
|
||||
|
||||
return missing_pub_keys
|
||||
|
||||
def set_public_key(self, jid, fingerprint):
|
||||
try:
|
||||
contact_data = self._contacts[jid]
|
||||
except KeyError:
|
||||
log.warning('ContactData not found: %s %s', jid, fingerprint)
|
||||
else:
|
||||
contact_data.set_public_key(fingerprint)
|
||||
|
||||
def get_keys(self, jid, only_trusted=True):
|
||||
try:
|
||||
contact_data = self._contacts[jid]
|
||||
return contact_data.get_keys(only_trusted=only_trusted)
|
||||
except KeyError:
|
||||
return []
|
||||
|
||||
|
||||
class OpenPGP:
|
||||
def __init__(self, con):
|
||||
self._con = con
|
||||
self._account = con.name
|
||||
|
||||
self.handlers = []
|
||||
|
||||
self.own_jid = self.get_own_jid(stripped=True)
|
||||
|
||||
path = Path(configpaths.get('MY_DATA')) / 'openpgp' / self.own_jid
|
||||
if not path.exists():
|
||||
path.mkdir(parents=True)
|
||||
|
||||
self._pgp = PGPContext(self.own_jid, path)
|
||||
self._storage = Storage(path)
|
||||
self._contacts = PGPContacts(self._pgp, self._storage)
|
||||
self._fingerprint, self._date = self.get_own_key_details()
|
||||
log.info('Own Fingerprint at start: %s', self._fingerprint)
|
||||
|
||||
@property
|
||||
def secret_key_available(self):
|
||||
return self._fingerprint is not None
|
||||
|
||||
def get_own_jid(self, stripped=False):
|
||||
if stripped:
|
||||
return self._con.get_own_jid().getStripped()
|
||||
return self._con.get_own_jid()
|
||||
|
||||
def get_own_key_details(self):
|
||||
self._fingerprint, self._date = self._pgp.get_own_key_details()
|
||||
return self._fingerprint, self._date
|
||||
|
||||
def generate_key(self):
|
||||
self._pgp.generate_key()
|
||||
|
||||
def publish_key(self):
|
||||
log.info('%s => Publish key', self._account)
|
||||
key = self._pgp.export_key(self._fingerprint)
|
||||
|
||||
date = time.strftime(
|
||||
'%Y-%m-%dT%H:%M:%SZ', time.gmtime(self._date))
|
||||
pubkey_node = Node('pubkey', attrs={'xmlns': NS_OPENPGP,
|
||||
'date': date})
|
||||
data = pubkey_node.addChild('data')
|
||||
data.addData(b64encode(key).decode('utf8'))
|
||||
node = '%s:%s' % (NS_OPENPGP_PUBLIC_KEYS, self._fingerprint)
|
||||
|
||||
self._con.get_module('PubSub').send_pb_publish(
|
||||
self.own_jid, node, pubkey_node,
|
||||
id_='current', cb=self._public_result)
|
||||
|
||||
def _publish_key_list(self, keylist=None):
|
||||
if keylist is None:
|
||||
keylist = [Key(self._fingerprint, self._date)]
|
||||
log.info('%s => Publish keys list', self._account)
|
||||
self._con.get_module('PGPKeylist').send(keylist)
|
||||
|
||||
def _public_result(self, con, stanza):
|
||||
if not isResultNode(stanza):
|
||||
log.error('%s => Publishing failed: %s',
|
||||
self._account, stanza.getError())
|
||||
|
||||
def _query_public_key(self, jid, fingerprint):
|
||||
log.info('%s => Fetch public key %s - %s',
|
||||
self._account, fingerprint, jid)
|
||||
node = '%s:%s' % (NS_OPENPGP_PUBLIC_KEYS, fingerprint)
|
||||
self._con.get_module('PubSub').send_pb_retrieve(
|
||||
jid, node, cb=self._public_key_received, fingerprint=fingerprint)
|
||||
|
||||
def _public_key_received(self, con, stanza, fingerprint):
|
||||
if not isResultNode(stanza):
|
||||
log.error('%s => Public Key not found: %s',
|
||||
self._account, stanza.getError())
|
||||
return
|
||||
pubkey = util.unpack_public_key(stanza, fingerprint)
|
||||
if pubkey is None:
|
||||
log.warning('Invalid public key received:\n%s', stanza)
|
||||
return
|
||||
|
||||
jid = stanza.getFrom().getStripped()
|
||||
result = self._pgp.import_key(pubkey, jid)
|
||||
if result is not None:
|
||||
self._contacts.set_public_key(jid, fingerprint)
|
||||
|
||||
def query_key_list(self, jid=None):
|
||||
if jid is None:
|
||||
jid = self.own_jid
|
||||
log.info('%s => Fetch keys list %s', self._account, jid)
|
||||
self._con.get_module('PubSub').send_pb_retrieve(
|
||||
jid, NS_OPENPGP_PUBLIC_KEYS,
|
||||
cb=self._query_key_list_result)
|
||||
|
||||
def _query_key_list_result(self, con, stanza):
|
||||
from_jid = stanza.getFrom()
|
||||
if from_jid is None:
|
||||
from_jid = self.own_jid
|
||||
else:
|
||||
from_jid = from_jid.getStripped()
|
||||
|
||||
if not isResultNode(stanza):
|
||||
log.error('%s => Keys list query failed: %s',
|
||||
self._account, stanza.getError())
|
||||
if from_jid == self.own_jid and self._fingerprint is not None:
|
||||
self._publish_key_list()
|
||||
return
|
||||
|
||||
from_jid = stanza.getFrom()
|
||||
if from_jid is None:
|
||||
from_jid = self.own_jid
|
||||
else:
|
||||
from_jid = from_jid.getStripped()
|
||||
|
||||
keylist = util.unpack_public_key_list(stanza, from_jid)
|
||||
self.key_list_received(keylist, from_jid)
|
||||
|
||||
def key_list_received(self, keylist, from_jid):
|
||||
if keylist is None:
|
||||
log.warning('Invalid keys list received')
|
||||
if from_jid == self.own_jid and self._fingerprint is not None:
|
||||
self._publish_key_list()
|
||||
return
|
||||
|
||||
if not keylist:
|
||||
log.warning('%s => Empty keys list received from %s',
|
||||
self._account, from_jid)
|
||||
self._contacts.process_keylist(self.own_jid, keylist)
|
||||
if from_jid == self.own_jid and self._fingerprint is not None:
|
||||
self._publish_key_list()
|
||||
return
|
||||
|
||||
if from_jid == self.own_jid:
|
||||
log.info('Received own keys list')
|
||||
for key in keylist:
|
||||
log.info(key.fingerprint)
|
||||
for key in keylist:
|
||||
# Check if own fingerprint is published
|
||||
if key.fingerprint == self._fingerprint:
|
||||
log.info('Own key found in keys list')
|
||||
return
|
||||
log.info('Own key not published')
|
||||
if self._fingerprint is not None:
|
||||
keylist.append(Key(self._fingerprint, None))
|
||||
self._publish_key_list(keylist)
|
||||
return
|
||||
|
||||
missing_pub_keys = self._contacts.process_keylist(from_jid, keylist)
|
||||
|
||||
for key in keylist:
|
||||
log.info(key.fingerprint)
|
||||
|
||||
for fingerprint in missing_pub_keys:
|
||||
self._query_public_key(from_jid, fingerprint)
|
||||
|
||||
def decrypt_message(self, obj, callback):
|
||||
if obj.encrypted:
|
||||
# Another Plugin already decrypted the message
|
||||
return
|
||||
|
||||
if obj.name == 'message-received':
|
||||
enc_tag = obj.stanza.getTag('openpgp', namespace=NS_OPENPGP)
|
||||
jid = obj.jid
|
||||
else:
|
||||
enc_tag = obj.message.getTag('openpgp', namespace=NS_OPENPGP)
|
||||
jid = obj.with_
|
||||
|
||||
if enc_tag is None:
|
||||
return
|
||||
|
||||
log.info('Received OpenPGP message from: %s', jid)
|
||||
b64encode_payload = enc_tag.getData()
|
||||
encrypted_payload = b64decode(b64encode_payload)
|
||||
|
||||
try:
|
||||
decrypted_payload = self._pgp.decrypt(encrypted_payload)
|
||||
except DecryptionFailed as error:
|
||||
log.warning(error)
|
||||
return
|
||||
|
||||
signcrypt = Node(node=decrypted_payload)
|
||||
|
||||
signcrypt_jid = signcrypt.getTagAttr('to', 'jid')
|
||||
if self.own_jid != signcrypt_jid:
|
||||
log.warning('signcrypt "to" attr %s != %s',
|
||||
self.own_jid, signcrypt_jid)
|
||||
log.debug(signcrypt)
|
||||
return
|
||||
|
||||
payload = signcrypt.getTag('payload')
|
||||
|
||||
body = None
|
||||
if obj.name == 'message-received':
|
||||
obj.stanza.delChild(enc_tag)
|
||||
for node in payload.getChildren():
|
||||
if node.name == 'body':
|
||||
body = node.getData()
|
||||
obj.stanza.setTagData('body', body)
|
||||
else:
|
||||
obj.stanza.addChild(node=node)
|
||||
else:
|
||||
obj.msg_.delChild(enc_tag)
|
||||
for node in payload.getChildren():
|
||||
if node.name == 'body':
|
||||
body = node.getData()
|
||||
obj.msg_.setTagData('body', node.getData())
|
||||
else:
|
||||
obj.msg_.addChild(node=node)
|
||||
|
||||
if body:
|
||||
obj.msgtxt = body
|
||||
|
||||
obj.encrypted = ENCRYPTION_NAME
|
||||
callback(obj)
|
||||
|
||||
def encrypt_message(self, obj, callback):
|
||||
keys = self._contacts.get_keys(obj.jid)
|
||||
if not keys:
|
||||
# TODO: this should never happen in theory
|
||||
log.error('Droping stanza to %s, because we have no key', obj.jid)
|
||||
return
|
||||
|
||||
keys += self._contacts.get_keys(self.own_jid)
|
||||
keys += [Key(self._fingerprint, None)]
|
||||
|
||||
payload = util.create_signcrypt_node(obj)
|
||||
|
||||
encrypted_payload, error = self._pgp.encrypt(payload, keys)
|
||||
if error:
|
||||
log.error('Error: %s', error)
|
||||
app.nec.push_incoming_event(
|
||||
MessageNotSentEvent(
|
||||
None, conn=self._con, jid=obj.jid, message=obj.message,
|
||||
error=error, time_=time.time()))
|
||||
return
|
||||
|
||||
util.create_openpgp_message(obj, encrypted_payload)
|
||||
|
||||
obj.encrypted = ENCRYPTION_NAME
|
||||
self.print_msg_to_log(obj.msg_iq)
|
||||
callback(obj)
|
||||
|
||||
@staticmethod
|
||||
def print_msg_to_log(stanza):
|
||||
""" Prints a stanza in a fancy way to the log """
|
||||
log.debug('-'*15)
|
||||
stanzastr = '\n' + stanza.__str__(fancy=True)
|
||||
stanzastr = stanzastr[0:-1]
|
||||
log.debug(stanzastr)
|
||||
log.debug('-'*15)
|
||||
|
||||
def get_keys(self, jid=None, only_trusted=True):
|
||||
if jid is None:
|
||||
jid = self.own_jid
|
||||
return self._contacts.get_keys(jid, only_trusted=only_trusted)
|
||||
|
||||
def clear_fingerprints(self):
|
||||
self._publish_key_list()
|
||||
|
||||
def cleanup(self):
|
||||
self._storage.cleanup()
|
||||
self._pgp = None
|
||||
self._contacts = None
|
||||
|
||||
|
||||
def get_instance(*args, **kwargs):
|
||||
return OpenPGP(*args, **kwargs), 'OpenPGP'
|
||||
124
openpgp/modules/pgp_keylist.py
Normal file
124
openpgp/modules/pgp_keylist.py
Normal file
@@ -0,0 +1,124 @@
|
||||
# Copyright (C) 2018 Philipp Hörist <philipp AT hoerist.com>
|
||||
#
|
||||
# This file is part of Gajim.
|
||||
#
|
||||
# Gajim is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published
|
||||
# by the Free Software Foundation; version 3 only.
|
||||
#
|
||||
# Gajim is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Gajim. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# XEP-0373: OpenPGP for XMPP
|
||||
|
||||
import logging
|
||||
import time
|
||||
|
||||
import nbxmpp
|
||||
|
||||
from gajim.common import app
|
||||
from gajim.common.exceptions import StanzaMalformed
|
||||
from gajim.common.modules.pep import AbstractPEPModule, AbstractPEPData
|
||||
from gajim.common.modules.date_and_time import parse_datetime
|
||||
|
||||
from openpgp.modules import util
|
||||
from openpgp.modules.util import Key
|
||||
|
||||
log = logging.getLogger('gajim.plugin_system.openpgp.pep')
|
||||
|
||||
# Module name
|
||||
name = 'PGPKeylist'
|
||||
zeroconf = False
|
||||
|
||||
|
||||
class PGPKeylistData(AbstractPEPData):
|
||||
|
||||
type_ = 'openpgp-keylist'
|
||||
|
||||
def __init__(self, keylist):
|
||||
self._pep_specific_data = keylist
|
||||
self.data = keylist
|
||||
|
||||
|
||||
class PGPKeylist(AbstractPEPModule):
|
||||
'''
|
||||
<item>
|
||||
<public-keys-list xmlns='urn:xmpp:openpgp:0'>
|
||||
<pubkey-metadata
|
||||
v4-fingerprint='1357B01865B2503C18453D208CAC2A9678548E35'
|
||||
date='2018-03-01T15:26:12Z'
|
||||
/>
|
||||
<pubkey-metadata
|
||||
v4-fingerprint='67819B343B2AB70DED9320872C6464AF2A8E4C02'
|
||||
date='1953-05-16T12:00:00Z'
|
||||
/>
|
||||
</public-keys-list>
|
||||
</item>
|
||||
'''
|
||||
|
||||
name = 'openpgp-keylist'
|
||||
namespace = util.NS_OPENPGP_PUBLIC_KEYS
|
||||
pep_class = PGPKeylistData
|
||||
store_publish = True
|
||||
_log = log
|
||||
|
||||
def __init__(self, con):
|
||||
AbstractPEPModule.__init__(self, con, con.name)
|
||||
|
||||
self.handlers = []
|
||||
|
||||
def _extract_info(self, item):
|
||||
keylist_tag = item.getTag('public-keys-list',
|
||||
namespace=util.NS_OPENPGP)
|
||||
if keylist_tag is None:
|
||||
raise StanzaMalformed('No public-keys-list node')
|
||||
|
||||
metadata = keylist_tag.getTags('pubkey-metadata')
|
||||
if not metadata:
|
||||
raise StanzaMalformed('No metadata found')
|
||||
|
||||
keylist = []
|
||||
for data in metadata:
|
||||
attrs = data.getAttrs()
|
||||
|
||||
if not attrs or 'v4-fingerprint' not in attrs:
|
||||
raise StanzaMalformed('No fingerprint in metadata')
|
||||
|
||||
date = attrs.get('date', None)
|
||||
if date is None:
|
||||
raise StanzaMalformed('No date in metadata')
|
||||
else:
|
||||
timestamp = parse_datetime(date, epoch=True)
|
||||
if timestamp is None:
|
||||
raise StanzaMalformed('Invalid date timestamp: %s', date)
|
||||
|
||||
keylist.append(Key(attrs['v4-fingerprint'], timestamp))
|
||||
return keylist
|
||||
|
||||
def _notification_received(self, jid, keylist):
|
||||
con = app.connections[self._account]
|
||||
con.get_module('OpenPGP').key_list_received(keylist.data,
|
||||
jid.getStripped())
|
||||
|
||||
def _build_node(self, keylist):
|
||||
keylist_node = nbxmpp.Node('public-keys-list',
|
||||
{'xmlns': util.NS_OPENPGP})
|
||||
if keylist is None:
|
||||
return keylist_node
|
||||
for key in keylist:
|
||||
attrs = {'v4-fingerprint': key.fingerprint}
|
||||
if key.date is not None:
|
||||
date = time.strftime(
|
||||
'%Y-%m-%dT%H:%M:%SZ', time.gmtime(key.date))
|
||||
attrs['date'] = date
|
||||
keylist_node.addChild('pubkey-metadata', attrs=attrs)
|
||||
return keylist_node
|
||||
|
||||
|
||||
def get_instance(*args, **kwargs):
|
||||
return PGPKeylist(*args, **kwargs), 'PGPKeylist'
|
||||
205
openpgp/modules/util.py
Normal file
205
openpgp/modules/util.py
Normal file
@@ -0,0 +1,205 @@
|
||||
# Copyright (C) 2018 Philipp Hörist <philipp AT hoerist.com>
|
||||
#
|
||||
# This file is part of Gajim.
|
||||
#
|
||||
# Gajim is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published
|
||||
# by the Free Software Foundation; version 3 only.
|
||||
#
|
||||
# Gajim is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with Gajim. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
# XEP-0373: OpenPGP for XMPP
|
||||
|
||||
import logging
|
||||
import random
|
||||
import time
|
||||
import string
|
||||
from enum import IntEnum
|
||||
from collections import namedtuple
|
||||
from base64 import b64decode, b64encode
|
||||
|
||||
import nbxmpp
|
||||
from nbxmpp import Node
|
||||
|
||||
NS_OPENPGP = 'urn:xmpp:openpgp:0'
|
||||
NS_OPENPGP_PUBLIC_KEYS = 'urn:xmpp:openpgp:0:public-keys'
|
||||
NS_NOTIFY = NS_OPENPGP_PUBLIC_KEYS + '+notify'
|
||||
|
||||
NOT_ENCRYPTED_TAGS = [('no-store', nbxmpp.NS_MSG_HINTS),
|
||||
('store', nbxmpp.NS_MSG_HINTS),
|
||||
('no-copy', nbxmpp.NS_MSG_HINTS),
|
||||
('no-permanent-store', nbxmpp.NS_MSG_HINTS),
|
||||
('thread', None)]
|
||||
|
||||
Key = namedtuple('Key', 'fingerprint date')
|
||||
|
||||
log = logging.getLogger('gajim.plugin_system.openpgp.util')
|
||||
|
||||
|
||||
class Trust(IntEnum):
|
||||
NOT_TRUSTED = 0
|
||||
UNKNOWN = 1
|
||||
BLIND = 2
|
||||
VERIFIED = 3
|
||||
|
||||
|
||||
def unpack_public_key_list(stanza, from_jid):
|
||||
fingerprints = []
|
||||
|
||||
parent = stanza.getTag('pubsub', namespace=nbxmpp.NS_PUBSUB)
|
||||
if parent is None:
|
||||
parent = stanza.getTag('event', namespace=nbxmpp.NS_PUBSUB_EVENT)
|
||||
if parent is None:
|
||||
log.warning('PGP keys list has no pubsub/event node')
|
||||
return
|
||||
|
||||
items = parent.getTag('items', attrs={'node': NS_OPENPGP_PUBLIC_KEYS})
|
||||
if items is None:
|
||||
log.warning('PGP keys list has no items node')
|
||||
return
|
||||
|
||||
item = items.getTags('item')
|
||||
if not item:
|
||||
log.warning('PGP keys list has no item node')
|
||||
return
|
||||
|
||||
if len(item) > 1:
|
||||
log.warning('PGP keys list has more than one item')
|
||||
return
|
||||
|
||||
key_list = item[0].getTag('public-keys-list', namespace=NS_OPENPGP)
|
||||
if key_list is None:
|
||||
log.warning('PGP keys list has no public-keys-list node')
|
||||
return
|
||||
|
||||
metadata = key_list.getTags('pubkey-metadata')
|
||||
if not metadata:
|
||||
return []
|
||||
|
||||
for node in metadata:
|
||||
attrs = node.getAttrs()
|
||||
if 'v4-fingerprint' not in attrs:
|
||||
log.warning('No fingerprint in metadata node')
|
||||
return
|
||||
|
||||
date = attrs.get('date', None)
|
||||
|
||||
fingerprints.append(
|
||||
Key(attrs['v4-fingerprint'], date))
|
||||
|
||||
return fingerprints
|
||||
|
||||
|
||||
def unpack_public_key(stanza, fingerprint):
|
||||
pubsub = stanza.getTag('pubsub', namespace=nbxmpp.NS_PUBSUB)
|
||||
if pubsub is None:
|
||||
log.warning('PGP public key has no pubsub node')
|
||||
return
|
||||
node = '%s:%s' % (NS_OPENPGP_PUBLIC_KEYS, fingerprint)
|
||||
items = pubsub.getTag('items', attrs={'node': node})
|
||||
if items is None:
|
||||
log.warning('PGP public key has no items node')
|
||||
return
|
||||
|
||||
item = items.getTags('item')
|
||||
if not item:
|
||||
log.warning('PGP public key has no item node')
|
||||
return
|
||||
|
||||
if len(item) > 1:
|
||||
log.warning('PGP public key has more than one item')
|
||||
return
|
||||
|
||||
pub_key = item[0].getTag('pubkey', namespace=NS_OPENPGP)
|
||||
if pub_key is None:
|
||||
log.warning('PGP public key has no pubkey node')
|
||||
return
|
||||
|
||||
data = pub_key.getTag('data')
|
||||
if data is None:
|
||||
log.warning('PGP public key has no data node')
|
||||
return
|
||||
|
||||
return b64decode(data.getData().encode('utf8'))
|
||||
|
||||
|
||||
def create_signcrypt_node(obj):
|
||||
'''
|
||||
<signcrypt xmlns='urn:xmpp:openpgp:0'>
|
||||
<to jid='juliet@example.org'/>
|
||||
<time stamp='2014-07-10T17:06:00+02:00'/>
|
||||
<rpad>
|
||||
f0rm1l4n4-mT8y33j!Y%fRSrcd^ZE4Q7VDt1L%WEgR!kv
|
||||
</rpad>
|
||||
<payload>
|
||||
<body xmlns='jabber:client'>
|
||||
This is a secret message.
|
||||
</body>
|
||||
</payload>
|
||||
</signcrypt>
|
||||
'''
|
||||
|
||||
encrypted_nodes = []
|
||||
child_nodes = obj.msg_iq.getChildren()
|
||||
for node in child_nodes:
|
||||
if (node.name, node.namespace) not in NOT_ENCRYPTED_TAGS:
|
||||
if not node.namespace:
|
||||
node.setNamespace(nbxmpp.NS_CLIENT)
|
||||
encrypted_nodes.append(node)
|
||||
obj.msg_iq.delChild(node)
|
||||
|
||||
signcrypt = Node('signcrypt', attrs={'xmlns': NS_OPENPGP})
|
||||
signcrypt.addChild('to', attrs={'jid': obj.jid})
|
||||
|
||||
timestamp = time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
|
||||
signcrypt.addChild('time', attrs={'stamp': timestamp})
|
||||
|
||||
signcrypt.addChild('rpad').addData(get_rpad())
|
||||
|
||||
payload = signcrypt.addChild('payload')
|
||||
|
||||
for node in encrypted_nodes:
|
||||
payload.addChild(node=node)
|
||||
|
||||
return signcrypt
|
||||
|
||||
|
||||
def get_rpad():
|
||||
rpad_range = random.randint(30, 50)
|
||||
return ''.join(
|
||||
random.choice(string.ascii_letters) for _ in range(rpad_range))
|
||||
|
||||
|
||||
def create_openpgp_message(obj, encrypted_payload):
|
||||
b64encoded_payload = b64encode(
|
||||
encrypted_payload.encode('utf-8')).decode('utf8')
|
||||
|
||||
openpgp_node = nbxmpp.Node('openpgp', attrs={'xmlns': NS_OPENPGP})
|
||||
openpgp_node.addData(b64encoded_payload)
|
||||
obj.msg_iq.addChild(node=openpgp_node)
|
||||
|
||||
eme_node = nbxmpp.Node('encryption',
|
||||
attrs={'xmlns': nbxmpp.NS_EME,
|
||||
'namespace': NS_OPENPGP})
|
||||
obj.msg_iq.addChild(node=eme_node)
|
||||
|
||||
if obj.message:
|
||||
obj.msg_iq.setBody(get_info_message())
|
||||
|
||||
|
||||
def get_info_message():
|
||||
return '[This message is *encrypted* with OpenPGP (See :XEP:`0373`]'
|
||||
|
||||
|
||||
class VerifyFailed(Exception):
|
||||
pass
|
||||
|
||||
|
||||
class DecryptionFailed(Exception):
|
||||
pass
|
||||
Reference in New Issue
Block a user