GitLab

at 2022-11-26T12:09:58+00:00

change: Jingle: Remove XTLS support

XTLS has never been standardized, see https://datatracker.ietf.org/doc/html/draft-meyer-xmpp-e2e-encryption
Gajim used this for file transfers, but there probably was no other client supporting this now obsolete feature.
Today, using XEP-0396: Jingle Encrypted Transports - OMEMO would be the preferred solution.

Part of #11160

@@ -189,7 +189,6 @@ def init(self):
          unique_profile_paths = [
              # Data paths
              ('SECRETS_FILE', 'secrets', PathLocation.DATA, PathType.FILE),
 -            ('MY_PEER_CERTS', 'certs', PathLocation.DATA, PathType.FOLDER),
              ('CERT_STORE', 'cert_store', PathLocation.DATA, PathType.FOLDER),
              ('DEBUG', 'debug', PathLocation.DATA, PathType.FOLDER),
              ('PLUGINS_DATA', 'plugins_data',
@@ -200,7 +199,6 @@ def init(self):
              ('CONFIG_FILE', 'config', PathLocation.CONFIG, PathType.FILE),
              ('PLUGINS_CONFIG_DIR',
               'pluginsconfig', PathLocation.CONFIG, PathType.FOLDER),
 -            ('MY_CERT', 'localcerts', PathLocation.CONFIG, PathType.FOLDER),
              ('MY_SHORTCUTS', 'shortcuts.json',
               PathLocation.CONFIG, PathType.FILE),
+         ]

@@ -903,7 +903,6 @@ def is_active(self):
      Namespace.HASHES_BLAKE2B_512,
      Namespace.JINGLE,
      Namespace.JINGLE_FILE_TRANSFER_5,
 -    Namespace.JINGLE_XTLS,
      Namespace.JINGLE_BYTESTREAM,
      Namespace.JINGLE_IBB,
      Namespace.AVATAR_METADATA + '+notify',

@@ -26,10 +26,7 @@
  from nbxmpp.namespaces import Namespace
  from gajim.common import app
 -from gajim.common import configpaths
  from gajim.common.file_props import FileProp
 -from gajim.common.jingle_xtls import SELF_SIGNED_CERTIFICATE
 -from gajim.common.jingle_xtls import load_cert_file
  if TYPE_CHECKING:
      from gajim.common.jingle_transport import JingleTransport
@@ -84,7 +81,6 @@ def __init__(self,
          # These were found by the Politie
          self.file_props: Optional[FileProp] = None
 -        self.use_security: Optional[bool] = None
          self.callbacks: dict[str, list[Callable[
              [nbxmpp.Node, nbxmpp.Node, Optional[nbxmpp.Node], str],
@@ -267,22 +263,6 @@ def _fill_content(self, content: nbxmpp.Node) -> None:
          desc = file_tag.setTag('desc')
          if self.file_props.desc:
              desc.setData(self.file_props.desc)
 -        if self.use_security:
 -            security = nbxmpp.simplexml.Node(
 -                tag=Namespace.JINGLE_XTLS + ' security')
 -            certpath = configpaths.get('MY_CERT')
 -            certpath = certpath / f'{SELF_SIGNED_CERTIFICATE}.cert'
 -            cert = load_cert_file(certpath)
 -            if cert:
 -                digest_algo = (cert.get_signature_algorithm()
 -                               .decode('utf-8').split('With')[0])
 -                security.addChild('fingerprint').addData(cert.digest(
 -                    digest_algo).decode('utf-8'))
 -                for m in ('x509', ):  # supported authentication methods
 -                    method = nbxmpp.simplexml.Node(tag='method')
 -                    method.setAttr('name', m)
 -                    security.addChild(node=method)
 -                content.addChild(node=security)
          content.addChild(node=description_node)
      def destroy(self) -> None:

@@ -33,8 +33,6 @@
  from nbxmpp.namespaces import Namespace
  from gajim.common import app
 -from gajim.common import configpaths
 -from gajim.common import jingle_xtls
  from gajim.common import helpers
  from gajim.common.const import KindConstant
  from gajim.common.helpers import AdditionalDataDict
@@ -80,7 +78,6 @@ def __init__(self,
                   session: JingleSession,
                   file_props: FileProp,
                   transport: Optional[JingleTransport] = None,
 -                 use_security: bool = False,
                   senders: Optional[str] = None
                   ) -> None:
@@ -102,8 +99,6 @@ def __init__(self,
          self.callbacks['transport-info'] += [self.__on_transport_info]
          self.callbacks['iq-result'] += [self.__on_iq_result]
 -        self.use_security = use_security
 -        self.x509_fingerprint: Optional[str] = None
          self.file_props = file_props
          self.weinitiate = self.session.weinitiate
          self.werequest = self.session.werequest
@@ -139,12 +134,6 @@ def __init__(self,
              State.CAND_SENT_AND_RECEIVED: StateCandSentAndRecv(self)
+         }
 -        cert_name = (configpaths.get('MY_CERT') /
 -                     jingle_xtls.SELF_SIGNED_CERTIFICATE)
 -        if not (cert_name.with_suffix('.cert').exists() and
 -                cert_name.with_suffix('.pkey').exists()):
 -            jingle_xtls.make_certs(cert_name, 'gajim')
+-
      def __state_changed(self,
                          nextstate: State,
                          args: Optional[dict[str, Any]] = None
@@ -200,13 +189,6 @@ def _raise_event(self,
          if not content:
              return
 -        secu = content.getTag('security')
 -        self.use_security = bool(secu)
 -        if secu:
 -            fingerprint = secu.getTag('fingerprint')
 -            if fingerprint:
 -                self.x509_fingerprint = fingerprint.getData()
+-
          if not self.transport:
              self.transport = JingleTransportSocks5()
              self.transport.set_our_jid(self.session.ourjid)
@@ -333,26 +315,6 @@ def __on_session_accept(self,
                              action: str
                              ) -> None:
          log.info('__on_session_accept')
 -        con = self.session.connection
 -        security = content.getTag('security')
 -        if not security:  # responder can not verify our fingerprint
 -            self.use_security = False
 -        else:
 -            fingerprint = security.getTag('fingerprint')
 -            if fingerprint:
 -                fingerprint = fingerprint.getData()
 -                self.x509_fingerprint = fingerprint
 -                if not jingle_xtls.check_cert(app.get_jid_without_resource(
 -                        self.session.responder), fingerprint):
 -                    id_ = jingle_xtls.send_cert_request(con,
 -                                                        self.session.responder)
 -                    jingle_xtls.key_exchange_pend(id_,
 -                                                  self.continue_session_accept,
 -                                                  [stanza])
 -                    raise nbxmpp.NodeProcessed
 -        self.continue_session_accept(stanza)
+-
 -    def continue_session_accept(self, stanza: nbxmpp.Node) -> None:
          if self.state == State.TRANSPORT_REPLACE:
              # If we are requesting we don't have the file
              if self.session.werequest:
@@ -371,16 +333,12 @@ def continue_session_accept(self, stanza: nbxmpp.Node) -> None:
              host['initiator'] = self.session.initiator
              host['target'] = self.session.responder
              host['sid'] = self.file_props.sid
 -        fingerprint = None
 -        if self.use_security:
 -            fingerprint = 'client'
          if self.transport.type_ == TransportType.SOCKS5:
              sid = self.file_props.transport_sid
              app.socks5queue.connect_to_hosts(self.session.connection.name,
                                               sid,
                                               self.on_connect,
                                               self._on_connect_error,
 -                                             fingerprint=fingerprint,
                                               receiving=False)
              raise nbxmpp.NodeProcessed
          self.__state_changed(State.TRANSFERRING)
@@ -550,15 +508,11 @@ def _listen_host(self) -> None:
                                         receiver)
          self.file_props.sha_str = sha_str
          port = app.settings.get('file_transfers_port')
 -        fingerprint = None
 -        if self.use_security:
 -            fingerprint = 'server'
          listener = app.socks5queue.start_listener(
              port,
              sha_str,
              self._store_socks5_sid,
              self.file_props,
 -            fingerprint=fingerprint,
              typ='sender' if self.weinitiate else 'receiver')
          if not listener:
              # send error message, notify the user

@@ -61,14 +61,11 @@ def action(self, args: Optional[dict[str, Any]] = None) -> None:
              self.jft._listen_host()
              # Listen on configured port for file transfer
          else:
 -            fingerprint = None
 -            if self.jft.use_security:
 -                fingerprint = 'client'
              # Connect to the candidate host, on success call on_connect method
              app.socks5queue.connect_to_hosts(
                  self.jft.session.connection.name,
                  self.jft.file_props.transport_sid, self.jft.on_connect,
 -                self.jft._on_connect_error, fingerprint=fingerprint)
 +                self.jft._on_connect_error)
  class StateCandSent(JingleFileTransferStates):
@@ -211,13 +208,13 @@ def _start_sock5_transfer(self) -> None:
                                               app.socks5queue, _sock=None,
                                               host=str(streamhost_used['host']),
                                               port=int(streamhost_used['port']),
 -                                             fingerprint=None, connected=False,
 +                                             connected=False,
                                               file_props=self.jft.file_props)
              else:
                  sockobj = Socks5ReceiverClient(
                      app.idlequeue, streamhost_used,
                      transport_sid=self.jft.file_props.transport_sid,
 -                    file_props=self.jft.file_props, fingerprint=None)
 +                    file_props=self.jft.file_props)
              sockobj.proxy = True
              sockobj.streamhost = streamhost_used
              app.socks5queue.add_sockobj(self.jft.session.connection.name,

Philipp Hörist pushed to branch master at gajim / gajim

Commits:

10 changed files:

Changes:

 -# This file is part of Gajim.
 -#
 -# Gajim is free software; you can redistribute it and/or modify
 -# it under the terms of the GNU General Public License as published
 -# by the Free Software Foundation; version 3 only.
 -#
 -# Gajim is distributed in the hope that it will be useful,
 -# but WITHOUT ANY WARRANTY; without even the implied warranty of
 -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 -# GNU General Public License for more details.
 -#
 -# You should have received a copy of the GNU General Public License
 -# along with Gajim. If not, see <http://www.gnu.org/licenses/>.
+-
 -import logging
 -from pathlib import Path
+-
 -from OpenSSL import SSL, crypto
+-
 -import nbxmpp
 -from nbxmpp.namespaces import Namespace
 -from nbxmpp.util import generate_id
 -from gajim.common import app
 -from gajim.common import configpaths
+-
 -log = logging.getLogger('gajim.c.jingle_xtls')
+-
 -# key-exchange id -> [callback, args]
 -# accept that session once key-exchange completes
 -pending_contents = {}
+-
+-
 -def key_exchange_pend(id_, cb, args):
 -    # args is a list
 -    pending_contents[id_] = [cb, args]
+-
+-
 -def approve_pending_content(id_):
 -    cb = pending_contents[id_][0]
 -    args = pending_contents[id_][1]
 -    cb(*args)
+-
+-
 -TYPE_RSA = crypto.TYPE_RSA
 -TYPE_DSA = crypto.TYPE_DSA
+-
 -SELF_SIGNED_CERTIFICATE = 'localcert'
 -DH_PARAMS = 'dh_params.pem'
 -DEFAULT_DH_PARAMS = 'dh4096.pem'
+-
+-
 -def default_callback(connection, certificate, error_num, depth, return_code):
 -    log.info('certificate: %s', certificate)
 -    return return_code
+-
+-
 -def load_cert_file(cert_path, cert_store=None):
 -    '''
 -    This is almost identical to the one in nbxmpp.tls_nb
 -    '''
 -    if not cert_path.is_file():
 -        return None
 -    try:
 -        f = open(cert_path, 'r', encoding='utf8')
 -    except IOError as e:
 -        log.warning('Unable to open certificate file %s: %s', cert_path,
 -                    str(e))
 -        return None
 -    lines = f.readlines()
 -    i = 0
 -    begin = -1
 -    for line in lines:
 -        if 'BEGIN CERTIFICATE' in line:
 -            begin = i
 -        elif 'END CERTIFICATE' in line and begin > -1:
 -            cert = ''.join(lines[begin:i + 2])
 -            try:
 -                x509cert = crypto.load_certificate(crypto.FILETYPE_PEM, cert)
 -                if cert_store:
 -                    cert_store.add_cert(x509cert)
 -                f.close()
 -                return x509cert
 -            except crypto.Error as exception_obj:
 -                log.warning('Unable to load a certificate from file %s: %s',
 -                            cert_path, exception_obj.args[0][0][2])
 -            except Exception:
 -                log.warning('Unknown error while loading certificate from file '
 -                            '%s', cert_path)
 -            begin = -1
 -        i += 1
 -    f.close()
+-
+-
 -def get_context(fingerprint, verify_cb=None, remote_jid=None):
 -    '''
 -    constructs and returns the context objects
 -    '''
 -    ctx = SSL.Context(SSL.SSLv23_METHOD)
 -    flags = (SSL.OP_NO_SSLv2 | SSL.OP_NO_SSLv3 | SSL.OP_SINGLE_DH_USE |
 -             SSL.OP_NO_TICKET)
 -    ctx.set_options(flags)
 -    ctx.set_cipher_list(b'HIGH:!aNULL:!3DES')
+-
 -    if fingerprint == 'server':  # for testing purposes only
 -        ctx.set_verify(SSL.VERIFY_NONE | SSL.VERIFY_FAIL_IF_NO_PEER_CERT,
 -                       verify_cb or default_callback)
 -    elif fingerprint == 'client':
 -        ctx.set_verify(SSL.VERIFY_PEER, verify_cb or default_callback)
+-
 -    cert_name = configpaths.get('MY_CERT') / SELF_SIGNED_CERTIFICATE
 -    ctx.use_privatekey_file(str(cert_name.with_suffix('.pkey')).encode('utf-8'))
 -    ctx.use_certificate_file(
 -        str(cert_name.with_suffix('.cert')).encode('utf-8'))
+-
 -    # Try to load Diffie-Hellman parameters.
 -    # First try user DH parameters, if this fails load the default DH parameters
 -    dh_params_name = configpaths.get('MY_CERT') / DH_PARAMS
 -    try:
 -        with open(dh_params_name, 'r', encoding='utf8'):
 -            ctx.load_tmp_dh(dh_params_name.encode('utf-8'))
 -    except FileNotFoundError:
 -        default_dh_params_name = (configpaths.get('DATA') / 'other' /
 -                                  DEFAULT_DH_PARAMS)
 -        try:
 -            with open(default_dh_params_name, 'r', encoding='utf8'):
 -                ctx.load_tmp_dh(str(default_dh_params_name).encode('utf-8'))
 -        except FileNotFoundError as err:
 -            log.error('Unable to load default DH parameter file: %s, %s',
 -                      default_dh_params_name, err)
 -            raise
+-
 -    if remote_jid:
 -        store = ctx.get_cert_store()
 -        path = configpaths.get('MY_PEER_CERTS').expanduser()
 -        path = path / f'{remote_jid}.cert'
 -        if path.exists():
 -            load_cert_file(path, cert_store=store)
 -            log.debug('certificate file %s loaded fingerprint %s',
 -                      path, fingerprint)
 -    return ctx
+-
+-
 -def read_cert(certpath):
 -    certificate = ''
 -    with open(certpath, 'r', encoding='utf8') as certfile:
 -        for line in certfile.readlines():
 -            if not line.startswith('-'):
 -                certificate += line
 -    return certificate
+-
+-
 -def send_cert(con, jid_from, sid):
 -    certpath = configpaths.get('MY_CERT') / f'{SELF_SIGNED_CERTIFICATE}.cert'
 -    certificate = read_cert(certpath)
 -    iq = nbxmpp.Iq('result', to=jid_from)
 -    iq.setAttr('id', sid)
+-
 -    pubkey = iq.setTag('pubkeys')
 -    pubkey.setNamespace(Namespace.PUBKEY_PUBKEY)
+-
 -    keyinfo = pubkey.setTag('keyinfo')
 -    name = keyinfo.setTag('name')
 -    name.setData('CertificateHash')
 -    cert = keyinfo.setTag('x509cert')
 -    cert.setData(certificate)
+-
 -    con.send(iq)
+-
+-
 -def handle_new_cert(con, obj, jid_from):
 -    jid = app.get_jid_without_resource(jid_from)
 -    certpath = configpaths.get('MY_PEER_CERTS').expanduser() / (jid + '.cert')
+-
 -    id_ = obj.getAttr('id')
+-
 -    x509cert = obj.getTag('pubkeys').getTag('keyinfo').getTag('x509cert')
+-
 -    cert = x509cert.getData()
+-
 -    f = open(certpath, 'w', encoding='utf8')
 -    f.write('-----BEGIN CERTIFICATE-----\n')
 -    f.write(cert)
 -    f.write('-----END CERTIFICATE-----\n')
 -    f.close()
+-
 -    approve_pending_content(id_)
+-
+-
 -def check_cert(jid, fingerprint):
 -    certpath = configpaths.get('MY_PEER_CERTS').expanduser() / (jid + '.cert')
 -    if certpath.exists():
 -        cert = load_cert_file(certpath)
 -        if cert:
 -            digest_algo = cert.get_signature_algorithm()
 -            digest_algo = digest_algo.decode('utf-8').split('With')[0]
 -            if cert.digest(digest_algo) == fingerprint:
 -                return True
 -    return False
+-
+-
 -def send_cert_request(con, to_jid):
 -    iq = nbxmpp.Iq('get', to=to_jid)
 -    id_ = generate_id()
 -    iq.setAttr('id', id_)
 -    pubkey = iq.setTag('pubkeys')
 -    pubkey.setNamespace(Namespace.PUBKEY_PUBKEY)
 -    con.connection.send(iq)
 -    return str(id_)
+-
 -# the following code is partly due to pyopenssl examples
+-
+-
 -def createKeyPair(type_, bits):
 -    '''
 -    Create a public/private key pair.
+-
 -    Arguments: type_ - Key type, must be one of TYPE_RSA and TYPE_DSA
 -               bits - Number of bits to use in the key
 -    Returns:   The public/private key pair in a PKey object
 -    '''
 -    pkey = crypto.PKey()
 -    pkey.generate_key(type_, bits)
 -    return pkey
+-
+-
 -def createCertRequest(pkey, digest='sha256', **name):
 -    '''
 -    Create a certificate request.
+-
 -    Arguments: pkey   - The key to associate with the request
 -               digest - Digestion method to use for signing, default is sha256
 -               **name - The name of the subject of the request, possible
 -                        arguments are:
 -                          C     - Country name
 -                          ST    - State or province name
 -                          L     - Locality name
 -                          O     - Organization name
 -                          OU    - Organizational unit name
 -                          CN    - Common name
 -                          emailAddress - E-mail address
 -    Returns:   The certificate request in an X509Req object
 -    '''
 -    req = crypto.X509Req()
 -    subj = req.get_subject()
+-
 -    for (key, value) in name.items():
 -        setattr(subj, key, value)
+-
 -    req.set_pubkey(pkey)
 -    req.sign(pkey, digest)
 -    return req
+-
+-
 -def createCertificate(req, issuerCert, issuerKey, serial, notBefore, notAfter,
 -                      digest='sha256'):
 -    '''
 -    Generate a certificate given a certificate request.
+-
 -    Arguments: req        - Certificate request to use
 -               issuerCert - The certificate of the issuer
 -               issuerKey  - The private key of the issuer
 -               serial     - Serial number for the certificate
 -               notBefore  - Timestamp (relative to now) when the certificate
 -                            starts being valid
 -               notAfter   - Timestamp (relative to now) when the certificate
 -                            stops being valid
 -               digest     - Digest method to use for signing, default is sha256
 -    Returns:   The signed certificate in an X509 object
 -    '''
 -    cert = crypto.X509()
 -    cert.set_serial_number(serial)
 -    cert.gmtime_adj_notBefore(notBefore)
 -    cert.gmtime_adj_notAfter(notAfter)
 -    cert.set_issuer(issuerCert.get_subject())
 -    cert.set_subject(req.get_subject())
 -    cert.set_pubkey(req.get_pubkey())
 -    cert.sign(issuerKey, digest)
 -    return cert
+-
+-
 -def make_certs(filepath, CN):
 -    '''
 -    make self signed certificates
 -    filepath : absolute path of certificate file, will be appended the '.pkey'
 -    and '.cert' extensions
 -    CN : common name
 -    '''
 -    key = createKeyPair(TYPE_RSA, 4096)
 -    req = createCertRequest(key, CN=CN)
 -    # five years
 -    cert = createCertificate(req, req, key, 0, 0, 60 * 60 * 24 * 365 * 5)
 -    with open(filepath.with_suffix('.pkey'), 'wb') as f:
 -        filepath.with_suffix('.pkey').chmod(0o600)
 -        f.write(crypto.dump_privatekey(crypto.FILETYPE_PEM, key))
 -    with open(filepath.with_suffix('.cert'), 'wb') as f:
 -        f.write(crypto.dump_certificate(crypto.FILETYPE_PEM, cert))
+-
+-
 -if __name__ == '__main__':
 -    make_certs(Path('selfcert'), 'gajim')

@@ -43,7 +43,6 @@
  from gajim.common import app
  from gajim.common import helpers
 -from gajim.common import jingle_xtls
  from gajim.common import types
  from gajim.common.events import FileRequestError
  from gajim.common.file_props import FileProp
@@ -165,16 +164,6 @@ def send_file_approval(self, file_props: FileProp) -> None:
          if not session.accepted:
              content = session.get_content('file', content.name)
 -            if content.use_security:
 -                fingerprint = content.x509_fingerprint
 -                if not jingle_xtls.check_cert(
 -                        app.get_jid_without_resource(file_props.sender),
 -                        fingerprint):
 -                    id_ = jingle_xtls.send_cert_request(
 -                        self._con, file_props.sender)
 -                    jingle_xtls.key_exchange_pend(id_,
 -                                                  content.on_cert_received, [])
 -                    return
              session.approve_session()
          session.approve_content('file', content.name)
@@ -747,7 +736,6 @@ def _on_bytestream_result(self,
                                          _sock=None,
                                          host=str(proxy['host']),
                                          port=int(proxy['port']),
 -                                        fingerprint=None,
                                          connected=False,
                                          file_props=file_props)
              sender.streamhost = proxy

@@ -42,7 +42,6 @@
  from nbxmpp.structs import IqProperties
  from gajim.common import helpers
 -from gajim.common import jingle_xtls
  from gajim.common import types
  from gajim.common.file_props import FileProp
  from gajim.common.modules.base import BaseModule
@@ -71,14 +70,6 @@ def __init__(self, con: types.Client) -> None:
                            typ='set',
                            ns=Namespace.JINGLE,
                            callback=self._on_jingle_iq),
 -            StanzaHandler(name='iq',
 -                          typ='get',
 -                          ns=Namespace.PUBKEY_PUBKEY,
 -                          callback=self._on_pubkey_request),
 -            StanzaHandler(name='iq',
 -                          typ='result',
 -                          ns=Namespace.PUBKEY_PUBKEY,
 -                          callback=self._pubkey_result_received),
+         ]
          # dictionary: sessionid => JingleSession object
@@ -100,26 +91,6 @@ def delete_jingle_session(self, sid: str) -> None:
              self._sessions[sid].callbacks = []
              del self._sessions[sid]
 -    def _on_pubkey_request(self,
 -                           con: types.xmppClient,
 -                           stanza: Iq,
 -                           _properties: IqProperties
 -                           ) -> None:
 -        jid_from = helpers.get_full_jid_from_iq(stanza)
 -        self._log.info('Pubkey request from %s', jid_from)
 -        sid = stanza.getAttr('id')
 -        jingle_xtls.send_cert(con, jid_from, sid)
 -        raise nbxmpp.NodeProcessed
+-
 -    def _pubkey_result_received(self,
 -                                con: types.xmppClient,
 -                                stanza: Iq,
 -                                _properties: IqProperties
 -                                ) -> None:
 -        jid_from = helpers.get_full_jid_from_iq(stanza)
 -        self._log.info('Pubkey result from %s', jid_from)
 -        jingle_xtls.handle_new_cert(con, stanza, jid_from)
+-
      def _on_jingle_iq(self,
                        _con: types.xmppClient,
                        stanza: Iq,
@@ -236,7 +207,6 @@ def start_file_transfer(self,
                              ) -> Optional[str]:
          logger.info('start file transfer with file: %s', file_props)
          contact = self._con.get_module('Contacts').get_contact(jid)
 -        use_security = contact.supports(Namespace.JINGLE_XTLS)
          jingle = JingleSession(self._con,
                                 weinitiate=True,
                                 jid=jid,
@@ -261,7 +231,6 @@ def start_file_transfer(self,
          transfer = JingleFileTransfer(jingle,
                                        transport=transport,
                                        file_props=file_props,
 -                                      use_security=use_security,
                                        senders=senders)
          file_props.transport_sid = transport.sid
          file_props.algo = self.__hash_support(contact)

@@ -33,11 +33,9 @@
  from errno import EAFNOSUPPORT
  from nbxmpp.idlequeue import IdleObject
 -import OpenSSL
  from gajim.common.file_props import FilesProp
  from gajim.common import app
 -from gajim.common import jingle_xtls
  log = logging.getLogger('gajim.c.socks5')
  MAX_BUFF_LEN = 65536
@@ -77,7 +75,7 @@ def __init__(self, idlequeue, complete_transfer_cb=None,
          self.on_failure = {} # {id: cb}
      def start_listener(self, port, sha_str, sha_handler, file_props,
 -    fingerprint=None, typ='sender'):
 +                       typ='sender'):
          """
          Start waiting for incoming connections on (host, port) and do a socks5
          authentication using sid for generated SHA
@@ -86,8 +84,7 @@ def start_listener(self, port, sha_str, sha_handler, file_props,
          sid = file_props.sid
          self.sha_handlers[sha_str] = (sha_handler, sid)
          if self.listener is None or not self.listener.connections:
 -            self.listener = Socks5Listener(self.idlequeue, port, file_props,
 -                fingerprint=fingerprint)
 +            self.listener = Socks5Listener(self.idlequeue, port, file_props)
              self.listener.queue = self
              self.listener.bind()
          else:
@@ -113,7 +110,7 @@ def send_success_reply(self, file_props, streamhost):
          return 1
      def connect_to_hosts(self, account, transport_sid, on_success=None,
 -    on_failure=None, fingerprint=None, receiving=True):
 +                         on_failure=None, receiving=True):
          self.on_success[transport_sid] = on_success
          self.on_failure[transport_sid] = on_failure
          file_props = FilesProp.getFilePropByTransportSid(account, transport_sid)
@@ -128,10 +125,6 @@ def connect_to_hosts(self, account, transport_sid, on_success=None,
              on_failure(file_props.transport_sid)
          # add streamhosts to the queue
          for streamhost in streamhosts_to_test:
 -            if 'type' in streamhost and streamhost['type'] == 'proxy':
 -                fp = None
 -            else:
 -                fp = fingerprint
              if receiving:
                  if 'candidate_id' in streamhost:
                      log.debug('Trying to connect as receiver to cid %s',
@@ -141,7 +134,7 @@ def connect_to_hosts(self, account, transport_sid, on_success=None,
                                streamhost['jid'])
                  file_props.type_ = 'r'
                  socks5obj = Socks5ReceiverClient(self.idlequeue, streamhost,
 -                    transport_sid, file_props, fingerprint=fp)
 +                    transport_sid, file_props)
                  self.add_sockobj(account, socks5obj)
              else:
                  if 'candidate_id' in streamhost:
@@ -162,7 +155,7 @@ def connect_to_hosts(self, account, transport_sid, on_success=None,
                      file_props.proxy_receiver = streamhost['initiator']
                  socks5obj = Socks5SenderClient(self.idlequeue, idx,
                      self, _sock=None, host=str(streamhost['host']),
 -                    port=int(streamhost['port']), fingerprint=fp,
 +                    port=int(streamhost['port']),
                      connected=False, file_props=file_props,
                      initiator=streamhost['initiator'],
                      target=streamhost['target'])
@@ -345,7 +338,7 @@ def on_connection_accepted(self, sock, listener):
          if listener.file_props.type_ == 's' and \
          not self.isHashInSockObjs(self.senders, sock_hash):
              sockobj = Socks5SenderServer(self.idlequeue, sock_hash, self,
 -                sock[0], sock[1][0], sock[1][1], fingerprint=None,
 +                sock[0], sock[1][0], sock[1][1],
                  file_props=listener.file_props)
              self._add(sockobj, self.senders, listener.file_props, sock_hash)
              # Start waiting for data
@@ -360,7 +353,7 @@ def on_connection_accepted(self, sock, listener):
              sh['target'] = None
              sockobj = Socks5ReceiverServer(idlequeue=self.idlequeue,
                  streamhost=sh, transport_sid=None,
 -                file_props=listener.file_props, fingerprint=None)
 +                file_props=listener.file_props)
              self._add(sockobj, self.readers, listener.file_props, sock_hash)
              sockobj.set_sock(sock[0])
@@ -477,20 +470,12 @@ def __init__(self, idlequeue, host, port, initiator, target, sid):
          self.file = None
          self.connected = False
          self.mode = ''
 -        self.ssl_cert = None
 -        self.ssl_errnum = 0
      def _is_connected(self):
          if self.state < 5:
              return False
          return True
 -    def ssl_verify_cb(self, ssl_conn, cert, error_num, depth, return_code):
 -        if depth == 0:
 -            self.ssl_cert = cert
 -            self.ssl_errnum = error_num
 -        return True
+-
      def connect(self):
          """
          Create the socket and plug it to the idlequeue
@@ -500,17 +485,6 @@ def connect(self):
          for ai in self.ais:
              try:
                  self._sock = socket.socket(*ai[:3])
 -                if self.fingerprint is not None:
 -                    if self.file_props.type_ == 's':
 -                        remote_jid = app.get_jid_without_resource(
 -                            self.file_props.receiver)
 -                    else:
 -                        remote_jid = app.get_jid_without_resource(
 -                            self.file_props.sender)
 -                    self._sock = OpenSSL.SSL.Connection(
 -                        jingle_xtls.get_context('client',
 -                        verify_cb=self.ssl_verify_cb, remote_jid=remote_jid),
 -                        self._sock)
                  # this will not block the GUI
                  self._sock.setblocking(False)
                  self._server = ai[4]
@@ -532,8 +506,6 @@ def do_connect(self):
              self._sock.connect(self._server)
              self._send = self._sock.send
              self._recv = self._sock.recv
 -        except (OpenSSL.SSL.WantReadError, OpenSSL.SSL.WantWriteError):
 -            pass
          except Exception as ee:
              errnum = ee.errno
              self.connect_timeout += 1
@@ -642,10 +614,6 @@ def receive(self):
          received = b''
          try:
              add = self._recv(64)
 -        except (OpenSSL.SSL.WantReadError, OpenSSL.SSL.WantWriteError,
 -        OpenSSL.SSL.WantX509LookupError) as e:
 -            log.info('SSL rehandshake request: %s', repr(e))
 -            raise e
          except Exception:
              add = b''
          received += add
@@ -659,10 +627,6 @@ def send_raw(self, raw_data):
          """
          try:
              self._send(raw_data)
 -        except (OpenSSL.SSL.WantReadError, OpenSSL.SSL.WantWriteError,
 -        OpenSSL.SSL.WantX509LookupError) as e:
 -            log.info('SSL rehandshake request: %s', repr(e))
 -            raise e
          except Exception:
              self.disconnect()
          return len(raw_data)
@@ -683,13 +647,6 @@ def write_next(self):
              lenn = 0
              try:
                  lenn = self._send(buff)
 -            except (OpenSSL.SSL.WantReadError,
 -                    OpenSSL.SSL.WantWriteError,
 -                    OpenSSL.SSL.WantX509LookupError) as err:
 -                log.info('SSL rehandshake request: %s', repr(err))
 -                raise err
 -            except OpenSSL.SSL.SysCallError:
 -                return self._on_send_exception()
              except socket.error as err:
                  if err.errno not in (EINTR, ENOBUFS, EWOULDBLOCK):
                      return self._on_send_exception()
@@ -767,10 +724,6 @@ def get_file_contents(self, timeout):
                  return 0
              try:
                  buff = self._recv(MAX_BUFF_LEN)
 -            except (OpenSSL.SSL.WantReadError, OpenSSL.SSL.WantWriteError,
 -            OpenSSL.SSL.WantX509LookupError) as e:
 -                log.info('SSL rehandshake request: %s', repr(e))
 -                raise e
              except Exception:
                  buff = b''
              current_time = time.time()
@@ -825,10 +778,7 @@ def disconnect(self, *args, **kwargs):
              if self.queue.listener.connections == []:
                  self.queue.listener.disconnect()
          try:
 -            if isinstance(self._sock, OpenSSL.SSL.Connection):
 -                self._sock.shutdown()
 -            else:
 -                self._sock.shutdown(socket.SHUT_RDWR)
 +            self._sock.shutdown(socket.SHUT_RDWR)
              self._sock.close()
          except Exception:
              # socket is already closed
@@ -905,12 +855,7 @@ def read_connect(self):
          """
          Connect response: version, auth method
          """
 -        try:
 -            buff = self._recv().decode('utf-8')
 -        except (OpenSSL.SSL.WantReadError, OpenSSL.SSL.WantWriteError,
 -        OpenSSL.SSL.WantX509LookupError) as e:
 -            log.info("SSL rehandshake request: %s", repr(e))
 -            raise e
 +        buff = self._recv().decode('utf-8')
          try:
              version, method = struct.unpack('!BB', buff)
          except Exception:
@@ -943,21 +888,15 @@ class Socks5Sender(IdleObject):
      Class for sending file to socket over socks5
      """
      def __init__(self, idlequeue, sock_hash, parent, _sock, host=None,
 -                 port=None, fingerprint=None, connected=True, file_props=None):
 +                 port=None, connected=True, file_props=None):
          IdleObject.__init__(self)
 -        self.fingerprint = fingerprint
          self.queue_idx = sock_hash
          self.queue = parent
          self.file_props = file_props
          self.proxy = False
          self._sock = _sock
          if _sock is not None:
 -            if self.fingerprint is not None and not isinstance(self._sock,
 -            OpenSSL.SSL.Connection):
 -                self._sock = OpenSSL.SSL.Connection(
 -                    jingle_xtls.get_context('server'), _sock)
 -            else:
 -                self._sock.setblocking(False)
 +            self._sock.setblocking(False)
              self.fd = _sock.fileno()
              self._recv = _sock.recv
              self._send = _sock.send
@@ -985,11 +924,7 @@ def start_transfer(self):
      def set_connection_sock(self, _sock):
          self._sock = _sock
 -        if self.fingerprint is not None:
 -            self._sock = OpenSSL.SSL.Connection(
 -                jingle_xtls.get_context('client'), _sock)
 -        else:
 -            self._sock.setblocking(False)
 +        self._sock.setblocking(False)
          self.fd = _sock.fileno()
          self._recv = _sock.recv
          self._send = _sock.send
@@ -1023,17 +958,11 @@ def disconnect(self, cb=True):
  class Socks5Receiver(IdleObject):
 -    def __init__(self, idlequeue, streamhost, sid, file_props=None,
 -                 fingerprint=None):
 -        """
 -        fingerprint: fingerprint of certificates we shall use, set to None if
 -        TLS connection not desired
 -        """
 +    def __init__(self, idlequeue, streamhost, sid, file_props=None):
          IdleObject.__init__(self)
          self.queue_idx = -1
          self.streamhost = streamhost
          self.queue = None
 -        self.fingerprint = fingerprint
          self.connect_timeout = 0
          self.connected = False
          self.pauses = 0
@@ -1129,36 +1058,31 @@ def main(self):
      def pollin(self):
          self.idlequeue.remove_timeout(self.fd)
          if self.connected:
 -            try:
 -                if self.state < 5:
 -                    result = self.main()
 -                    if self.state == 4:
 -                        self.queue.result_sha(self.sha_msg, self.queue_idx)
 -                    if result == -1:
 -                        self.disconnect()
 -                elif self.state == 5:
 -                    self.state = 7
 -                    if self.file_props.type_ == 's':
 -                        # We wait for the end of the negotiation to
 -                        # send the file
 -                        self.idlequeue.plug_idle(self, False, False)
 -                    else:
 -                        # We plug for reading
 -                        self.idlequeue.plug_idle(self, False, True)
 -                        return
 -                elif self.state == 7:
 -                    if self.file_props.paused:
 -                        self.file_props.continue_cb = \
 -                            self.continue_paused_transfer
 -                        self.idlequeue.plug_idle(self, False, False)
 -                        return
 -                    self.idlequeue.set_read_timeout(self.fd, STALLED_TIMEOUT)
 -                    result = self.start_transfer() # send
 -                    self.queue.process_result(result, self)
 -            except (OpenSSL.SSL.WantReadError,
 -                    OpenSSL.SSL.WantWriteError,
 -                    OpenSSL.SSL.WantX509LookupError):
 -                log.info('caught SSL exception, ignored')
 +            if self.state < 5:
 +                result = self.main()
 +                if self.state == 4:
 +                    self.queue.result_sha(self.sha_msg, self.queue_idx)
 +                if result == -1:
 +                    self.disconnect()
 +            elif self.state == 5:
 +                self.state = 7
 +                if self.file_props.type_ == 's':
 +                    # We wait for the end of the negotiation to
 +                    # send the file
 +                    self.idlequeue.plug_idle(self, False, False)
 +                else:
 +                    # We plug for reading
 +                    self.idlequeue.plug_idle(self, False, True)
 +                    return
 +            elif self.state == 7:
 +                if self.file_props.paused:
 +                    self.file_props.continue_cb = \
 +                        self.continue_paused_transfer
 +                    self.idlequeue.plug_idle(self, False, False)
 +                    return
 +                self.idlequeue.set_read_timeout(self.fd, STALLED_TIMEOUT)
 +                result = self.start_transfer() # send
 +                self.queue.process_result(result, self)
          else:
              self.disconnect()
@@ -1173,32 +1097,26 @@ def pollout(self):
              self.disconnect()
              return
          self.idlequeue.remove_timeout(self.fd)
 -        try:
 -            if self.state == 2: # send reply with desired auth type
 -                self.send_raw(self._get_auth_response())
 -            elif self.state == 4: # send positive response to the 'connect'
 -                self.send_raw(self._get_request_buff(self.sha_msg, 0x00))
 -            elif self.state == 7:
 -                if self.file_props.paused:
 -                    self.file_props.continue_cb = self.continue_paused_transfer
 -                    self.idlequeue.plug_idle(self, False, False)
 -                    return
 -                result = self.start_transfer() # send
 -                self.queue.process_result(result, self)
 -                if result is None or result <= 0:
 -                    self.disconnect()
 -                    return
 -                self.idlequeue.set_read_timeout(self.fd, STALLED_TIMEOUT)
 -            elif self.state == 8:
 -                self.disconnect()
 +        if self.state == 2: # send reply with desired auth type
 +            self.send_raw(self._get_auth_response())
 +        elif self.state == 4: # send positive response to the 'connect'
 +            self.send_raw(self._get_request_buff(self.sha_msg, 0x00))
 +        elif self.state == 7:
 +            if self.file_props.paused:
 +                self.file_props.continue_cb = self.continue_paused_transfer
 +                self.idlequeue.plug_idle(self, False, False)
                  return
 -            else:
 +            result = self.start_transfer() # send
 +            self.queue.process_result(result, self)
 +            if result is None or result <= 0:
                  self.disconnect()
 -        except (OpenSSL.SSL.WantReadError,
 -                OpenSSL.SSL.WantWriteError,
 -                OpenSSL.SSL.WantX509LookupError):
 -            log.info('caught SSL exception, ignored')
 +                return
 +            self.idlequeue.set_read_timeout(self.fd, STALLED_TIMEOUT)
 +        elif self.state == 8:
 +            self.disconnect()
              return
 +        else:
 +            self.disconnect()
          if self.state < 5:
              self.state += 1
              # unplug and plug this time for reading
@@ -1286,61 +1204,41 @@ def main(self, timeout=0):
              self.state += 1
              return None
 -    def send_file(self):
 -        if self.ssl_errnum > 0:
 -            log.error('remote certificate does not match the announced one.'
 -                      '\nSSL Error: %d\nCancelling file transfer',
 -                      self.ssl_errnum)
 -            self.file_props.error = -12
 -            return -1
 -        return super(Socks5Client, self).send_file()
+-
      def pollin(self):
          self.idlequeue.remove_timeout(self.fd)
          if self.connected:
 -            try:
 -                if self.file_props.paused:
 -                    self.idlequeue.plug_idle(self, False, False)
 -                    return
 -                if self.state < 5:
 -                    self.idlequeue.set_read_timeout(self.fd, CONNECT_TIMEOUT)
 -                    self.main(0)
 -                elif self.state == 5: # wait for proxy reply
 -                    pass
 -                elif self.file_props.type_ == 'r':
 -                    self.idlequeue.set_read_timeout(self.fd, STALLED_TIMEOUT)
 -                    result = self.start_transfer() # receive
 -                    self.queue.process_result(result, self)
 -            except (OpenSSL.SSL.WantReadError,
 -                    OpenSSL.SSL.WantWriteError,
 -                    OpenSSL.SSL.WantX509LookupError):
 -                log.info('caught SSL exception, ignored')
 +            if self.file_props.paused:
 +                self.idlequeue.plug_idle(self, False, False)
                  return
 +            if self.state < 5:
 +                self.idlequeue.set_read_timeout(self.fd, CONNECT_TIMEOUT)
 +                self.main(0)
 +            elif self.state == 5: # wait for proxy reply
 +                pass
 +            elif self.file_props.type_ == 'r':
 +                self.idlequeue.set_read_timeout(self.fd, STALLED_TIMEOUT)
 +                result = self.start_transfer() # receive
 +                self.queue.process_result(result, self)
          else:
              self.disconnect()
      def pollout(self):
          self.idlequeue.remove_timeout(self.fd)
 -        try:
 -            if self.state == 0:
 -                self.do_connect()
 -                return
 -            if self.state == 1: # send initially: version and auth types
 -                self.send_raw(self._get_auth_buff())
 -            elif self.state == 3: # send 'connect' request
 -                self.send_raw(self._get_request_buff(self._get_sha1_auth()))
 -            elif self.file_props.type_ != 'r':
 -                if self.file_props.paused:
 -                    self.idlequeue.plug_idle(self, False, False)
 -                    return
 -                result = self.start_transfer() # send
 -                self.queue.process_result(result, self)
 +        if self.state == 0:
 +            self.do_connect()
 +            return
 +        if self.state == 1: # send initially: version and auth types
 +            self.send_raw(self._get_auth_buff())
 +        elif self.state == 3: # send 'connect' request
 +            self.send_raw(self._get_request_buff(self._get_sha1_auth()))
 +        elif self.file_props.type_ != 'r':
 +            if self.file_props.paused:
 +                self.idlequeue.plug_idle(self, False, False)
                  return
 -        except (OpenSSL.SSL.WantReadError,
 -                OpenSSL.SSL.WantWriteError,
 -                OpenSSL.SSL.WantX509LookupError):
 -            log.info('caught SSL exception, ignored')
 +            result = self.start_transfer() # send
 +            self.queue.process_result(result, self)
              return
++
          self.state += 1
          # unplug and plug for reading
          self.idlequeue.plug_idle(self, False, True)
@@ -1359,55 +1257,50 @@ def pollend(self):
  class Socks5SenderClient(Socks5Client, Socks5Sender):
      def __init__(self, idlequeue, sock_hash, parent, _sock, host=None,
 -    port=None, fingerprint=None, connected=True, file_props=None,
 +    port=None, connected=True, file_props=None,
      initiator=None, target=None):
          Socks5Client.__init__(self, idlequeue, host, port, initiator, target,
              file_props.transport_sid)
          Socks5Sender.__init__(self, idlequeue, sock_hash, parent, _sock,
 -            host, port, fingerprint, connected, file_props)
 +            host, port, connected, file_props)
  class Socks5SenderServer(Socks5Server, Socks5Sender):
      def __init__(self, idlequeue, sock_hash, parent, _sock, host=None,
 -    port=None, fingerprint=None, connected=True, file_props=None):
 +    port=None, connected=True, file_props=None):
          Socks5Server.__init__(self, idlequeue, host, port, None, None,
              file_props.transport_sid)
          Socks5Sender.__init__(self, idlequeue, sock_hash, parent, _sock,
 -            host, port, fingerprint, connected, file_props)
 +            host, port, connected, file_props)
  class Socks5ReceiverClient(Socks5Client, Socks5Receiver):
 -    def __init__(self, idlequeue, streamhost, transport_sid, file_props=None,
 -    fingerprint=None):
 +    def __init__(self, idlequeue, streamhost, transport_sid, file_props=None):
          Socks5Client.__init__(self, idlequeue, streamhost['host'],
              int(streamhost['port']), streamhost['initiator'],
              streamhost['target'], transport_sid)
          Socks5Receiver.__init__(self, idlequeue, streamhost, transport_sid,
 -            file_props, fingerprint)
 +            file_props)
  class Socks5ReceiverServer(Socks5Server, Socks5Receiver):
 -    def __init__(self, idlequeue, streamhost, transport_sid, file_props=None,
 -    fingerprint=None):
 +    def __init__(self, idlequeue, streamhost, transport_sid, file_props=None):
          Socks5Server.__init__(self, idlequeue, streamhost['host'],
              int(streamhost['port']), streamhost['initiator'],
              streamhost['target'], transport_sid)
          Socks5Receiver.__init__(self, idlequeue, streamhost, transport_sid,
 -            file_props, fingerprint)
 +            file_props)
  class Socks5Listener(IdleObject):
 -    def __init__(self, idlequeue, port, fp, fingerprint=None):
 +    def __init__(self, idlequeue, port, fp):
          """
          Handle all incoming connections on (0.0.0.0, port)
          This class implements IdleObject, but we will expect
          only pollin events though
+-
 -        fingerprint: fingerprint of certificates we shall use, set to None if
 -        TLS connection not desired
          """
          IdleObject.__init__(self)
          self.port = port
@@ -1420,7 +1313,6 @@ def __init__(self, idlequeue, port, fp, fingerprint=None):
          self.started = False
          self._sock = None
          self.fd = -1
 -        self.fingerprint = fingerprint
          self.file_props = fp
          self.connections = []
@@ -1429,9 +1321,6 @@ def bind(self):
              # try the different possibilities (ipv6, ipv4, etc.)
              try:
                  self._serv = socket.socket(*ai[:3])
 -                if self.fingerprint is not None:
 -                    self._serv = OpenSSL.SSL.Connection(
 -                        jingle_xtls.get_context('server'), self._serv)
              except socket.error as e:
                  if e.errno == EAFNOSUPPORT:
                      self.ai = None

 ------BEGIN DH PARAMETERS-----
 -MIICCAKCAgEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
 -IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
 -awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
 -mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
 -fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
 -5RXSJhiY+gUQFXKOWoqqxC2tMxcNBFB6M6hVIavfHLpk7PuFBFjb7wqK6nFXXQYM
 -fbOXD4Wm4eTHq/WujNsJM9cejJTgSiVhnc7j0iYa0u5r8S/6BtmKCGTYdgJzPshq
 -ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqSEI
 -ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O
 -+S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI
 -HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=
 ------END DH PARAMETERS-----
+-
 -"4096-bit MODP Group" from RFC3526, Section 5.
+-
 -The prime is: 2^4096 - 2^4032 - 1 + 2^64 * { [2^3966 pi] + 240904 }
+-
 -RFC3526 specifies a generator of 2.
+-
 -The generation of the group is described in RFC 2412.