1package eu.siacs.conversations.crypto.axolotl;
   2
   3import android.os.Bundle;
   4import android.security.KeyChain;
   5import android.support.annotation.NonNull;
   6import android.support.annotation.Nullable;
   7import android.util.Log;
   8import android.util.Pair;
   9
  10import org.bouncycastle.jce.provider.BouncyCastleProvider;
  11import org.whispersystems.libsignal.SignalProtocolAddress;
  12import org.whispersystems.libsignal.IdentityKey;
  13import org.whispersystems.libsignal.IdentityKeyPair;
  14import org.whispersystems.libsignal.InvalidKeyException;
  15import org.whispersystems.libsignal.InvalidKeyIdException;
  16import org.whispersystems.libsignal.SessionBuilder;
  17import org.whispersystems.libsignal.UntrustedIdentityException;
  18import org.whispersystems.libsignal.ecc.ECPublicKey;
  19import org.whispersystems.libsignal.state.PreKeyBundle;
  20import org.whispersystems.libsignal.state.PreKeyRecord;
  21import org.whispersystems.libsignal.state.SignedPreKeyRecord;
  22import org.whispersystems.libsignal.util.KeyHelper;
  23
  24import java.security.PrivateKey;
  25import java.security.Security;
  26import java.security.Signature;
  27import java.security.cert.X509Certificate;
  28import java.util.ArrayList;
  29import java.util.Arrays;
  30import java.util.Collection;
  31import java.util.Collections;
  32import java.util.HashMap;
  33import java.util.HashSet;
  34import java.util.Iterator;
  35import java.util.List;
  36import java.util.Map;
  37import java.util.Random;
  38import java.util.Set;
  39import java.util.concurrent.atomic.AtomicBoolean;
  40
  41import eu.siacs.conversations.Config;
  42import eu.siacs.conversations.entities.Account;
  43import eu.siacs.conversations.entities.Contact;
  44import eu.siacs.conversations.entities.Conversation;
  45import eu.siacs.conversations.entities.Message;
  46import eu.siacs.conversations.parser.IqParser;
  47import eu.siacs.conversations.services.XmppConnectionService;
  48import eu.siacs.conversations.utils.CryptoHelper;
  49import eu.siacs.conversations.utils.SerialSingleThreadExecutor;
  50import eu.siacs.conversations.xml.Element;
  51import eu.siacs.conversations.xmpp.OnAdvancedStreamFeaturesLoaded;
  52import eu.siacs.conversations.xmpp.OnIqPacketReceived;
  53import eu.siacs.conversations.xmpp.pep.PublishOptions;
  54import eu.siacs.conversations.xmpp.stanzas.IqPacket;
  55import eu.siacs.conversations.xmpp.stanzas.MessagePacket;
  56import rocks.xmpp.addr.Jid;
  57
  58public class AxolotlService implements OnAdvancedStreamFeaturesLoaded {
  59
  60    public static final String PEP_PREFIX = "eu.siacs.conversations.axolotl";
  61    public static final String PEP_DEVICE_LIST = PEP_PREFIX + ".devicelist";
  62    public static final String PEP_DEVICE_LIST_NOTIFY = PEP_DEVICE_LIST + "+notify";
  63    public static final String PEP_BUNDLES = PEP_PREFIX + ".bundles";
  64    public static final String PEP_VERIFICATION = PEP_PREFIX + ".verification";
  65    public static final String PEP_OMEMO_WHITELISTED = PEP_PREFIX + ".whitelisted";
  66
  67    public static final String LOGPREFIX = "AxolotlService";
  68
  69    private static final int NUM_KEYS_TO_PUBLISH = 100;
  70    private static final int publishTriesThreshold = 3;
  71
  72    private final Account account;
  73    private final XmppConnectionService mXmppConnectionService;
  74    private final SQLiteAxolotlStore axolotlStore;
  75    private final SessionMap sessions;
  76    private final Map<Jid, Set<Integer>> deviceIds;
  77    private final Map<String, XmppAxolotlMessage> messageCache;
  78    private final FetchStatusMap fetchStatusMap;
  79    private final Map<Jid, Boolean> fetchDeviceListStatus = new HashMap<>();
  80    private final HashMap<Jid, List<OnDeviceIdsFetched>> fetchDeviceIdsMap = new HashMap<>();
  81    private final SerialSingleThreadExecutor executor;
  82    private final Set<SignalProtocolAddress> healingAttempts = new HashSet<>();
  83    private final HashSet<Integer> cleanedOwnDeviceIds = new HashSet<>();
  84    private final Set<Integer> PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT = new HashSet<>();
  85    private int numPublishTriesOnEmptyPep = 0;
  86    private boolean pepBroken = false;
  87    private int lastDeviceListNotificationHash = 0;
  88    private Set<XmppAxolotlSession> postponedSessions = new HashSet<>(); //sessions stored here will receive after mam catchup treatment
  89    private Set<SignalProtocolAddress> postponedHealing = new HashSet<>(); //addresses stored here will need a healing notification after mam catchup
  90    private AtomicBoolean changeAccessMode = new AtomicBoolean(false);
  91
  92    public AxolotlService(Account account, XmppConnectionService connectionService) {
  93        if (account == null || connectionService == null) {
  94            throw new IllegalArgumentException("account and service cannot be null");
  95        }
  96        if (Security.getProvider("BC") == null) {
  97            Security.addProvider(new BouncyCastleProvider());
  98        }
  99        this.mXmppConnectionService = connectionService;
 100        this.account = account;
 101        this.axolotlStore = new SQLiteAxolotlStore(this.account, this.mXmppConnectionService);
 102        this.deviceIds = new HashMap<>();
 103        this.messageCache = new HashMap<>();
 104        this.sessions = new SessionMap(mXmppConnectionService, axolotlStore, account);
 105        this.fetchStatusMap = new FetchStatusMap();
 106        this.executor = new SerialSingleThreadExecutor("Axolotl");
 107    }
 108
 109    public static String getLogprefix(Account account) {
 110        return LOGPREFIX + " (" + account.getJid().asBareJid().toString() + "): ";
 111    }
 112
 113    @Override
 114    public void onAdvancedStreamFeaturesAvailable(Account account) {
 115        if (Config.supportOmemo()
 116                && account.getXmppConnection() != null
 117                && account.getXmppConnection().getFeatures().pep()) {
 118            publishBundlesIfNeeded(true, false);
 119        } else {
 120            Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": skipping OMEMO initialization");
 121        }
 122    }
 123
 124    private boolean hasErrorFetchingDeviceList(Jid jid) {
 125        Boolean status = fetchDeviceListStatus.get(jid);
 126        return status != null && !status;
 127    }
 128
 129    public boolean hasErrorFetchingDeviceList(List<Jid> jids) {
 130        for (Jid jid : jids) {
 131            if (hasErrorFetchingDeviceList(jid)) {
 132                return true;
 133            }
 134        }
 135        return false;
 136    }
 137
 138    public boolean fetchMapHasErrors(List<Jid> jids) {
 139        for (Jid jid : jids) {
 140            if (deviceIds.get(jid) != null) {
 141                for (Integer foreignId : this.deviceIds.get(jid)) {
 142                    SignalProtocolAddress address = new SignalProtocolAddress(jid.toString(), foreignId);
 143                    if (fetchStatusMap.getAll(address.getName()).containsValue(FetchStatus.ERROR)) {
 144                        return true;
 145                    }
 146                }
 147            }
 148        }
 149        return false;
 150    }
 151
 152    public void preVerifyFingerprint(Contact contact, String fingerprint) {
 153        axolotlStore.preVerifyFingerprint(contact.getAccount(), contact.getJid().asBareJid().toString(), fingerprint);
 154    }
 155
 156    public void preVerifyFingerprint(Account account, String fingerprint) {
 157        axolotlStore.preVerifyFingerprint(account, account.getJid().asBareJid().toString(), fingerprint);
 158    }
 159
 160    public boolean hasVerifiedKeys(String name) {
 161        for (XmppAxolotlSession session : this.sessions.getAll(name).values()) {
 162            if (session.getTrust().isVerified()) {
 163                return true;
 164            }
 165        }
 166        return false;
 167    }
 168
 169    public String getOwnFingerprint() {
 170        return CryptoHelper.bytesToHex(axolotlStore.getIdentityKeyPair().getPublicKey().serialize());
 171    }
 172
 173    public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status) {
 174        return axolotlStore.getContactKeysWithTrust(account.getJid().asBareJid().toString(), status);
 175    }
 176
 177    public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, Jid jid) {
 178        return axolotlStore.getContactKeysWithTrust(jid.asBareJid().toString(), status);
 179    }
 180
 181    public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, List<Jid> jids) {
 182        Set<IdentityKey> keys = new HashSet<>();
 183        for (Jid jid : jids) {
 184            keys.addAll(axolotlStore.getContactKeysWithTrust(jid.toString(), status));
 185        }
 186        return keys;
 187    }
 188
 189    public Set<Jid> findCounterpartsBySourceId(int sid) {
 190        return sessions.findCounterpartsForSourceId(sid);
 191    }
 192
 193    public long getNumTrustedKeys(Jid jid) {
 194        return axolotlStore.getContactNumTrustedKeys(jid.asBareJid().toString());
 195    }
 196
 197    public boolean anyTargetHasNoTrustedKeys(List<Jid> jids) {
 198        for (Jid jid : jids) {
 199            if (axolotlStore.getContactNumTrustedKeys(jid.asBareJid().toString()) == 0) {
 200                return true;
 201            }
 202        }
 203        return false;
 204    }
 205
 206    private SignalProtocolAddress getAddressForJid(Jid jid) {
 207        return new SignalProtocolAddress(jid.toString(), 0);
 208    }
 209
 210    public Collection<XmppAxolotlSession> findOwnSessions() {
 211        SignalProtocolAddress ownAddress = getAddressForJid(account.getJid().asBareJid());
 212        ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(ownAddress.getName()).values());
 213        Collections.sort(s);
 214        return s;
 215    }
 216
 217    public Collection<XmppAxolotlSession> findSessionsForContact(Contact contact) {
 218        SignalProtocolAddress contactAddress = getAddressForJid(contact.getJid());
 219        ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(contactAddress.getName()).values());
 220        Collections.sort(s);
 221        return s;
 222    }
 223
 224    private Set<XmppAxolotlSession> findSessionsForConversation(Conversation conversation) {
 225        if (conversation.getContact().isSelf()) {
 226            //will be added in findOwnSessions()
 227            return Collections.emptySet();
 228        }
 229        HashSet<XmppAxolotlSession> sessions = new HashSet<>();
 230        for (Jid jid : conversation.getAcceptedCryptoTargets()) {
 231            sessions.addAll(this.sessions.getAll(getAddressForJid(jid).getName()).values());
 232        }
 233        return sessions;
 234    }
 235
 236    private boolean hasAny(Jid jid) {
 237        return sessions.hasAny(getAddressForJid(jid));
 238    }
 239
 240    public boolean isPepBroken() {
 241        return this.pepBroken;
 242    }
 243
 244    public void resetBrokenness() {
 245        this.pepBroken = false;
 246        this.numPublishTriesOnEmptyPep = 0;
 247        this.lastDeviceListNotificationHash = 0;
 248        this.healingAttempts.clear();
 249    }
 250
 251    public void clearErrorsInFetchStatusMap(Jid jid) {
 252        fetchStatusMap.clearErrorFor(jid);
 253        fetchDeviceListStatus.remove(jid);
 254    }
 255
 256    public void regenerateKeys(boolean wipeOther) {
 257        axolotlStore.regenerate();
 258        sessions.clear();
 259        fetchStatusMap.clear();
 260        fetchDeviceIdsMap.clear();
 261        fetchDeviceListStatus.clear();
 262        publishBundlesIfNeeded(true, wipeOther);
 263    }
 264
 265    public void destroy() {
 266        Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": destroying old axolotl service. no longer in use");
 267        mXmppConnectionService.databaseBackend.wipeAxolotlDb(account);
 268    }
 269
 270    public AxolotlService makeNew() {
 271        Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": make new axolotl service");
 272        return new AxolotlService(this.account, this.mXmppConnectionService);
 273    }
 274
 275    public int getOwnDeviceId() {
 276        return axolotlStore.getLocalRegistrationId();
 277    }
 278
 279    public SignalProtocolAddress getOwnAxolotlAddress() {
 280        return new SignalProtocolAddress(account.getJid().asBareJid().toString(), getOwnDeviceId());
 281    }
 282
 283    public Set<Integer> getOwnDeviceIds() {
 284        return this.deviceIds.get(account.getJid().asBareJid());
 285    }
 286
 287    public void registerDevices(final Jid jid, @NonNull final Set<Integer> deviceIds) {
 288        final int hash = deviceIds.hashCode();
 289        final boolean me = jid.asBareJid().equals(account.getJid().asBareJid());
 290        if (me) {
 291            if (hash != 0 && hash == this.lastDeviceListNotificationHash) {
 292                Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": ignoring duplicate own device id list");
 293                return;
 294            }
 295            this.lastDeviceListNotificationHash = hash;
 296        }
 297        boolean needsPublishing = me && !deviceIds.contains(getOwnDeviceId());
 298        if (me) {
 299            deviceIds.remove(getOwnDeviceId());
 300        }
 301        Set<Integer> expiredDevices = new HashSet<>(axolotlStore.getSubDeviceSessions(jid.asBareJid().toString()));
 302        expiredDevices.removeAll(deviceIds);
 303        for (Integer deviceId : expiredDevices) {
 304            SignalProtocolAddress address = new SignalProtocolAddress(jid.asBareJid().toString(), deviceId);
 305            XmppAxolotlSession session = sessions.get(address);
 306            if (session != null && session.getFingerprint() != null) {
 307                if (session.getTrust().isActive()) {
 308                    session.setTrust(session.getTrust().toInactive());
 309                }
 310            }
 311        }
 312        Set<Integer> newDevices = new HashSet<>(deviceIds);
 313        for (Integer deviceId : newDevices) {
 314            SignalProtocolAddress address = new SignalProtocolAddress(jid.asBareJid().toString(), deviceId);
 315            XmppAxolotlSession session = sessions.get(address);
 316            if (session != null && session.getFingerprint() != null) {
 317                if (!session.getTrust().isActive()) {
 318                    Log.d(Config.LOGTAG, "reactivating device with fingerprint " + session.getFingerprint());
 319                    session.setTrust(session.getTrust().toActive());
 320                }
 321            }
 322        }
 323        if (me) {
 324            if (Config.OMEMO_AUTO_EXPIRY != 0) {
 325                needsPublishing |= deviceIds.removeAll(getExpiredDevices());
 326            }
 327            needsPublishing |= this.changeAccessMode.get();
 328            for (Integer deviceId : deviceIds) {
 329                SignalProtocolAddress ownDeviceAddress = new SignalProtocolAddress(jid.asBareJid().toString(), deviceId);
 330                if (sessions.get(ownDeviceAddress) == null) {
 331                    FetchStatus status = fetchStatusMap.get(ownDeviceAddress);
 332                    if (status == null || status == FetchStatus.TIMEOUT) {
 333                        fetchStatusMap.put(ownDeviceAddress, FetchStatus.PENDING);
 334                        this.buildSessionFromPEP(ownDeviceAddress);
 335                    }
 336                }
 337            }
 338            if (needsPublishing) {
 339                publishOwnDeviceId(deviceIds);
 340            }
 341        }
 342        final Set<Integer> oldSet = this.deviceIds.get(jid);
 343        final boolean changed = oldSet == null || oldSet.hashCode() != hash;
 344        this.deviceIds.put(jid, deviceIds);
 345        if (changed) {
 346            mXmppConnectionService.updateConversationUi(); //update the lock icon
 347            mXmppConnectionService.keyStatusUpdated(null);
 348            if (me) {
 349                mXmppConnectionService.updateAccountUi();
 350            }
 351        } else {
 352            Log.d(Config.LOGTAG, "skipped device list update because it hasn't changed");
 353        }
 354    }
 355
 356    public void wipeOtherPepDevices() {
 357        if (pepBroken) {
 358            Log.d(Config.LOGTAG, getLogprefix(account) + "wipeOtherPepDevices called, but PEP is broken. Ignoring... ");
 359            return;
 360        }
 361        Set<Integer> deviceIds = new HashSet<>();
 362        deviceIds.add(getOwnDeviceId());
 363        publishDeviceIdsAndRefineAccessModel(deviceIds);
 364    }
 365
 366    public void distrustFingerprint(final String fingerprint) {
 367        final String fp = fingerprint.replaceAll("\\s", "");
 368        final FingerprintStatus fingerprintStatus = axolotlStore.getFingerprintStatus(fp);
 369        axolotlStore.setFingerprintStatus(fp, fingerprintStatus.toUntrusted());
 370    }
 371
 372    private void publishOwnDeviceIdIfNeeded() {
 373        if (pepBroken) {
 374            Log.d(Config.LOGTAG, getLogprefix(account) + "publishOwnDeviceIdIfNeeded called, but PEP is broken. Ignoring... ");
 375            return;
 376        }
 377        IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(account.getJid().asBareJid());
 378        mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
 379            @Override
 380            public void onIqPacketReceived(Account account, IqPacket packet) {
 381                if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
 382                    Log.d(Config.LOGTAG, getLogprefix(account) + "Timeout received while retrieving own Device Ids.");
 383                } else {
 384                    //TODO consider calling registerDevices only after item-not-found to account for broken PEPs
 385                    Element item = mXmppConnectionService.getIqParser().getItem(packet);
 386                    Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
 387                    Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": retrieved own device list: " + deviceIds);
 388                    registerDevices(account.getJid().asBareJid(), deviceIds);
 389                }
 390            }
 391        });
 392    }
 393
 394    private Set<Integer> getExpiredDevices() {
 395        Set<Integer> devices = new HashSet<>();
 396        for (XmppAxolotlSession session : findOwnSessions()) {
 397            if (session.getTrust().isActive()) {
 398                long diff = System.currentTimeMillis() - session.getTrust().getLastActivation();
 399                if (diff > Config.OMEMO_AUTO_EXPIRY) {
 400                    long lastMessageDiff = System.currentTimeMillis() - mXmppConnectionService.databaseBackend.getLastTimeFingerprintUsed(account, session.getFingerprint());
 401                    long hours = Math.round(lastMessageDiff / (1000 * 60.0 * 60.0));
 402                    if (lastMessageDiff > Config.OMEMO_AUTO_EXPIRY) {
 403                        devices.add(session.getRemoteAddress().getDeviceId());
 404                        session.setTrust(session.getTrust().toInactive());
 405                        Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": added own device " + session.getFingerprint() + " to list of expired devices. Last message received " + hours + " hours ago");
 406                    } else {
 407                        Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": own device " + session.getFingerprint() + " was active " + hours + " hours ago");
 408                    }
 409                } //TODO print last activation diff
 410            }
 411        }
 412        return devices;
 413    }
 414
 415    private void publishOwnDeviceId(Set<Integer> deviceIds) {
 416        Set<Integer> deviceIdsCopy = new HashSet<>(deviceIds);
 417        Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "publishing own device ids");
 418        if (deviceIdsCopy.isEmpty()) {
 419            if (numPublishTriesOnEmptyPep >= publishTriesThreshold) {
 420                Log.w(Config.LOGTAG, getLogprefix(account) + "Own device publish attempt threshold exceeded, aborting...");
 421                pepBroken = true;
 422                return;
 423            } else {
 424                numPublishTriesOnEmptyPep++;
 425                Log.w(Config.LOGTAG, getLogprefix(account) + "Own device list empty, attempting to publish (try " + numPublishTriesOnEmptyPep + ")");
 426            }
 427        } else {
 428            numPublishTriesOnEmptyPep = 0;
 429        }
 430        deviceIdsCopy.add(getOwnDeviceId());
 431        publishDeviceIdsAndRefineAccessModel(deviceIdsCopy);
 432    }
 433
 434    private void publishDeviceIdsAndRefineAccessModel(Set<Integer> ids) {
 435        publishDeviceIdsAndRefineAccessModel(ids, true);
 436    }
 437
 438    private void publishDeviceIdsAndRefineAccessModel(final Set<Integer> ids, final boolean firstAttempt) {
 439        final Bundle publishOptions = account.getXmppConnection().getFeatures().pepPublishOptions() ? PublishOptions.openAccess() : null;
 440        IqPacket publish = mXmppConnectionService.getIqGenerator().publishDeviceIds(ids, publishOptions);
 441        mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
 442            @Override
 443            public void onIqPacketReceived(Account account, IqPacket packet) {
 444                final Element error = packet.getType() == IqPacket.TYPE.ERROR ? packet.findChild("error") : null;
 445                final boolean preConditionNotMet = PublishOptions.preconditionNotMet(packet);
 446                if (firstAttempt && preConditionNotMet) {
 447                    Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": precondition wasn't met for device list. pushing node configuration");
 448                    mXmppConnectionService.pushNodeConfiguration(account, AxolotlService.PEP_DEVICE_LIST, publishOptions, new XmppConnectionService.OnConfigurationPushed() {
 449                        @Override
 450                        public void onPushSucceeded() {
 451                            publishDeviceIdsAndRefineAccessModel(ids, false);
 452                        }
 453
 454                        @Override
 455                        public void onPushFailed() {
 456                            publishDeviceIdsAndRefineAccessModel(ids, false);
 457                        }
 458                    });
 459                } else {
 460                    if (AxolotlService.this.changeAccessMode.compareAndSet(true, false)) {
 461                        Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": done changing access mode");
 462                        account.setOption(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE, false);
 463                        mXmppConnectionService.databaseBackend.updateAccount(account);
 464                    }
 465                    if (packet.getType() == IqPacket.TYPE.ERROR) {
 466                        if (preConditionNotMet) {
 467                            Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": device list pre condition still not met on second attempt");
 468                        } else if (error != null) {
 469                            pepBroken = true;
 470                            Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing own device id" + packet.findChild("error"));
 471                        }
 472
 473                    }
 474                }
 475            }
 476        });
 477    }
 478
 479    public void publishDeviceVerificationAndBundle(final SignedPreKeyRecord signedPreKeyRecord,
 480                                                   final Set<PreKeyRecord> preKeyRecords,
 481                                                   final boolean announceAfter,
 482                                                   final boolean wipe) {
 483        try {
 484            IdentityKey axolotlPublicKey = axolotlStore.getIdentityKeyPair().getPublicKey();
 485            PrivateKey x509PrivateKey = KeyChain.getPrivateKey(mXmppConnectionService, account.getPrivateKeyAlias());
 486            X509Certificate[] chain = KeyChain.getCertificateChain(mXmppConnectionService, account.getPrivateKeyAlias());
 487            Signature verifier = Signature.getInstance("sha256WithRSA");
 488            verifier.initSign(x509PrivateKey, mXmppConnectionService.getRNG());
 489            verifier.update(axolotlPublicKey.serialize());
 490            byte[] signature = verifier.sign();
 491            IqPacket packet = mXmppConnectionService.getIqGenerator().publishVerification(signature, chain, getOwnDeviceId());
 492            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": publish verification for device " + getOwnDeviceId());
 493            mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
 494                @Override
 495                public void onIqPacketReceived(final Account account, IqPacket packet) {
 496                    String node = AxolotlService.PEP_VERIFICATION + ":" + getOwnDeviceId();
 497                    mXmppConnectionService.pushNodeConfiguration(account, node, PublishOptions.openAccess(), new XmppConnectionService.OnConfigurationPushed() {
 498                        @Override
 499                        public void onPushSucceeded() {
 500                            Log.d(Config.LOGTAG, getLogprefix(account) + "configured verification node to be world readable");
 501                            publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
 502                        }
 503
 504                        @Override
 505                        public void onPushFailed() {
 506                            Log.d(Config.LOGTAG, getLogprefix(account) + "unable to set access model on verification node");
 507                            publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
 508                        }
 509                    });
 510                }
 511            });
 512        } catch (Exception e) {
 513            e.printStackTrace();
 514        }
 515    }
 516
 517    public void publishBundlesIfNeeded(final boolean announce, final boolean wipe) {
 518        if (pepBroken) {
 519            Log.d(Config.LOGTAG, getLogprefix(account) + "publishBundlesIfNeeded called, but PEP is broken. Ignoring... ");
 520            return;
 521        }
 522
 523        if (account.getXmppConnection().getFeatures().pepPublishOptions()) {
 524            this.changeAccessMode.set(account.isOptionSet(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE));
 525        } else {
 526            if (account.setOption(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE, true)) {
 527                Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": server doesn’t support publish-options. setting for later access mode change");
 528                mXmppConnectionService.databaseBackend.updateAccount(account);
 529            }
 530        }
 531        if (this.changeAccessMode.get()) {
 532            Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": server gained publish-options capabilities. changing access model");
 533        }
 534        IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(account.getJid().asBareJid(), getOwnDeviceId());
 535        mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
 536            @Override
 537            public void onIqPacketReceived(Account account, IqPacket packet) {
 538
 539                if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
 540                    return; //ignore timeout. do nothing
 541                }
 542
 543                if (packet.getType() == IqPacket.TYPE.ERROR) {
 544                    Element error = packet.findChild("error");
 545                    if (error == null || !error.hasChild("item-not-found")) {
 546                        pepBroken = true;
 547                        Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "request for device bundles came back with something other than item-not-found" + packet);
 548                        return;
 549                    }
 550                }
 551
 552                PreKeyBundle bundle = mXmppConnectionService.getIqParser().bundle(packet);
 553                Map<Integer, ECPublicKey> keys = mXmppConnectionService.getIqParser().preKeyPublics(packet);
 554                boolean flush = false;
 555                if (bundle == null) {
 556                    Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid bundle:" + packet);
 557                    bundle = new PreKeyBundle(-1, -1, -1, null, -1, null, null, null);
 558                    flush = true;
 559                }
 560                if (keys == null) {
 561                    Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid prekeys:" + packet);
 562                }
 563                try {
 564                    boolean changed = false;
 565                    // Validate IdentityKey
 566                    IdentityKeyPair identityKeyPair = axolotlStore.getIdentityKeyPair();
 567                    if (flush || !identityKeyPair.getPublicKey().equals(bundle.getIdentityKey())) {
 568                        Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding own IdentityKey " + identityKeyPair.getPublicKey() + " to PEP.");
 569                        changed = true;
 570                    }
 571
 572                    // Validate signedPreKeyRecord + ID
 573                    SignedPreKeyRecord signedPreKeyRecord;
 574                    int numSignedPreKeys = axolotlStore.getSignedPreKeysCount();
 575                    try {
 576                        signedPreKeyRecord = axolotlStore.loadSignedPreKey(bundle.getSignedPreKeyId());
 577                        if (flush
 578                                || !bundle.getSignedPreKey().equals(signedPreKeyRecord.getKeyPair().getPublicKey())
 579                                || !Arrays.equals(bundle.getSignedPreKeySignature(), signedPreKeyRecord.getSignature())) {
 580                            Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
 581                            signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
 582                            axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
 583                            changed = true;
 584                        }
 585                    } catch (InvalidKeyIdException e) {
 586                        Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
 587                        signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
 588                        axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
 589                        changed = true;
 590                    }
 591
 592                    // Validate PreKeys
 593                    Set<PreKeyRecord> preKeyRecords = new HashSet<>();
 594                    if (keys != null) {
 595                        for (Integer id : keys.keySet()) {
 596                            try {
 597                                PreKeyRecord preKeyRecord = axolotlStore.loadPreKey(id);
 598                                if (preKeyRecord.getKeyPair().getPublicKey().equals(keys.get(id))) {
 599                                    preKeyRecords.add(preKeyRecord);
 600                                }
 601                            } catch (InvalidKeyIdException ignored) {
 602                            }
 603                        }
 604                    }
 605                    int newKeys = NUM_KEYS_TO_PUBLISH - preKeyRecords.size();
 606                    if (newKeys > 0) {
 607                        List<PreKeyRecord> newRecords = KeyHelper.generatePreKeys(
 608                                axolotlStore.getCurrentPreKeyId() + 1, newKeys);
 609                        preKeyRecords.addAll(newRecords);
 610                        for (PreKeyRecord record : newRecords) {
 611                            axolotlStore.storePreKey(record.getId(), record);
 612                        }
 613                        changed = true;
 614                        Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding " + newKeys + " new preKeys to PEP.");
 615                    }
 616
 617
 618                    if (changed || changeAccessMode.get()) {
 619                        if (account.getPrivateKeyAlias() != null && Config.X509_VERIFICATION) {
 620                            mXmppConnectionService.publishDisplayName(account);
 621                            publishDeviceVerificationAndBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
 622                        } else {
 623                            publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
 624                        }
 625                    } else {
 626                        Log.d(Config.LOGTAG, getLogprefix(account) + "Bundle " + getOwnDeviceId() + " in PEP was current");
 627                        if (wipe) {
 628                            wipeOtherPepDevices();
 629                        } else if (announce) {
 630                            Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
 631                            publishOwnDeviceIdIfNeeded();
 632                        }
 633                    }
 634                } catch (InvalidKeyException e) {
 635                    Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Failed to publish bundle " + getOwnDeviceId() + ", reason: " + e.getMessage());
 636                }
 637            }
 638        });
 639    }
 640
 641    private void publishDeviceBundle(SignedPreKeyRecord signedPreKeyRecord,
 642                                     Set<PreKeyRecord> preKeyRecords,
 643                                     final boolean announceAfter,
 644                                     final boolean wipe) {
 645        publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe, true);
 646    }
 647
 648    private void publishDeviceBundle(final SignedPreKeyRecord signedPreKeyRecord,
 649                                     final Set<PreKeyRecord> preKeyRecords,
 650                                     final boolean announceAfter,
 651                                     final boolean wipe,
 652                                     final boolean firstAttempt) {
 653        final Bundle publishOptions = account.getXmppConnection().getFeatures().pepPublishOptions() ? PublishOptions.openAccess() : null;
 654        final IqPacket publish = mXmppConnectionService.getIqGenerator().publishBundles(
 655                signedPreKeyRecord, axolotlStore.getIdentityKeyPair().getPublicKey(),
 656                preKeyRecords, getOwnDeviceId(), publishOptions);
 657        Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": Bundle " + getOwnDeviceId() + " in PEP not current. Publishing...");
 658        mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
 659            @Override
 660            public void onIqPacketReceived(final Account account, IqPacket packet) {
 661                final boolean preconditionNotMet = PublishOptions.preconditionNotMet(packet);
 662                if (firstAttempt && preconditionNotMet) {
 663                    Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": precondition wasn't met for bundle. pushing node configuration");
 664                    final String node = AxolotlService.PEP_BUNDLES + ":" + getOwnDeviceId();
 665                    mXmppConnectionService.pushNodeConfiguration(account, node, publishOptions, new XmppConnectionService.OnConfigurationPushed() {
 666                        @Override
 667                        public void onPushSucceeded() {
 668                            publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe, false);
 669                        }
 670
 671                        @Override
 672                        public void onPushFailed() {
 673                            publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe, false);
 674                        }
 675                    });
 676                } else if (packet.getType() == IqPacket.TYPE.RESULT) {
 677                    Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Successfully published bundle. ");
 678                    if (wipe) {
 679                        wipeOtherPepDevices();
 680                    } else if (announceAfter) {
 681                        Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
 682                        publishOwnDeviceIdIfNeeded();
 683                    }
 684                } else if (packet.getType() == IqPacket.TYPE.ERROR) {
 685                    if (preconditionNotMet) {
 686                        Log.d(Config.LOGTAG, getLogprefix(account) + "bundle precondition still not met after second attempt");
 687                    } else {
 688                        Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing bundle: " + packet.toString());
 689                    }
 690                    pepBroken = true;
 691                }
 692            }
 693        });
 694    }
 695
 696    public void deleteOmemoIdentity() {
 697        final String node = AxolotlService.PEP_BUNDLES + ":" + getOwnDeviceId();
 698        final IqPacket deleteBundleNode = mXmppConnectionService.getIqGenerator().deleteNode(node);
 699        mXmppConnectionService.sendIqPacket(account, deleteBundleNode, null);
 700        final Set<Integer> ownDeviceIds = getOwnDeviceIds();
 701        publishDeviceIdsAndRefineAccessModel(ownDeviceIds == null ? Collections.emptySet() : ownDeviceIds);
 702    }
 703
 704    public List<Jid> getCryptoTargets(Conversation conversation) {
 705        final List<Jid> jids;
 706        if (conversation.getMode() == Conversation.MODE_SINGLE) {
 707            jids = new ArrayList<>();
 708            jids.add(conversation.getJid().asBareJid());
 709        } else {
 710            jids = conversation.getMucOptions().getMembers(false);
 711        }
 712        return jids;
 713    }
 714
 715    public FingerprintStatus getFingerprintTrust(String fingerprint) {
 716        return axolotlStore.getFingerprintStatus(fingerprint);
 717    }
 718
 719    public X509Certificate getFingerprintCertificate(String fingerprint) {
 720        return axolotlStore.getFingerprintCertificate(fingerprint);
 721    }
 722
 723    public void setFingerprintTrust(String fingerprint, FingerprintStatus status) {
 724        axolotlStore.setFingerprintStatus(fingerprint, status);
 725    }
 726
 727    private void verifySessionWithPEP(final XmppAxolotlSession session) {
 728        Log.d(Config.LOGTAG, "trying to verify fresh session (" + session.getRemoteAddress().getName() + ") with pep");
 729        final SignalProtocolAddress address = session.getRemoteAddress();
 730        final IdentityKey identityKey = session.getIdentityKey();
 731        try {
 732            IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveVerificationForDevice(Jid.of(address.getName()), address.getDeviceId());
 733            mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
 734                @Override
 735                public void onIqPacketReceived(Account account, IqPacket packet) {
 736                    Pair<X509Certificate[], byte[]> verification = mXmppConnectionService.getIqParser().verification(packet);
 737                    if (verification != null) {
 738                        try {
 739                            Signature verifier = Signature.getInstance("sha256WithRSA");
 740                            verifier.initVerify(verification.first[0]);
 741                            verifier.update(identityKey.serialize());
 742                            if (verifier.verify(verification.second)) {
 743                                try {
 744                                    mXmppConnectionService.getMemorizingTrustManager().getNonInteractive().checkClientTrusted(verification.first, "RSA");
 745                                    String fingerprint = session.getFingerprint();
 746                                    Log.d(Config.LOGTAG, "verified session with x.509 signature. fingerprint was: " + fingerprint);
 747                                    setFingerprintTrust(fingerprint, FingerprintStatus.createActiveVerified(true));
 748                                    axolotlStore.setFingerprintCertificate(fingerprint, verification.first[0]);
 749                                    fetchStatusMap.put(address, FetchStatus.SUCCESS_VERIFIED);
 750                                    Bundle information = CryptoHelper.extractCertificateInformation(verification.first[0]);
 751                                    try {
 752                                        final String cn = information.getString("subject_cn");
 753                                        final Jid jid = Jid.of(address.getName());
 754                                        Log.d(Config.LOGTAG, "setting common name for " + jid + " to " + cn);
 755                                        account.getRoster().getContact(jid).setCommonName(cn);
 756                                    } catch (final IllegalArgumentException ignored) {
 757                                        //ignored
 758                                    }
 759                                    finishBuildingSessionsFromPEP(address);
 760                                    return;
 761                                } catch (Exception e) {
 762                                    Log.d(Config.LOGTAG, "could not verify certificate");
 763                                }
 764                            }
 765                        } catch (Exception e) {
 766                            Log.d(Config.LOGTAG, "error during verification " + e.getMessage());
 767                        }
 768                    } else {
 769                        Log.d(Config.LOGTAG, "no verification found");
 770                    }
 771                    fetchStatusMap.put(address, FetchStatus.SUCCESS);
 772                    finishBuildingSessionsFromPEP(address);
 773                }
 774            });
 775        } catch (IllegalArgumentException e) {
 776            fetchStatusMap.put(address, FetchStatus.SUCCESS);
 777            finishBuildingSessionsFromPEP(address);
 778        }
 779    }
 780
 781    private void finishBuildingSessionsFromPEP(final SignalProtocolAddress address) {
 782        SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().asBareJid().toString(), 0);
 783        Map<Integer, FetchStatus> own = fetchStatusMap.getAll(ownAddress.getName());
 784        Map<Integer, FetchStatus> remote = fetchStatusMap.getAll(address.getName());
 785        if (!own.containsValue(FetchStatus.PENDING) && !remote.containsValue(FetchStatus.PENDING)) {
 786            FetchStatus report = null;
 787            if (own.containsValue(FetchStatus.SUCCESS) || remote.containsValue(FetchStatus.SUCCESS)) {
 788                report = FetchStatus.SUCCESS;
 789            } else if (own.containsValue(FetchStatus.SUCCESS_VERIFIED) || remote.containsValue(FetchStatus.SUCCESS_VERIFIED)) {
 790                report = FetchStatus.SUCCESS_VERIFIED;
 791            } else if (own.containsValue(FetchStatus.SUCCESS_TRUSTED) || remote.containsValue(FetchStatus.SUCCESS_TRUSTED)) {
 792                report = FetchStatus.SUCCESS_TRUSTED;
 793            } else if (own.containsValue(FetchStatus.ERROR) || remote.containsValue(FetchStatus.ERROR)) {
 794                report = FetchStatus.ERROR;
 795            }
 796            mXmppConnectionService.keyStatusUpdated(report);
 797        }
 798        if (Config.REMOVE_BROKEN_DEVICES) {
 799            Set<Integer> ownDeviceIds = new HashSet<>(getOwnDeviceIds());
 800            boolean publish = false;
 801            for (Map.Entry<Integer, FetchStatus> entry : own.entrySet()) {
 802                int id = entry.getKey();
 803                if (entry.getValue() == FetchStatus.ERROR && PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT.add(id) && ownDeviceIds.remove(id)) {
 804                    publish = true;
 805                    Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": error fetching own device with id " + id + ". removing from announcement");
 806                }
 807            }
 808            if (publish) {
 809                publishOwnDeviceId(ownDeviceIds);
 810            }
 811        }
 812    }
 813
 814    public boolean hasEmptyDeviceList(Jid jid) {
 815        return !hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty());
 816    }
 817
 818    public void fetchDeviceIds(final Jid jid) {
 819        fetchDeviceIds(jid, null);
 820    }
 821
 822    private void fetchDeviceIds(final Jid jid, OnDeviceIdsFetched callback) {
 823        IqPacket packet;
 824        synchronized (this.fetchDeviceIdsMap) {
 825            List<OnDeviceIdsFetched> callbacks = this.fetchDeviceIdsMap.get(jid);
 826            if (callbacks != null) {
 827                if (callback != null) {
 828                    callbacks.add(callback);
 829                }
 830                Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": fetching device ids for " + jid + " already running. adding callback");
 831                packet = null;
 832            } else {
 833                callbacks = new ArrayList<>();
 834                if (callback != null) {
 835                    callbacks.add(callback);
 836                }
 837                this.fetchDeviceIdsMap.put(jid, callbacks);
 838                Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": fetching device ids for " + jid);
 839                packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(jid);
 840            }
 841        }
 842        if (packet != null) {
 843            mXmppConnectionService.sendIqPacket(account, packet, (account, response) -> {
 844                if (response.getType() == IqPacket.TYPE.RESULT) {
 845                    fetchDeviceListStatus.put(jid, true);
 846                    Element item = mXmppConnectionService.getIqParser().getItem(response);
 847                    Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
 848                    registerDevices(jid, deviceIds);
 849                    final List<OnDeviceIdsFetched> callbacks;
 850                    synchronized (fetchDeviceIdsMap) {
 851                        callbacks = fetchDeviceIdsMap.remove(jid);
 852                    }
 853                    if (callbacks != null) {
 854                        for (OnDeviceIdsFetched c : callbacks) {
 855                            c.fetched(jid, deviceIds);
 856                        }
 857                    }
 858                } else {
 859                    if (response.getType() == IqPacket.TYPE.TIMEOUT) {
 860                        fetchDeviceListStatus.remove(jid);
 861                    } else {
 862                        fetchDeviceListStatus.put(jid, false);
 863                    }
 864                    final List<OnDeviceIdsFetched> callbacks;
 865                    synchronized (fetchDeviceIdsMap) {
 866                        callbacks = fetchDeviceIdsMap.remove(jid);
 867                    }
 868                    if (callbacks != null) {
 869                        for (OnDeviceIdsFetched c : callbacks) {
 870                            c.fetched(jid, null);
 871                        }
 872                    }
 873                }
 874            });
 875        }
 876    }
 877
 878    private void fetchDeviceIds(List<Jid> jids, final OnMultipleDeviceIdFetched callback) {
 879        final ArrayList<Jid> unfinishedJids = new ArrayList<>(jids);
 880        synchronized (unfinishedJids) {
 881            for (Jid jid : unfinishedJids) {
 882                fetchDeviceIds(jid, (j, deviceIds) -> {
 883                    synchronized (unfinishedJids) {
 884                        unfinishedJids.remove(j);
 885                        if (unfinishedJids.size() == 0 && callback != null) {
 886                            callback.fetched();
 887                        }
 888                    }
 889                });
 890            }
 891        }
 892    }
 893
 894    private void buildSessionFromPEP(final SignalProtocolAddress address) {
 895        buildSessionFromPEP(address, null);
 896    }
 897
 898    private void buildSessionFromPEP(final SignalProtocolAddress address, OnSessionBuildFromPep callback) {
 899        Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Building new session for " + address.toString());
 900        if (address.equals(getOwnAxolotlAddress())) {
 901            throw new AssertionError("We should NEVER build a session with ourselves. What happened here?!");
 902        }
 903
 904        final Jid jid = Jid.of(address.getName());
 905        final boolean oneOfOurs = jid.asBareJid().equals(account.getJid().asBareJid());
 906        IqPacket bundlesPacket = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(jid, address.getDeviceId());
 907        mXmppConnectionService.sendIqPacket(account, bundlesPacket, (account, packet) -> {
 908            if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
 909                fetchStatusMap.put(address, FetchStatus.TIMEOUT);
 910            } else if (packet.getType() == IqPacket.TYPE.RESULT) {
 911                Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received preKey IQ packet, processing...");
 912                final IqParser parser = mXmppConnectionService.getIqParser();
 913                final List<PreKeyBundle> preKeyBundleList = parser.preKeys(packet);
 914                final PreKeyBundle bundle = parser.bundle(packet);
 915                if (preKeyBundleList.isEmpty() || bundle == null) {
 916                    Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "preKey IQ packet invalid: " + packet);
 917                    fetchStatusMap.put(address, FetchStatus.ERROR);
 918                    finishBuildingSessionsFromPEP(address);
 919                    if (callback != null) {
 920                        callback.onSessionBuildFailed();
 921                    }
 922                    return;
 923                }
 924                Random random = new Random();
 925                final PreKeyBundle preKey = preKeyBundleList.get(random.nextInt(preKeyBundleList.size()));
 926                if (preKey == null) {
 927                    //should never happen
 928                    fetchStatusMap.put(address, FetchStatus.ERROR);
 929                    finishBuildingSessionsFromPEP(address);
 930                    if (callback != null) {
 931                        callback.onSessionBuildFailed();
 932                    }
 933                    return;
 934                }
 935
 936                final PreKeyBundle preKeyBundle = new PreKeyBundle(0, address.getDeviceId(),
 937                        preKey.getPreKeyId(), preKey.getPreKey(),
 938                        bundle.getSignedPreKeyId(), bundle.getSignedPreKey(),
 939                        bundle.getSignedPreKeySignature(), bundle.getIdentityKey());
 940
 941                try {
 942                    SessionBuilder builder = new SessionBuilder(axolotlStore, address);
 943                    builder.process(preKeyBundle);
 944                    XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, bundle.getIdentityKey());
 945                    sessions.put(address, session);
 946                    if (Config.X509_VERIFICATION) {
 947                        verifySessionWithPEP(session); //TODO; maybe inject callback in here too
 948                    } else {
 949                        FingerprintStatus status = getFingerprintTrust(CryptoHelper.bytesToHex(bundle.getIdentityKey().getPublicKey().serialize()));
 950                        FetchStatus fetchStatus;
 951                        if (status != null && status.isVerified()) {
 952                            fetchStatus = FetchStatus.SUCCESS_VERIFIED;
 953                        } else if (status != null && status.isTrusted()) {
 954                            fetchStatus = FetchStatus.SUCCESS_TRUSTED;
 955                        } else {
 956                            fetchStatus = FetchStatus.SUCCESS;
 957                        }
 958                        fetchStatusMap.put(address, fetchStatus);
 959                        finishBuildingSessionsFromPEP(address);
 960                        if (callback != null) {
 961                            callback.onSessionBuildSuccessful();
 962                        }
 963                    }
 964                } catch (UntrustedIdentityException | InvalidKeyException e) {
 965                    Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Error building session for " + address + ": "
 966                            + e.getClass().getName() + ", " + e.getMessage());
 967                    fetchStatusMap.put(address, FetchStatus.ERROR);
 968                    finishBuildingSessionsFromPEP(address);
 969                    if (oneOfOurs && cleanedOwnDeviceIds.add(address.getDeviceId())) {
 970                        removeFromDeviceAnnouncement(address.getDeviceId());
 971                    }
 972                    if (callback != null) {
 973                        callback.onSessionBuildFailed();
 974                    }
 975                }
 976            } else {
 977                fetchStatusMap.put(address, FetchStatus.ERROR);
 978                Element error = packet.findChild("error");
 979                boolean itemNotFound = error != null && error.hasChild("item-not-found");
 980                Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while building session:" + packet.findChild("error"));
 981                finishBuildingSessionsFromPEP(address);
 982                if (oneOfOurs && itemNotFound && cleanedOwnDeviceIds.add(address.getDeviceId())) {
 983                    removeFromDeviceAnnouncement(address.getDeviceId());
 984                }
 985                if (callback != null) {
 986                    callback.onSessionBuildFailed();
 987                }
 988            }
 989        });
 990    }
 991
 992    private void removeFromDeviceAnnouncement(Integer id) {
 993        HashSet<Integer> temp = new HashSet<>(getOwnDeviceIds());
 994        if (temp.remove(id)) {
 995            Log.d(Config.LOGTAG, account.getJid().asBareJid() + " remove own device id " + id + " from announcement. devices left:" + temp);
 996            publishOwnDeviceId(temp);
 997        }
 998    }
 999
1000    public Set<SignalProtocolAddress> findDevicesWithoutSession(final Conversation conversation) {
1001        Set<SignalProtocolAddress> addresses = new HashSet<>();
1002        for (Jid jid : getCryptoTargets(conversation)) {
1003            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Finding devices without session for " + jid);
1004            final Set<Integer> ids = deviceIds.get(jid);
1005            if (ids != null && !ids.isEmpty()) {
1006                for (Integer foreignId : ids) {
1007                    SignalProtocolAddress address = new SignalProtocolAddress(jid.toString(), foreignId);
1008                    if (sessions.get(address) == null) {
1009                        IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1010                        if (identityKey != null) {
1011                            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
1012                            XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
1013                            sessions.put(address, session);
1014                        } else {
1015                            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + jid + ":" + foreignId);
1016                            if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1017                                addresses.add(address);
1018                            } else {
1019                                Log.d(Config.LOGTAG, getLogprefix(account) + "skipping over " + address + " because it's broken");
1020                            }
1021                        }
1022                    }
1023                }
1024            } else {
1025                mXmppConnectionService.keyStatusUpdated(FetchStatus.ERROR);
1026                Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Have no target devices in PEP!");
1027            }
1028        }
1029        Set<Integer> ownIds = this.deviceIds.get(account.getJid().asBareJid());
1030        for (Integer ownId : (ownIds != null ? ownIds : new HashSet<Integer>())) {
1031            SignalProtocolAddress address = new SignalProtocolAddress(account.getJid().asBareJid().toString(), ownId);
1032            if (sessions.get(address) == null) {
1033                IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1034                if (identityKey != null) {
1035                    Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
1036                    XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
1037                    sessions.put(address, session);
1038                } else {
1039                    Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + account.getJid().asBareJid() + ":" + ownId);
1040                    if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1041                        addresses.add(address);
1042                    } else {
1043                        Log.d(Config.LOGTAG, getLogprefix(account) + "skipping over " + address + " because it's broken");
1044                    }
1045                }
1046            }
1047        }
1048
1049        return addresses;
1050    }
1051
1052    public boolean createSessionsIfNeeded(final Conversation conversation) {
1053        final List<Jid> jidsWithEmptyDeviceList = getCryptoTargets(conversation);
1054        for (Iterator<Jid> iterator = jidsWithEmptyDeviceList.iterator(); iterator.hasNext(); ) {
1055            final Jid jid = iterator.next();
1056            if (!hasEmptyDeviceList(jid)) {
1057                iterator.remove();
1058            }
1059        }
1060        Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": createSessionsIfNeeded() - jids with empty device list: " + jidsWithEmptyDeviceList);
1061        if (jidsWithEmptyDeviceList.size() > 0) {
1062            fetchDeviceIds(jidsWithEmptyDeviceList, () -> createSessionsIfNeededActual(conversation));
1063            return true;
1064        } else {
1065            return createSessionsIfNeededActual(conversation);
1066        }
1067    }
1068
1069    private boolean createSessionsIfNeededActual(final Conversation conversation) {
1070        Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Creating axolotl sessions if needed...");
1071        boolean newSessions = false;
1072        Set<SignalProtocolAddress> addresses = findDevicesWithoutSession(conversation);
1073        for (SignalProtocolAddress address : addresses) {
1074            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Processing device: " + address.toString());
1075            FetchStatus status = fetchStatusMap.get(address);
1076            if (status == null || status == FetchStatus.TIMEOUT) {
1077                fetchStatusMap.put(address, FetchStatus.PENDING);
1078                this.buildSessionFromPEP(address);
1079                newSessions = true;
1080            } else if (status == FetchStatus.PENDING) {
1081                newSessions = true;
1082            } else {
1083                Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already fetching bundle for " + address.toString());
1084            }
1085        }
1086
1087        return newSessions;
1088    }
1089
1090    public boolean trustedSessionVerified(final Conversation conversation) {
1091        final Set<XmppAxolotlSession> sessions = new HashSet<>();
1092        sessions.addAll(findSessionsForConversation(conversation));
1093        sessions.addAll(findOwnSessions());
1094        boolean verified = false;
1095        for (XmppAxolotlSession session : sessions) {
1096            if (session.getTrust().isTrustedAndActive()) {
1097                if (session.getTrust().getTrust() == FingerprintStatus.Trust.VERIFIED_X509) {
1098                    verified = true;
1099                } else {
1100                    return false;
1101                }
1102            }
1103        }
1104        return verified;
1105    }
1106
1107    public boolean hasPendingKeyFetches(List<Jid> jids) {
1108        SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().asBareJid().toString(), 0);
1109        if (fetchStatusMap.getAll(ownAddress.getName()).containsValue(FetchStatus.PENDING)) {
1110            return true;
1111        }
1112        synchronized (this.fetchDeviceIdsMap) {
1113            for (Jid jid : jids) {
1114                SignalProtocolAddress foreignAddress = new SignalProtocolAddress(jid.asBareJid().toString(), 0);
1115                if (fetchStatusMap.getAll(foreignAddress.getName()).containsValue(FetchStatus.PENDING) || this.fetchDeviceIdsMap.containsKey(jid)) {
1116                    return true;
1117                }
1118            }
1119        }
1120        return false;
1121    }
1122
1123    @Nullable
1124    private boolean buildHeader(XmppAxolotlMessage axolotlMessage, Conversation c) {
1125        Set<XmppAxolotlSession> remoteSessions = findSessionsForConversation(c);
1126        final boolean acceptEmpty = (c.getMode() == Conversation.MODE_MULTI && c.getMucOptions().getUserCount() == 0) || c.getContact().isSelf();
1127        Collection<XmppAxolotlSession> ownSessions = findOwnSessions();
1128        if (remoteSessions.isEmpty() && !acceptEmpty) {
1129            return false;
1130        }
1131        for (XmppAxolotlSession session : remoteSessions) {
1132            axolotlMessage.addDevice(session);
1133        }
1134        for (XmppAxolotlSession session : ownSessions) {
1135            axolotlMessage.addDevice(session);
1136        }
1137
1138        return true;
1139    }
1140
1141    //this is being used for private muc messages only
1142    private boolean buildHeader(XmppAxolotlMessage axolotlMessage, Jid jid) {
1143        if (jid == null) {
1144            return false;
1145        }
1146        HashSet<XmppAxolotlSession> sessions = new HashSet<>();
1147        sessions.addAll(this.sessions.getAll(getAddressForJid(jid).getName()).values());
1148        if (sessions.isEmpty()) {
1149            return false;
1150        }
1151        sessions.addAll(findOwnSessions());
1152        for (XmppAxolotlSession session : sessions) {
1153            axolotlMessage.addDevice(session);
1154        }
1155        return true;
1156    }
1157
1158    @Nullable
1159    public XmppAxolotlMessage encrypt(Message message) {
1160        final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().asBareJid(), getOwnDeviceId(), true);
1161        final String content;
1162        if (message.hasFileOnRemoteHost()) {
1163            content = message.getFileParams().url.toString();
1164        } else {
1165            content = message.getBody();
1166        }
1167        try {
1168            axolotlMessage.encrypt(content);
1169        } catch (CryptoFailedException e) {
1170            Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to encrypt message: " + e.getMessage());
1171            return null;
1172        }
1173
1174        final boolean success;
1175        if (message.isPrivateMessage()) {
1176            success = buildHeader(axolotlMessage, message.getTrueCounterpart());
1177        } else {
1178            success = buildHeader(axolotlMessage, (Conversation) message.getConversation());
1179        }
1180        return success ? axolotlMessage : null;
1181    }
1182
1183    public void preparePayloadMessage(final Message message, final boolean delay) {
1184        executor.execute(new Runnable() {
1185            @Override
1186            public void run() {
1187                XmppAxolotlMessage axolotlMessage = encrypt(message);
1188                if (axolotlMessage == null) {
1189                    mXmppConnectionService.markMessage(message, Message.STATUS_SEND_FAILED);
1190                    //mXmppConnectionService.updateConversationUi();
1191                } else {
1192                    Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Generated message, caching: " + message.getUuid());
1193                    messageCache.put(message.getUuid(), axolotlMessage);
1194                    mXmppConnectionService.resendMessage(message, delay);
1195                }
1196            }
1197        });
1198    }
1199
1200    public void prepareKeyTransportMessage(final Conversation conversation, final OnMessageCreatedCallback onMessageCreatedCallback) {
1201        executor.execute(new Runnable() {
1202            @Override
1203            public void run() {
1204                final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().asBareJid(), getOwnDeviceId(), false);
1205                if (buildHeader(axolotlMessage, conversation)) {
1206                    onMessageCreatedCallback.run(axolotlMessage);
1207                } else {
1208                    onMessageCreatedCallback.run(null);
1209                }
1210            }
1211        });
1212    }
1213
1214    public XmppAxolotlMessage fetchAxolotlMessageFromCache(Message message) {
1215        XmppAxolotlMessage axolotlMessage = messageCache.get(message.getUuid());
1216        if (axolotlMessage != null) {
1217            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache hit: " + message.getUuid());
1218            messageCache.remove(message.getUuid());
1219        } else {
1220            Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache miss: " + message.getUuid());
1221        }
1222        return axolotlMessage;
1223    }
1224
1225    private XmppAxolotlSession recreateUncachedSession(SignalProtocolAddress address) {
1226        IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1227        return (identityKey != null)
1228                ? new XmppAxolotlSession(account, axolotlStore, address, identityKey)
1229                : null;
1230    }
1231
1232    private XmppAxolotlSession getReceivingSession(XmppAxolotlMessage message) {
1233        SignalProtocolAddress senderAddress = new SignalProtocolAddress(message.getFrom().toString(), message.getSenderDeviceId());
1234        return getReceivingSession(senderAddress);
1235
1236    }
1237
1238    private XmppAxolotlSession getReceivingSession(SignalProtocolAddress senderAddress) {
1239        XmppAxolotlSession session = sessions.get(senderAddress);
1240        if (session == null) {
1241            session = recreateUncachedSession(senderAddress);
1242            if (session == null) {
1243                session = new XmppAxolotlSession(account, axolotlStore, senderAddress);
1244            }
1245        }
1246        return session;
1247    }
1248
1249    public XmppAxolotlMessage.XmppAxolotlPlaintextMessage processReceivingPayloadMessage(XmppAxolotlMessage message, boolean postponePreKeyMessageHandling) throws NotEncryptedForThisDeviceException, BrokenSessionException, OutdatedSenderException {
1250        XmppAxolotlMessage.XmppAxolotlPlaintextMessage plaintextMessage = null;
1251
1252        XmppAxolotlSession session = getReceivingSession(message);
1253        int ownDeviceId = getOwnDeviceId();
1254        try {
1255            plaintextMessage = message.decrypt(session, ownDeviceId);
1256            Integer preKeyId = session.getPreKeyIdAndReset();
1257            if (preKeyId != null) {
1258                postPreKeyMessageHandling(session, postponePreKeyMessageHandling);
1259            }
1260        } catch (NotEncryptedForThisDeviceException e) {
1261            if (account.getJid().asBareJid().equals(message.getFrom().asBareJid()) && message.getSenderDeviceId() == ownDeviceId) {
1262                Log.w(Config.LOGTAG, getLogprefix(account) + "Reflected omemo message received");
1263            } else {
1264                throw e;
1265            }
1266        } catch (final BrokenSessionException e) {
1267            throw e;
1268        } catch (final OutdatedSenderException e) {
1269            Log.e(Config.LOGTAG,account.getJid().asBareJid()+": "+e.getMessage());
1270            throw e;
1271        } catch (CryptoFailedException e) {
1272            Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to decrypt message from " + message.getFrom(), e);
1273        }
1274
1275        if (session.isFresh() && plaintextMessage != null) {
1276            putFreshSession(session);
1277        }
1278
1279        return plaintextMessage;
1280    }
1281
1282    public void reportBrokenSessionException(BrokenSessionException e, boolean postpone) {
1283        Log.e(Config.LOGTAG, account.getJid().asBareJid() + ": broken session with " + e.getSignalProtocolAddress().toString() + " detected", e);
1284        if (postpone) {
1285            postponedHealing.add(e.getSignalProtocolAddress());
1286        } else {
1287            notifyRequiresHealing(e.getSignalProtocolAddress());
1288        }
1289    }
1290
1291    private void notifyRequiresHealing(final SignalProtocolAddress signalProtocolAddress) {
1292        if (healingAttempts.add(signalProtocolAddress)) {
1293            Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": attempt to heal " + signalProtocolAddress);
1294            buildSessionFromPEP(signalProtocolAddress, new OnSessionBuildFromPep() {
1295                @Override
1296                public void onSessionBuildSuccessful() {
1297                    Log.d(Config.LOGTAG, "successfully build new session from pep after detecting broken session");
1298                    completeSession(getReceivingSession(signalProtocolAddress));
1299                }
1300
1301                @Override
1302                public void onSessionBuildFailed() {
1303                    Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": unable to build new session from pep after detecting broken session");
1304                }
1305            });
1306        } else {
1307            Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": do not attempt to heal " + signalProtocolAddress + " again");
1308        }
1309    }
1310
1311    private void postPreKeyMessageHandling(final XmppAxolotlSession session, final boolean postpone) {
1312        if (postpone) {
1313            postponedSessions.add(session);
1314        } else {
1315            if (axolotlStore.flushPreKeys()) {
1316                publishBundlesIfNeeded(false, false);
1317            } else {
1318                Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": nothing to flush. Not republishing key");
1319            }
1320            if (trustedOrPreviouslyResponded(session)) {
1321                completeSession(session);
1322            }
1323        }
1324    }
1325
1326    public void processPostponed() {
1327        if (postponedSessions.size() > 0) {
1328            if (axolotlStore.flushPreKeys()) {
1329                publishBundlesIfNeeded(false, false);
1330            }
1331        }
1332        final Iterator<XmppAxolotlSession> iterator = postponedSessions.iterator();
1333        while (iterator.hasNext()) {
1334            final XmppAxolotlSession session = iterator.next();
1335            if (trustedOrPreviouslyResponded(session)) {
1336                completeSession(session);
1337            }
1338            iterator.remove();
1339        }
1340        final Iterator<SignalProtocolAddress> postponedHealingAttemptsIterator = postponedHealing.iterator();
1341        while (postponedHealingAttemptsIterator.hasNext()) {
1342            notifyRequiresHealing(postponedHealingAttemptsIterator.next());
1343            postponedHealingAttemptsIterator.remove();
1344        }
1345    }
1346
1347    private boolean trustedOrPreviouslyResponded(XmppAxolotlSession session) {
1348        try {
1349            return trustedOrPreviouslyResponded(Jid.of(session.getRemoteAddress().getName()));
1350        } catch (IllegalArgumentException e) {
1351            return false;
1352        }
1353    }
1354
1355    public boolean trustedOrPreviouslyResponded(Jid jid) {
1356        final Contact contact = account.getRoster().getContact(jid);
1357        if (contact.showInRoster() || contact.isSelf()) {
1358            return true;
1359        }
1360        final Conversation conversation = mXmppConnectionService.find(account, jid);
1361        return conversation != null && conversation.sentMessagesCount() > 0;
1362    }
1363
1364    private void completeSession(XmppAxolotlSession session) {
1365        final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().asBareJid(), getOwnDeviceId(), true);
1366        axolotlMessage.addDevice(session, true);
1367        try {
1368            final Jid jid = Jid.of(session.getRemoteAddress().getName());
1369            MessagePacket packet = mXmppConnectionService.getMessageGenerator().generateKeyTransportMessage(jid, axolotlMessage);
1370            mXmppConnectionService.sendMessagePacket(account, packet);
1371        } catch (IllegalArgumentException e) {
1372            throw new Error("Remote addresses are created from jid and should convert back to jid", e);
1373        }
1374    }
1375
1376    public XmppAxolotlMessage.XmppAxolotlKeyTransportMessage processReceivingKeyTransportMessage(XmppAxolotlMessage message, final boolean postponePreKeyMessageHandling) {
1377        final XmppAxolotlMessage.XmppAxolotlKeyTransportMessage keyTransportMessage;
1378        final XmppAxolotlSession session = getReceivingSession(message);
1379        try {
1380            keyTransportMessage = message.getParameters(session, getOwnDeviceId());
1381            Integer preKeyId = session.getPreKeyIdAndReset();
1382            if (preKeyId != null) {
1383                postPreKeyMessageHandling(session, postponePreKeyMessageHandling);
1384            }
1385        } catch (CryptoFailedException e) {
1386            Log.d(Config.LOGTAG, "could not decrypt keyTransport message " + e.getMessage());
1387            return null;
1388        }
1389
1390        if (session.isFresh() && keyTransportMessage != null) {
1391            putFreshSession(session);
1392        }
1393
1394        return keyTransportMessage;
1395    }
1396
1397    private void putFreshSession(XmppAxolotlSession session) {
1398        sessions.put(session);
1399        if (Config.X509_VERIFICATION) {
1400            if (session.getIdentityKey() != null) {
1401                verifySessionWithPEP(session);
1402            } else {
1403                Log.e(Config.LOGTAG, account.getJid().asBareJid() + ": identity key was empty after reloading for x509 verification");
1404            }
1405        }
1406    }
1407
1408    public enum FetchStatus {
1409        PENDING,
1410        SUCCESS,
1411        SUCCESS_VERIFIED,
1412        TIMEOUT,
1413        SUCCESS_TRUSTED,
1414        ERROR
1415    }
1416
1417    public interface OnDeviceIdsFetched {
1418        void fetched(Jid jid, Set<Integer> deviceIds);
1419    }
1420
1421
1422    public interface OnMultipleDeviceIdFetched {
1423        void fetched();
1424    }
1425
1426    interface OnSessionBuildFromPep {
1427        void onSessionBuildSuccessful();
1428
1429        void onSessionBuildFailed();
1430    }
1431
1432    private static class AxolotlAddressMap<T> {
1433        protected final Object MAP_LOCK = new Object();
1434        protected Map<String, Map<Integer, T>> map;
1435
1436        public AxolotlAddressMap() {
1437            this.map = new HashMap<>();
1438        }
1439
1440        public void put(SignalProtocolAddress address, T value) {
1441            synchronized (MAP_LOCK) {
1442                Map<Integer, T> devices = map.get(address.getName());
1443                if (devices == null) {
1444                    devices = new HashMap<>();
1445                    map.put(address.getName(), devices);
1446                }
1447                devices.put(address.getDeviceId(), value);
1448            }
1449        }
1450
1451        public T get(SignalProtocolAddress address) {
1452            synchronized (MAP_LOCK) {
1453                Map<Integer, T> devices = map.get(address.getName());
1454                if (devices == null) {
1455                    return null;
1456                }
1457                return devices.get(address.getDeviceId());
1458            }
1459        }
1460
1461        public Map<Integer, T> getAll(String name) {
1462            synchronized (MAP_LOCK) {
1463                Map<Integer, T> devices = map.get(name);
1464                if (devices == null) {
1465                    return new HashMap<>();
1466                }
1467                return devices;
1468            }
1469        }
1470
1471        public boolean hasAny(SignalProtocolAddress address) {
1472            synchronized (MAP_LOCK) {
1473                Map<Integer, T> devices = map.get(address.getName());
1474                return devices != null && !devices.isEmpty();
1475            }
1476        }
1477
1478        public void clear() {
1479            map.clear();
1480        }
1481
1482    }
1483
1484    private static class SessionMap extends AxolotlAddressMap<XmppAxolotlSession> {
1485        private final XmppConnectionService xmppConnectionService;
1486        private final Account account;
1487
1488        public SessionMap(XmppConnectionService service, SQLiteAxolotlStore store, Account account) {
1489            super();
1490            this.xmppConnectionService = service;
1491            this.account = account;
1492            this.fillMap(store);
1493        }
1494
1495        public Set<Jid> findCounterpartsForSourceId(Integer sid) {
1496            Set<Jid> candidates = new HashSet<>();
1497            synchronized (MAP_LOCK) {
1498                for (Map.Entry<String, Map<Integer, XmppAxolotlSession>> entry : map.entrySet()) {
1499                    String key = entry.getKey();
1500                    if (entry.getValue().containsKey(sid)) {
1501                        candidates.add(Jid.of(key));
1502                    }
1503                }
1504            }
1505            return candidates;
1506        }
1507
1508        private void putDevicesForJid(String bareJid, List<Integer> deviceIds, SQLiteAxolotlStore store) {
1509            for (Integer deviceId : deviceIds) {
1510                SignalProtocolAddress axolotlAddress = new SignalProtocolAddress(bareJid, deviceId);
1511                IdentityKey identityKey = store.loadSession(axolotlAddress).getSessionState().getRemoteIdentityKey();
1512                if (Config.X509_VERIFICATION) {
1513                    X509Certificate certificate = store.getFingerprintCertificate(CryptoHelper.bytesToHex(identityKey.getPublicKey().serialize()));
1514                    if (certificate != null) {
1515                        Bundle information = CryptoHelper.extractCertificateInformation(certificate);
1516                        try {
1517                            final String cn = information.getString("subject_cn");
1518                            final Jid jid = Jid.of(bareJid);
1519                            Log.d(Config.LOGTAG, "setting common name for " + jid + " to " + cn);
1520                            account.getRoster().getContact(jid).setCommonName(cn);
1521                        } catch (final IllegalArgumentException ignored) {
1522                            //ignored
1523                        }
1524                    }
1525                }
1526                this.put(axolotlAddress, new XmppAxolotlSession(account, store, axolotlAddress, identityKey));
1527            }
1528        }
1529
1530        private void fillMap(SQLiteAxolotlStore store) {
1531            List<Integer> deviceIds = store.getSubDeviceSessions(account.getJid().asBareJid().toString());
1532            putDevicesForJid(account.getJid().asBareJid().toString(), deviceIds, store);
1533            for (String address : store.getKnownAddresses()) {
1534                deviceIds = store.getSubDeviceSessions(address);
1535                putDevicesForJid(address, deviceIds, store);
1536            }
1537        }
1538
1539        @Override
1540        public void put(SignalProtocolAddress address, XmppAxolotlSession value) {
1541            super.put(address, value);
1542            value.setNotFresh();
1543        }
1544
1545        public void put(XmppAxolotlSession session) {
1546            this.put(session.getRemoteAddress(), session);
1547        }
1548    }
1549
1550    private static class FetchStatusMap extends AxolotlAddressMap<FetchStatus> {
1551
1552        public void clearErrorFor(Jid jid) {
1553            synchronized (MAP_LOCK) {
1554                Map<Integer, FetchStatus> devices = this.map.get(jid.asBareJid().toString());
1555                if (devices == null) {
1556                    return;
1557                }
1558                for (Map.Entry<Integer, FetchStatus> entry : devices.entrySet()) {
1559                    if (entry.getValue() == FetchStatus.ERROR) {
1560                        Log.d(Config.LOGTAG, "resetting error for " + jid.asBareJid() + "(" + entry.getKey() + ")");
1561                        entry.setValue(FetchStatus.TIMEOUT);
1562                    }
1563                }
1564            }
1565        }
1566    }
1567}