#include "pEp_internal.h"

#include "pgp_netpgp.h"

#include <limits.h>

#include "wrappers.h"

#include <netpgp.h>

#include <netpgp/config.h>

#include <netpgp/memory.h>

#include <netpgp/crypto.h>

#include <netpgp/netpgpsdk.h>

#include <netpgp/validate.h>

#include <netpgp/readerwriter.h>

#include <curl/curl.h>

#include <pthread.h>

#include <regex.h>

static netpgp_t netpgp;

static pthread_mutex_t netpgp_mutex;

static PEP_STATUS init_netpgp()

{

    PEP_STATUS status = PEP_STATUS_OK;

    const char *home = NULL;

    if(pthread_mutex_init(&netpgp_mutex, NULL)){

        return PEP_OUT_OF_MEMORY;

    }

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    if (strcmp(setlocale(LC_ALL, NULL), "C") == 0)

        setlocale(LC_ALL, "");

    memset(&netpgp, 0x0, sizeof(netpgp_t));

    // netpgp_setvar(&netpgp, "max mem alloc", "4194304");

    netpgp_setvar(&netpgp, "need seckey", "1");

    // netpgp_setvar(&netpgp, "need userid", "1");

    // NetPGP shares home with GPG

    home = gpg_home();

    if(home){

        netpgp_set_homedir(&netpgp,(char*)home, NULL, 0);

    }else{

        status = PEP_INIT_NO_GPG_HOME;

        goto unlock_netpgp;

    }

    // pair with gpg's cert-digest-algo

    netpgp_setvar(&netpgp, "hash", "SHA256");

    // subset of gpg's personal-cipher-preferences

    // here only one cipher can be selected

    netpgp_setvar(&netpgp, "cipher", "CAST5");

    if (!netpgp_init(&netpgp)) {

        status = PEP_INIT_NETPGP_INIT_FAILED;

        goto unlock_netpgp;

    }

    // netpgp_set_debug("packet-parse.c");

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return status;

}

static void release_netpgp()

{

    if(pthread_mutex_lock(&netpgp_mutex)){

        return;

    }

    netpgp_end(&netpgp);

    memset(&netpgp, 0x0, sizeof(netpgp_t));

    pthread_mutex_destroy(&netpgp_mutex);

    return;

}

static PEP_STATUS init_curl(

    CURL **curl,

    pthread_mutex_t *curl_mutex,

    bool in_first)

{

    PEP_STATUS status = PEP_STATUS_OK;

    struct curl_slist *headers=NULL;

    if(pthread_mutex_init(curl_mutex, NULL)){

        return PEP_OUT_OF_MEMORY;

    }

    if(pthread_mutex_lock(curl_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    if(in_first){

        curl_global_init(CURL_GLOBAL_DEFAULT);

    }

    if ((*curl = curl_easy_init()) == NULL) {

        return PEP_OUT_OF_MEMORY;

    }

    curl_easy_setopt(*curl, CURLOPT_FOLLOWLOCATION, 1L);

    curl_easy_setopt(*curl, CURLOPT_MAXREDIRS, 3L);

    headers=curl_slist_append(headers,"Pragma: no-cache");

    if(headers)

        headers=curl_slist_append(headers,"Cache-Control: no-cache");

    if(!headers)

    {

        status = PEP_OUT_OF_MEMORY;

        goto unlock_curl;

    }

    curl_easy_setopt(curl,CURLOPT_HTTPHEADER,headers);

    curl_slist_free_all(headers);

    // TODO curl_easy_setopt(curl,CURLOPT_PROXY,proxy);

unlock_curl:

    pthread_mutex_unlock(curl_mutex);

    return status;

}

static void release_curl(

    CURL **curl,

    pthread_mutex_t *curl_mutex, 

    bool out_last)

{

    if(pthread_mutex_lock(curl_mutex)){

        return;

    }

    if(*curl)

        curl_easy_cleanup(*curl);

    *curl = NULL;

    if(out_last){

        curl_global_cleanup();

    }

    pthread_mutex_destroy(curl_mutex);

    return;

}

PEP_STATUS pgp_init(PEP_SESSION session, bool in_first)

{

    PEP_STATUS status = PEP_STATUS_OK;

    assert(session);

    if(!session) return PEP_UNKNOWN_ERROR;

    if (in_first) {

        if((status = init_netpgp()) != PEP_STATUS_OK)

        return status;

    }

    if((status = init_curl(

                    &session->ctx.curl,

                    &session->ctx.curl_mutex,

                    in_first) != PEP_STATUS_OK)){

        if(in_first) release_netpgp();

        return status;

    }

    return PEP_STATUS_OK;

}

void pgp_release(PEP_SESSION session, bool out_last)

{

    assert(session);

    if(!session) return;

    if (out_last){

        release_netpgp();

    }

    release_curl(&session->ctx.curl, &session->ctx.curl_mutex, out_last);

}

// return 1 if the file contains ascii-armoured text 

// buf MUST be \0 terminated to be checked for armour

static unsigned

_armoured(const char *buf, size_t size, const char *pattern)

{

    unsigned armoured = 0;

    if(buf[size]=='\0'){

        regex_t r;

        regcomp(&r, pattern, REG_EXTENDED|REG_NEWLINE|REG_NOSUB);

        if (regexec(&r, buf, 0, NULL, 0) == 0) {

            armoured = 1;

        }

        regfree(&r);

    }

    return armoured;

}

/* return key ID's hexdump as a string */

static void id_to_str(const uint8_t *keyid, char *str)

{

    int i;

    static const char *hexes = "0123456789abcdef";

    for (i = 0; i < PGP_KEY_ID_SIZE ; i++) {

        str[i * 2] = hexes[(unsigned)(keyid[i] & 0xf0) >> 4];

        str[(i * 2) + 1] = hexes[keyid[i] & 0xf];

    }

    str[PGP_KEY_ID_SIZE * 2] = 0x0;

}

/* return key ID's hexdump as a string */

static unsigned str_to_id(uint8_t *keyid, const char *str)

{

    int i, n;

    static const char *hexes = "0123456789abcdef";

    for (i = 0; i < PGP_KEY_ID_SIZE ; i++) {

        uint8_t b = 0;

        for (n = 0; n < 2; n++) {

            char c = str[i * 2 + n];

            uint8_t q;

            if(c >= '0' &&  c <= '9'){

                q = (c - '0');

            }else if(c >= 'a' &&  c <= 'z'){

                q = (c - 'a' + 0xA);

            }else if(c >= 'A' &&  c <= 'Z'){

                q = (c - 'A' + 0xA);

            }else{

                return 0;

            }

            b |= q << (4 * (1 - n));

        }

        keyid[i] = b;

    }

    return 1;

}

// Iterate through netpgp' reported valid signatures 

// fill a list of valid figerprints

// returns PEP_STATUS_OK if all sig reported valid

// error status otherwise.

static PEP_STATUS _validation_results(

        netpgp_t *netpgp,

        pgp_validation_t *vresult,

        stringlist_t **_keylist

    )

{

    time_t    now;

    time_t    t;

    char    buf[128];

    now = time(NULL);

    if (now < vresult->birthtime) {

        // signature is not valid yet

        return PEP_UNENCRYPTED;

    }

    if (vresult->duration != 0 && now > vresult->birthtime + vresult->duration) {

        // signature has expired

        t = vresult->duration + vresult->birthtime;

        return PEP_UNENCRYPTED;

    }

    if (vresult->validc && vresult->valid_sigs &&

        !vresult->invalidc && !vresult->unknownc ) {

        unsigned    n;

        stringlist_t *k;

        // caller responsible to free

        *_keylist = new_stringlist(NULL);

        assert(*_keylist);

        if (*_keylist == NULL) {

            return PEP_OUT_OF_MEMORY;

        }

        k = *_keylist;

        for (n = 0; n < vresult->validc; ++n) {

            char id[MAX_ID_LENGTH + 1];

            const uint8_t *keyid = vresult->valid_sigs[n].signer_id;

            id_to_str(keyid, id);

            k = stringlist_add(k, id);

            if(!k){

                free_stringlist(*_keylist);

                return PEP_OUT_OF_MEMORY;

            }

        }

        return PEP_STATUS_OK;

    }

    if (vresult->validc + vresult->invalidc + vresult->unknownc == 0) {

        // No signatures found - is this memory signed?

        return PEP_VERIFY_NO_KEY; 

    } 

    if (vresult->invalidc) {

        // some invalid signatures

        return PEP_DECRYPT_SIGNATURE_DOES_NOT_MATCH;

    }

    // only unknown sigs

    return PEP_DECRYPT_WRONG_FORMAT;

}

#define ARMOR_HEAD    "^-----BEGIN PGP MESSAGE-----\\s*$"

PEP_STATUS pgp_decrypt_and_verify(

    PEP_SESSION session, const char *ctext, size_t csize,

    char **ptext, size_t *psize, stringlist_t **keylist

    )

{

    pgp_memory_t *mem;

    pgp_memory_t *cat;

    pgp_validation_t *vresult;

    char *_ptext = NULL;

    size_t _psize = 0;

    int ret;

    PEP_STATUS result;

    stringlist_t *_keylist = NULL;

    int i_key = 0;

    assert(session);

    assert(ctext);

    assert(csize);

    assert(ptext);

    assert(psize);

    assert(keylist);

    if(!session || !ctext || !csize || !ptext || !psize || !keylist) 

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    *ptext = NULL;

    *psize = 0;

    *keylist = NULL;

    vresult = malloc(sizeof(pgp_validation_t));

    memset(vresult, 0x0, sizeof(pgp_validation_t));

    mem = pgp_decrypt_and_validate_buf(netpgp.io, vresult, ctext, csize,

                netpgp.secring, netpgp.pubring,

                _armoured(ctext, csize, ARMOR_HEAD),

                0 /* sshkeys */,

                NULL, -1, NULL  /* pass fp,attempts,cb */);

    if (mem == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    _psize = pgp_mem_len(mem);

    if (_psize){

        if ((_ptext = malloc(_psize + 1)) == NULL) {

            result = PEP_OUT_OF_MEMORY;

            goto free_pgp;

        }

        memcpy(_ptext, pgp_mem_data(mem), _psize);

        _ptext[_psize] = '\0'; // safeguard for naive users

        result = PEP_DECRYPTED;

    }else{

        result = PEP_DECRYPT_NO_KEY;

        goto free_pgp;

    }

    if (result == PEP_DECRYPTED) {

        result = _validation_results(&netpgp, vresult, &_keylist);

        if (result != PEP_STATUS_OK) {

            goto free_ptext;

        }

        result = PEP_DECRYPTED_AND_VERIFIED;

    }

    if (result == PEP_DECRYPTED_AND_VERIFIED

        || result == PEP_DECRYPTED) {

        *ptext = _ptext;

        *psize = _psize;

        (*ptext)[*psize] = 0; // safeguard for naive users

        if (result == PEP_DECRYPTED_AND_VERIFIED) {

            *keylist = _keylist;

        }

        /* _ptext and _keylist ownership transfer, don't free */

        goto free_pgp;

    }

free_keylist:

    free_stringlist(_keylist);

free_ptext:

    free(_ptext);

free_pgp:

    pgp_memory_free(mem);

    pgp_validate_result_free(vresult);

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

#define ARMOR_SIG_HEAD    "^-----BEGIN PGP (SIGNATURE|SIGNED MESSAGE)-----\\s*$"

PEP_STATUS pgp_verify_text(

    PEP_SESSION session, const char *text, size_t size,

    const char *signature, size_t sig_size, stringlist_t **keylist

    )

{

    pgp_memory_t *signedmem;

    pgp_memory_t *sig;

    pgp_validation_t *vresult;

    PEP_STATUS result;

    stringlist_t *_keylist;

    assert(session);

    assert(text);

    assert(size);

    assert(signature);

    assert(sig_size);

    assert(keylist);

    if(!session || !text || !size || !signature || !sig_size || !keylist) 

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    *keylist = NULL;

    vresult = malloc(sizeof(pgp_validation_t));

    if (vresult == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    memset(vresult, 0x0, sizeof(pgp_validation_t));

    signedmem = pgp_memory_new();

    if (signedmem == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    pgp_memory_add(signedmem, (const uint8_t*)text, size);

    sig = pgp_memory_new();

    if (sig == NULL) {

        pgp_memory_free(signedmem);

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    pgp_memory_add(sig, (const uint8_t*)signature, sig_size);

    pgp_validate_mem_detached(netpgp.io, vresult, sig,

                NULL,/* output */

                _armoured(signature, sig_size, ARMOR_SIG_HEAD),

                netpgp.pubring,

                signedmem);

    result = _validation_results(&netpgp, vresult, &_keylist);

    if (result != PEP_STATUS_OK) {

        goto free_pgp;

    }else{

        result = PEP_VERIFIED;

    }

    if (result == PEP_VERIFIED) {

        /* TODO : check trust level */

        result = PEP_VERIFIED_AND_TRUSTED;

    }

    if (result == PEP_VERIFIED || result == PEP_VERIFIED_AND_TRUSTED) {

        *keylist = _keylist;

        /* _keylist ownership transfer, don't free */

        goto free_pgp;

    }

free_keylist:

    free_stringlist(_keylist);

free_pgp:

    // free done by pgp_validate_mem_detached

    // pgp_memory_free(sig);

    // pgp_memory_free(signedmem);

    pgp_validate_result_free(vresult);

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

PEP_STATUS pgp_encrypt_and_sign(

    PEP_SESSION session, const stringlist_t *keylist, const char *ptext,

    size_t psize, char **ctext, size_t *csize

    )

{

    const pgp_key_t *signer = NULL;

    const pgp_seckey_t *seckey = NULL;

    pgp_memory_t *signedmem;

    pgp_memory_t *cmem;

    const char *hashalg;

    pgp_keyring_t *rcpts;

    PEP_STATUS result;

    const stringlist_t *_keylist;

    assert(session);

    assert(keylist);

    assert(ptext);

    assert(psize);

    assert(ctext);

    assert(csize);

    if(!session || !ptext || !psize || !ctext || !csize || !keylist) 

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    *ctext = NULL;

    *csize = 0;

    if ((rcpts = calloc(1, sizeof(*rcpts))) == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto free_signedmem;

    }

    for (_keylist = keylist; _keylist != NULL; _keylist = _keylist->next) {

        assert(_keylist->value);

        const pgp_key_t *key;

        uint8_t keyid[PGP_KEY_ID_SIZE];

        unsigned from = 0;

        if(!str_to_id(keyid, _keylist->value))

        {

            result = PEP_ILLEGAL_VALUE;

            goto free_rcpts;

        }

        key = pgp_getkeybyid(netpgp.io, netpgp.pubring, 

                 keyid, &from, NULL, NULL, 

                 1, 0); /* reject revoked, accept expired */

        if(key == NULL){

            result = PEP_KEY_NOT_FOUND;

            goto free_rcpts;

        }

        /* Signer is the first key in the list */

        if(signer == NULL){

            from = 0;

            signer = pgp_getkeybyid(netpgp.io, netpgp.secring, 

                     keyid, &from, NULL, NULL, 

                     0, 0); /* accept any */

            if(signer == NULL){

                result = PEP_KEY_NOT_FOUND;

                goto free_rcpts;

            }

        }

        printf("ZZ %s\n", _keylist->value);

        // add key to recipients/signers

        pgp_keyring_add(rcpts, key);

        if(rcpts->keys == NULL){

            result = PEP_OUT_OF_MEMORY;

            goto free_signedmem;

        }

           printf("ZZ %s\n", _keylist->value);

    }

    /* Empty keylist ?*/

    if(rcpts->keyc == 0){

        result = PEP_ILLEGAL_VALUE;

        goto free_signedmem;

    }

    seckey = pgp_key_get_certkey(signer);

    /* No signig key. Revoked ? */

    if(seckey == NULL){

        result = PEP_GET_KEY_FAILED;

        goto free_signedmem;

    }

    hashalg = netpgp_getvar(&netpgp, "hash");

    // Sign data

    signedmem = pgp_sign_buf(netpgp.io, ptext, psize, seckey,

                time(NULL), /* birthtime */

                0 /* duration */,

                hashalg, 

                0 /* armored */,

                0 /* cleartext */);

    if (!signedmem) {

        result = PEP_UNENCRYPTED;

        goto unlock_netpgp;

    }

    // Encrypt signed data

    cmem = pgp_encrypt_buf(netpgp.io, pgp_mem_data(signedmem),

            pgp_mem_len(signedmem), rcpts, 1 /* armored */,

            netpgp_getvar(&netpgp, "cipher"), 

            1 /* takes raw OpenPGP message */);

    if (cmem == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto free_signedmem;

    }else{

        char *_buffer = NULL;

        size_t length = pgp_mem_len(cmem);

        // Allocate transferable buffer

        _buffer = malloc(length + 1);

        assert(_buffer);

        if (_buffer == NULL) {

            result = PEP_OUT_OF_MEMORY;

            goto free_cmem;

        }

        memcpy(_buffer, pgp_mem_data(cmem), length);

        *ctext = _buffer;

        *csize = length;

        (*ctext)[*csize] = 0; // safeguard for naive users

        result = PEP_STATUS_OK;

    }

free_cmem :

    pgp_memory_free(cmem);

free_signedmem :

    pgp_memory_free(signedmem);

free_rcpts :

    pgp_keyring_free(rcpts);

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

/* return the hexdump as a string */

static unsigned

fpr_to_str (char **str, const uint8_t *fpr, size_t length)

{

    unsigned i;

    int	n;

    /* 5 char per byte (hexes + space) tuple -1 space at the end + null */

    *str = malloc((length / 2) * 5 - 1 + 1);

    if(*str == NULL)

        return 0;

    for (n = 0, i = 0 ; i < length - 2; i += 2) {

    	n += snprintf(&((*str)[n]), 6, "%02x%02x ", fpr[i], fpr[i+1]);

    }

    snprintf(&((*str)[n]), 5, "%02x%02x", fpr[i], fpr[i+1]);

    return 1;

}

static unsigned

str_to_fpr (const char *str, uint8_t *fpr, size_t *length)

{

    unsigned i,j;

    *length = 0;

    while(*str && *length < PGP_FINGERPRINT_SIZE){

        while (*str == ' ') str++;

        for (j = 0; j < 2; j++) {

            uint8_t *byte = &fpr[*length];

            *byte = 0;

            for (i = 0; i < 2; i++) {

                if (i > 0)

                    *byte = *byte << 4;

                if (*str >= 'a' && *str <= 'f')

                    *byte += 10 + *str - 'a';

                else if (*str >= 'A' && *str <= 'F')

                    *byte += 10 + *str - 'A';

                else if (*str >= '0' && *str <= '9')

                    *byte += *str - '0';

                else 

                    return 0;

                str++;

            }

            (*length)++;

        }

    }

    return 1;

}

PEP_STATUS pgp_generate_keypair(

    PEP_SESSION session, pEp_identity *identity

    )

{

    pgp_key_t	newseckey;

    pgp_key_t	newpubkey;

    PEP_STATUS result;

    char newid[1024];

    const char *hashalg;

    const char *cipher;

    char *fprstr = NULL;

    assert(session);

    assert(identity);

    assert(identity->address);

    assert(identity->fpr == NULL);

    assert(identity->username);

    if(!session || !identity || 

       !identity->address || identity->fpr || !identity->username)

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    if(snprintf(newid, sizeof(newid),

        "%s <%s>", identity->username, identity->address) >= sizeof(newid)){

        result =  PEP_BUFFER_TOO_SMALL;

        goto unlock_netpgp;

    }

    hashalg = netpgp_getvar(&netpgp, "hash");

    cipher = netpgp_getvar(&netpgp, "cipher");

    bzero(&newseckey, sizeof(newseckey));

    bzero(&newpubkey, sizeof(newpubkey));

    // TODO "Expire-Date: 1y\n";

    // Generate the key

    if (!pgp_rsa_generate_keypair(&newseckey, 4096, 65537UL, hashalg, cipher,

                                  (const uint8_t *) "", (const size_t) 0) ||

        !pgp_add_selfsigned_userid(&newseckey, (uint8_t *)newid)) {

        result = PEP_CANNOT_CREATE_KEY;

        goto free_seckey;

    }

    /* duplicate public part of generated secret key */

    newpubkey.type = PGP_PTAG_CT_PUBLIC_KEY;

    pgp_pubkey_dup(&newpubkey.key.pubkey, &newseckey.key.seckey.pubkey);

    pgp_update_userid(&newpubkey,

                      newseckey.uids[0], 

                      &newseckey.uidsigs[0].packet, 

                      &newseckey.uidsigs[0].siginfo);

    fpr_to_str(&fprstr,

               newseckey.pubkeyfpr.fingerprint,

               newseckey.pubkeyfpr.length);

    if (fprstr == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto free_pubkey;

    } 

    // Append key to netpgp's rings (key ownership transfered)

    if (!pgp_keyring_add(netpgp.secring, &newseckey)){

        result = PEP_OUT_OF_MEMORY;

        goto free_pubkey;

    } else if (!pgp_keyring_add(netpgp.pubring, &newpubkey)){

        result = PEP_OUT_OF_MEMORY;

        goto pop_secring;

    }

    // save rings 

    if (netpgp_save_pubring(&netpgp) && netpgp_save_secring(&netpgp))

    {

        /* keys saved, now send ID back to */

        identity->fpr = fprstr;

        result = PEP_STATUS_OK;

        /* free nothing, everything transfered */

        goto unlock_netpgp;

    } else {

        /* XXX in case only pubring save succeed

         * pubring file is left as-is, but backup restore

         * could be attempted if such corner case matters */

        result = PEP_UNKNOWN_ERROR;

    }

pop_pubring:

    ((pgp_keyring_t *)netpgp.pubring)->keyc--;

pop_secring:

    ((pgp_keyring_t *)netpgp.secring)->keyc--;

free_fpr:

    free(fprstr);

free_pubkey:

    pgp_key_free(&newpubkey);

free_seckey:

    pgp_key_free(&newseckey);

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

PEP_STATUS pgp_delete_keypair(PEP_SESSION session, const char *fprstr)

{

    uint8_t fpr[PGP_FINGERPRINT_SIZE];

    size_t length;

    PEP_STATUS result;

    assert(session);

    assert(fpr);

    if (!session || !fpr)

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    if (str_to_fpr(fprstr, fpr, &length)) {

        unsigned insec = pgp_deletekeybyfpr(netpgp.io,

                                (pgp_keyring_t *)netpgp.secring, 

                                (const uint8_t *)fpr, length);

        unsigned inpub = pgp_deletekeybyfpr(netpgp.io,

                                (pgp_keyring_t *)netpgp.pubring, 

                                (const uint8_t *)fpr, length);

        if(!insec && !inpub){

            result = PEP_KEY_NOT_FOUND;

            goto unlock_netpgp;

        } else {

            result = PEP_STATUS_OK;

        }

    }else{

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    // save rings (key ownership transfered)

    if (netpgp_save_pubring(&netpgp) && 

        netpgp_save_secring(&netpgp))

    {

        result = PEP_STATUS_OK;

    }else{

        result = PEP_UNKNOWN_ERROR;

    }

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

#define ARMOR_KEY_HEAD    "^-----BEGIN PGP (PUBLIC|PRIVATE) KEY BLOCK-----\\s*$"

PEP_STATUS pgp_import_keydata(

        PEP_SESSION session,

        const char *key_data, 

        size_t size

    )

{

    pgp_memory_t *mem;

    unsigned i = 0;

    PEP_STATUS result = PEP_STATUS_OK;

    assert(session);

    assert(key_data);

    if(!session || !key_data) 

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    mem = pgp_memory_new();

    if (mem == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    pgp_memory_add(mem, (const uint8_t*)key_data, size);

    if (pgp_keyring_read_from_mem(netpgp.io, netpgp.pubring, netpgp.secring, 

                                  _armoured(key_data, size, ARMOR_KEY_HEAD),

                                  mem) == 0){

        result = PEP_ILLEGAL_VALUE;

    }    

    pgp_memory_free(mem);

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

PEP_STATUS pgp_export_keydata(

    PEP_SESSION session, const char *fprstr, char **key_data, size_t *size

    )

{

    pgp_key_t *key;

	pgp_output_t *output;

    pgp_memory_t *mem;

    uint8_t fpr[PGP_FINGERPRINT_SIZE];

    size_t fprlen;

    PEP_STATUS result;

    char *buffer;

    size_t buflen;

    assert(session);

    assert(fprstr);

    assert(key_data);

    assert(size);

    if (!session || !fprstr || !key_data || !size)

        return PEP_UNKNOWN_ERROR;

    if(pthread_mutex_lock(&netpgp_mutex)){

        return PEP_UNKNOWN_ERROR;

    }

    if (str_to_fpr(fprstr, fpr, &fprlen)) {

        if ((key = (pgp_key_t *)pgp_getkeybyfpr(netpgp.io, netpgp.pubring, 

                                                fpr, fprlen,

                                                NULL)) == NULL) {

            result = PEP_KEY_NOT_FOUND;

            goto unlock_netpgp;

        }

    }else{

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

	pgp_setup_memory_write(&output, &mem, 128);

    if (mem == NULL || output == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto unlock_netpgp;

    }

    if (!pgp_write_xfer_key(output, key, 1)) {

        result = PEP_UNKNOWN_ERROR;

        goto free_mem;

    }

    buffer = NULL;

    buflen = pgp_mem_len(mem);

    // Allocate transferable buffer

    buffer = malloc(buflen + 1);

    assert(buffer);

    if (buffer == NULL) {

        result = PEP_OUT_OF_MEMORY;

        goto free_mem;

    }

    memcpy(buffer, pgp_mem_data(mem), buflen);

    *key_data = buffer;

    *size = buflen;

    (*key_data)[*size] = 0; // safeguard for naive users

    result = PEP_STATUS_OK;

free_mem :

	pgp_teardown_memory_write(output, mem);

unlock_netpgp:

    pthread_mutex_unlock(&netpgp_mutex);

    return result;

}

struct HKP_answer {

  char *memory;

  size_t size;

};

static size_t

HKPAnswerWriter(void *contents, size_t size, size_t nmemb, void *userp)

{

  size_t realsize = size * nmemb;

  struct HKP_answer *mem = (struct HKP_answer *)userp;

  mem->memory = realloc(mem->memory, mem->size + realsize + 1);

  if(mem->memory == NULL) {

    mem->size = 0;

    return 0;

  }

  memcpy(&(mem->memory[mem->size]), contents, realsize);

  mem->size += realsize;