Merge 'upstream/master'

70 files changed, 5653 insertions, 422 deletions

diff --git a/libdino/src/application.vala b/libdino/src/application.vala
index 536ca949..13bcd471 100644
--- a/libdino/src/application.vala
+++ b/libdino/src/application.vala
@@ -2,10 +2,12 @@ using Dino.Entities;
 
 namespace Dino {
 
-public string get_version() { return VERSION; }
+public extern unowned string get_version();
+
 public string get_short_version() {
-    if (!VERSION.contains("~")) return VERSION;
-    return VERSION.split("~")[0] + "+";
+    string version = get_version();
+    if (!version.contains("~")) return version;
+    return version.split("~")[0] + "+";
 }
 
 public interface Application : GLib.Application {
@@ -48,6 +50,7 @@ public interface Application : GLib.Application {
         AvatarManager.start(stream_interactor, db);
         RosterManager.start(stream_interactor, db);
         FileManager.start(stream_interactor, db);
+        FileManager2.start(stream_interactor, db);
         CallStore.start(stream_interactor, db);
         ContentItemStore.start(stream_interactor, db);
         ChatInteraction.start(stream_interactor);
@@ -133,6 +136,36 @@ public interface Application : GLib.Application {
             stream_interactor.get_module(PresenceManager.IDENTITY).request_subscription(conversation.account, conversation.counterpart);
         });
         add_action(accept_subscription_action);
+
+        SimpleAction open_file_action = new SimpleAction("file_open_externally", VariantType.INT32);
+        open_file_action.activate.connect((variant) => {
+            int file_transfer_id = variant.get_int32();
+            FileTransfer file_transfer = stream_interactor.get_module(FileTransferStorage.IDENTITY).get_file_by_id(file_transfer_id, null);
+
+            try{
+                AppInfo.launch_default_for_uri(file_transfer.get_file().get_uri(), null);
+            } catch (Error err) {
+                warning("Failed to open %s - %s", file_transfer.get_file().get_uri(), err.message);
+            }
+        });
+        add_action(open_file_action);
+
+        SimpleAction download_file_action = new SimpleAction("file_start_download", VariantType.INT32);
+        download_file_action.activate.connect((variant) => {
+            int file_transfer_id = variant.get_int32();
+            FileTransfer file_transfer = stream_interactor.get_module(FileTransferStorage.IDENTITY).get_file_by_id(file_transfer_id, null);
+
+            stream_interactor.get_module(FileManager.IDENTITY).download_file.begin(file_transfer);
+        });
+        add_action(download_file_action);
+
+        SimpleAction cancel_file_action = new SimpleAction("file_cancel_download", VariantType.INT32);
+        cancel_file_action.activate.connect((variant) => {
+            int file_transfer_id = variant.get_int32();
+            FileTransfer file_transfer = stream_interactor.get_module(FileTransferStorage.IDENTITY).get_file_by_id(file_transfer_id, null);
+            file_transfer.cancellable.cancel();
+        });
+        add_action(cancel_file_action);
     }
 
     protected void add_connection(Account account) {
diff --git a/libdino/src/crypto/cipher.vala b/libdino/src/crypto/cipher.vala
new file mode 100644
index 00000000..89282144
--- /dev/null
+++ b/libdino/src/crypto/cipher.vala
@@ -0,0 +1,19 @@
+namespace Dino.Crypto {
+
+public interface SymmetricCipher {
+    public abstract void set_key(uint8[] key) throws Error;
+    public abstract void set_iv(uint8[] iv) throws Error;
+    public abstract void reset() throws Error;
+}
+
+public interface SymmetricCipherEncryption : SymmetricCipher, Object {
+    public abstract int encrypt(uint8[] output, uint8[] input) throws Error;
+    public abstract uint8[] get_tag(size_t taglen) throws Error;
+}
+
+public interface SymmetricCipherDecryption : SymmetricCipher, Object {
+    public abstract int decrypt(uint8[] output, uint8[] input) throws Error;
+    public abstract void check_tag(uint8[] tag) throws Error;
+}
+
+}
diff --git a/libdino/src/crypto/cipher_converter.vala b/libdino/src/crypto/cipher_converter.vala
new file mode 100644
index 00000000..c2404c6d
--- /dev/null
+++ b/libdino/src/crypto/cipher_converter.vala
@@ -0,0 +1,110 @@
+using GLib;
+
+namespace Dino.Crypto {
+
+public class SymmetricCipherEncrypter : Converter, Object {
+    private SymmetricCipherEncryption cipher;
+    private size_t attached_taglen;
+
+    public SymmetricCipherEncrypter(owned SymmetricCipherEncryption cipher, size_t attached_taglen = 0) {
+        this.cipher = (owned) cipher;
+        this.attached_taglen = attached_taglen;
+    }
+
+    public void reset() {
+        try {
+            cipher.reset();
+        } catch (Crypto.Error e) {
+            warning(@"$(e.domain) error while resetting cipher: $(e.message)");
+        }
+    }
+
+    public uint8[] get_tag(size_t taglen) throws Error {
+        return ((SymmetricCipherEncryption)cipher).get_tag(taglen);
+    }
+
+    public ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError {
+        if (inbuf.length > outbuf.length) {
+            throw new IOError.NO_SPACE("CipherConverter needs at least the size of input as output space");
+        }
+        if ((flags & ConverterFlags.INPUT_AT_END) != 0 && inbuf.length + attached_taglen > outbuf.length) {
+            throw new IOError.NO_SPACE("CipherConverter needs additional output space to attach tag");
+        }
+        try {
+            if (inbuf.length > 0) {
+                ((SymmetricCipherEncryption)cipher).encrypt(outbuf, inbuf);
+            }
+            bytes_read = inbuf.length;
+            bytes_written = inbuf.length;
+            if ((flags & ConverterFlags.INPUT_AT_END) != 0) {
+                if (attached_taglen > 0) {
+                    Memory.copy((uint8*)outbuf + inbuf.length, get_tag(attached_taglen), attached_taglen);
+                    bytes_written = inbuf.length + attached_taglen;
+                }
+                return ConverterResult.FINISHED;
+            }
+            if ((flags & ConverterFlags.FLUSH) != 0) {
+                return ConverterResult.FLUSHED;
+            }
+            return ConverterResult.CONVERTED;
+        } catch (Crypto.Error e) {
+            throw new IOError.FAILED(@"$(e.domain) error while encrypting: $(e.message)");
+        }
+    }
+}
+
+public class SymmetricCipherDecrypter : Converter, Object {
+    private SymmetricCipherDecryption cipher;
+    private size_t attached_taglen;
+
+    public SymmetricCipherDecrypter(owned SymmetricCipherDecryption cipher, size_t attached_taglen = 0) {
+        this.cipher = (owned) cipher;
+        this.attached_taglen = attached_taglen;
+    }
+
+    public void reset() {
+        try {
+            cipher.reset();
+        } catch (Crypto.Error e) {
+            warning(@"$(e.domain) error while resetting cipher: $(e.message)");
+        }
+    }
+
+    public void check_tag(uint8[] tag) throws Error {
+        ((SymmetricCipherDecryption)cipher).check_tag(tag);
+    }
+
+    public ConverterResult convert(uint8[] inbuf, uint8[] outbuf, ConverterFlags flags, out size_t bytes_read, out size_t bytes_written) throws IOError {
+        if (inbuf.length > outbuf.length + attached_taglen) {
+            throw new IOError.NO_SPACE("CipherConverter needs at least the size of input as output space");
+        }
+        if ((flags & ConverterFlags.INPUT_AT_END) != 0 && inbuf.length < attached_taglen) {
+            throw new IOError.PARTIAL_INPUT("CipherConverter needs additional input to read tag");
+        } else if ((flags & ConverterFlags.INPUT_AT_END) == 0 && inbuf.length < attached_taglen + 1) {
+            throw new IOError.PARTIAL_INPUT("CipherConverter needs additional input to make sure to not accidentally read tag");
+        }
+        try {
+            inbuf.length -= (int) attached_taglen;
+            if (inbuf.length > 0) {
+                ((SymmetricCipherDecryption)cipher).decrypt(outbuf, inbuf);
+            }
+            bytes_read = inbuf.length;
+            bytes_written = inbuf.length;
+            inbuf.length += (int) attached_taglen;
+            if ((flags & ConverterFlags.INPUT_AT_END) != 0) {
+                if (attached_taglen > 0) {
+                    check_tag(inbuf[(inbuf.length - attached_taglen):inbuf.length]);
+                    bytes_read = inbuf.length;
+                }
+                return ConverterResult.FINISHED;
+            }
+            if ((flags & ConverterFlags.FLUSH) != 0) {
+                return ConverterResult.FLUSHED;
+            }
+            return ConverterResult.CONVERTED;
+        } catch (Crypto.Error e) {
+            throw new IOError.FAILED(@"$(e.domain) error while decrypting: $(e.message)");
+        }
+    }
+}
+}
diff --git a/libdino/src/crypto/dtls_srtp.vala b/libdino/src/crypto/dtls_srtp.vala
new file mode 100644
index 00000000..884f1a43
--- /dev/null
+++ b/libdino/src/crypto/dtls_srtp.vala
@@ -0,0 +1,146 @@
+namespace Dino.Crypto.DtlsSrtp {
+
+public abstract class CredentialsCapsule : Object {
+    public uint8[] own_fingerprint;
+}
+
+public abstract class AbstractHandler {
+
+    public signal void send_data(uint8[] data);
+
+    public bool ready { get {
+        return srtp_session.has_encrypt && srtp_session.has_decrypt;
+    }}
+
+    public Mode mode { get; set; default = Mode.CLIENT; }
+    public uint8[] own_fingerprint { get; private set; }
+    public uint8[] peer_fingerprint { get; set; }
+    public string peer_fp_algo { get; set; }
+
+    protected CredentialsCapsule credentials;
+    protected Cond buffer_cond = Cond();
+    protected Mutex buffer_mutex = Mutex();
+    protected Gee.LinkedList<Bytes> buffer_queue = new Gee.LinkedList<Bytes>();
+
+    protected bool running = false;
+    protected bool stop = false;
+    protected bool restart = false;
+
+    protected Crypto.Srtp.Session srtp_session = new Crypto.Srtp.Session();
+
+    protected AbstractHandler.with_cert(CredentialsCapsule creds) {
+        this.credentials = creds;
+        this.own_fingerprint = creds.own_fingerprint;
+    }
+
+    public uint8[]? process_incoming_data(uint component_id, uint8[] data) throws Crypto.Error {
+        if (data[0] >= 128) {
+            if (!srtp_session.has_decrypt) {
+                debug("Received data before SRTP session is ready, dropping.");
+                return null;
+            }
+            if (component_id == 1) {
+                if (data.length >= 2 && data[1] >= 192 && data[1] < 224) {
+                    return srtp_session.decrypt_rtcp(data);
+                }
+                return srtp_session.decrypt_rtp(data);
+            }
+            if (component_id == 2) return srtp_session.decrypt_rtcp(data);
+        }
+        if (component_id == 1 && data.length >= 1 && (data[0] >= 20 && data[0] < 64)) {
+            on_data_rec(data);
+            return null;
+        }
+        debug("Dropping unknown data from component %u", component_id);
+        return null;
+    }
+
+    public uint8[]? process_outgoing_data(uint component_id, uint8[] data) throws Crypto.Error {
+        if (srtp_session.has_encrypt) {
+            if (component_id == 1) {
+                if (data.length >= 2 && data[1] >= 192 && data[1] < 224) {
+                    return srtp_session.encrypt_rtcp(data);
+                }
+                return srtp_session.encrypt_rtp(data);
+            }
+            if (component_id == 2) return srtp_session.encrypt_rtcp(data);
+        }
+        return null;
+    }
+
+    public void on_data_rec(owned uint8[] data) {
+        buffer_mutex.lock();
+        buffer_queue.add(new Bytes.take(data));
+        buffer_cond.signal();
+        buffer_mutex.unlock();
+    }
+
+    public void stop_dtls_connection() {
+        buffer_mutex.lock();
+        stop = true;
+        buffer_cond.signal();
+        buffer_mutex.unlock();
+    }
+
+    protected Bytes get_buffer_if_present () {
+        buffer_mutex.lock();
+        if (buffer_queue.size == 0) {
+            buffer_mutex.unlock();
+            return null;
+        }
+        Bytes res = buffer_queue.remove_at(0);
+        buffer_mutex.unlock();
+        return res;
+    }
+
+    public async Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection() {
+        MainContext context = MainContext.current_source().get_context();
+        var thread = new Thread<Xmpp.Xep.Jingle.ContentEncryption>("dtls-connection", () => {
+            // Check we can start working on the thread
+            buffer_mutex.lock();
+            if (stop) {
+                restart = true;
+                buffer_mutex.unlock();
+                return null;
+            }
+            if (running || ready) {
+                buffer_mutex.unlock();
+                return null;
+            }
+            running = true;
+            restart = false;
+            buffer_mutex.unlock();
+
+            // Actual work
+            var res = setup_dtls_connection_thread();
+
+            // Callback
+            Source source = new IdleSource();
+            source.set_callback(setup_dtls_connection.callback);
+            source.attach(context);
+            return res;
+        });
+        yield;
+        return thread.join();
+    }
+
+    protected abstract Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread();
+}
+
+private string format_fingerprint(uint8[] fingerprint) {
+    var sb = new StringBuilder();
+    for (int i = 0; i < fingerprint.length; i++) {
+        sb.append("%02X".printf(fingerprint[i]));
+        if (i < fingerprint.length - 1) {
+            sb.append(":");
+        }
+    }
+    return sb.str;
+}
+
+
+public enum Mode {
+    CLIENT, SERVER
+}
+
+}
diff --git a/libdino/src/crypto/error.vala b/libdino/src/crypto/error.vala
new file mode 100644
index 00000000..2458ae4a
--- /dev/null
+++ b/libdino/src/crypto/error.vala
@@ -0,0 +1,11 @@
+namespace Dino.Crypto {
+
+public errordomain Error {
+    ILLEGAL_ARGUMENTS,
+    GCRYPT,
+    OPENSSL,
+    AUTHENTICATION_FAILED,
+    UNKNOWN
+}
+
+}
diff --git a/libdino/src/crypto/gnu/cipher.vala b/libdino/src/crypto/gnu/cipher.vala
new file mode 100644
index 00000000..41f15837
--- /dev/null
+++ b/libdino/src/crypto/gnu/cipher.vala
@@ -0,0 +1,137 @@
+namespace Dino.Crypto {
+
+internal class SymmetricCipherGcrypt : SymmetricCipher, SymmetricCipherEncryption, SymmetricCipherDecryption, Object {
+    private GCrypt.Cipher.Cipher cipher;
+
+    private static unowned string mode_to_string(GCrypt.Cipher.Mode mode) {
+        switch (mode) {
+            case GCrypt.Cipher.Mode.ECB: return "ECB";
+            case GCrypt.Cipher.Mode.CFB: return "CFB";
+            case GCrypt.Cipher.Mode.CBC: return "CBC";
+            case GCrypt.Cipher.Mode.STREAM: return "STREAM";
+            case GCrypt.Cipher.Mode.OFB: return "OFB";
+            case GCrypt.Cipher.Mode.CTR: return "CTR";
+            case GCrypt.Cipher.Mode.AESWRAP: return "AESWRAP";
+            case GCrypt.Cipher.Mode.GCM: return "GCM";
+            case GCrypt.Cipher.Mode.POLY1305: return "POLY1305";
+            case GCrypt.Cipher.Mode.OCB: return "OCB";
+            case GCrypt.Cipher.Mode.CFB8: return "CFB8";
+            // case GCrypt.Cipher.Mode.XTS: return "XTS"; // Not supported in gcrypt < 1.8
+        }
+        return "NONE";
+    }
+
+    private static GCrypt.Cipher.Mode mode_from_string(string name) {
+        switch (name) {
+            case "ECB": return GCrypt.Cipher.Mode.ECB;
+            case "CFB": return GCrypt.Cipher.Mode.CFB;
+            case "CBC": return GCrypt.Cipher.Mode.CBC;
+            case "STREAM": return GCrypt.Cipher.Mode.STREAM;
+            case "OFB": return GCrypt.Cipher.Mode.OFB;
+            case "CTR": return GCrypt.Cipher.Mode.CTR;
+            case "AESWRAP": return GCrypt.Cipher.Mode.AESWRAP;
+            case "GCM": return GCrypt.Cipher.Mode.GCM;
+            case "POLY1305": return GCrypt.Cipher.Mode.POLY1305;
+            case "OCB": return GCrypt.Cipher.Mode.OCB;
+            case "CFB8": return GCrypt.Cipher.Mode.CFB8;
+            // case "XTS": return GCrypt.Cipher.Mode.XTS; // Not supported in gcrypt < 1.8
+        }
+        return GCrypt.Cipher.Mode.NONE;
+    }
+
+    private static string flags_to_string(GCrypt.Cipher.Flag flags) {
+        string? s = null;
+        if ((GCrypt.Cipher.Flag.CBC_MAC & flags) != 0) s = (s == null ? "" : @"$s-") + "MAC";
+        if ((GCrypt.Cipher.Flag.CBC_CTS & flags) != 0) s = (s == null ? "" : @"$s-") + "CTS";
+        if ((GCrypt.Cipher.Flag.ENABLE_SYNC & flags) != 0) s = (s == null ? "" : @"$s-") + "SYNC";
+        if ((GCrypt.Cipher.Flag.SECURE & flags) != 0) s = (s == null ? "" : @"$s-") + "SECURE";
+        return s ?? "NONE";
+    }
+
+    private static GCrypt.Cipher.Flag flag_from_string(string flag_name) {
+        if (flag_name == "SECURE") return GCrypt.Cipher.Flag.SECURE;
+        if (flag_name == "SYNC") return GCrypt.Cipher.Flag.ENABLE_SYNC;
+        if (flag_name == "CTS") return GCrypt.Cipher.Flag.CBC_CTS;
+        if (flag_name == "MAC") return GCrypt.Cipher.Flag.CBC_MAC;
+        return 0;
+    }
+
+    private static GCrypt.Cipher.Flag flags_from_string(string flag_names) {
+        GCrypt.Cipher.Flag flags = 0;
+        foreach(string flag in flag_names.split("-")) {
+            flags |= flag_from_string(flag);
+        }
+        return flags;
+    }
+
+    private static bool parse(string algo_name, out GCrypt.Cipher.Algorithm algo, out GCrypt.Cipher.Mode mode, out GCrypt.Cipher.Flag flags) {
+        algo = GCrypt.Cipher.Algorithm.NONE;
+        mode = GCrypt.Cipher.Mode.NONE;
+        flags = 0;
+        string[] algo_parts = algo_name.split("-", 3);
+
+        algo = GCrypt.Cipher.Algorithm.from_string(algo_parts[0]);
+        if (algo_parts.length >= 2) {
+            mode = mode_from_string(algo_parts[1]);
+        }
+        if (algo_parts.length == 3) {
+            flags |= flags_from_string(algo_parts[2]);
+        }
+        return to_algo_name(algo, mode, flags) == algo_name;
+    }
+
+    private static string to_algo_name(GCrypt.Cipher.Algorithm algo = GCrypt.Cipher.Algorithm.NONE, GCrypt.Cipher.Mode mode = GCrypt.Cipher.Mode.NONE, GCrypt.Cipher.Flag flags = 0) {
+        if (flags != 0) {
+            return @"$algo-$(mode_to_string(mode))-$(flags_to_string(flags))";
+        } else if (mode != GCrypt.Cipher.Mode.NONE) {
+            return @"$algo-$(mode_to_string(mode))";
+        } else {
+            return algo.to_string();
+        }
+    }
+
+    public SymmetricCipherGcrypt(string algo_name) throws Error {
+        GCrypt.Cipher.Algorithm algo;
+        GCrypt.Cipher.Mode mode;
+        GCrypt.Cipher.Flag flags;
+        if (parse(algo_name, out algo, out mode, out flags)) {
+            may_throw_gcrypt_error(GCrypt.Cipher.Cipher.open(out this.cipher, algo, mode, flags));
+        } else {
+            throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+        }
+    }
+
+    public void set_key(uint8[] key) throws Error {
+        may_throw_gcrypt_error(cipher.set_key(key));
+    }
+
+    public void set_iv(uint8[] iv) throws Error {
+        may_throw_gcrypt_error(cipher.set_iv(iv));
+    }
+
+    public void reset() throws Error {
+        may_throw_gcrypt_error(cipher.reset());
+    }
+
+    public uint8[] get_tag(size_t taglen) throws Error {
+        uint8[] tag = new uint8[taglen];
+        may_throw_gcrypt_error(cipher.get_tag(tag));
+        return tag;
+    }
+
+    public void check_tag(uint8[] tag) throws Error {
+        may_throw_gcrypt_error(cipher.check_tag(tag));
+    }
+
+    public int encrypt(uint8[] output, uint8[] input) throws Error {
+        may_throw_gcrypt_error(cipher.encrypt(output, input));
+        return input.length;
+    }
+
+    public int decrypt(uint8[] output, uint8[] input) throws Error {
+        may_throw_gcrypt_error(cipher.decrypt(output, input));
+        return input.length;
+    }
+}
+
+}
diff --git a/libdino/src/crypto/gnu/dtls_srtp.vala b/libdino/src/crypto/gnu/dtls_srtp.vala
new file mode 100644
index 00000000..f6f0a24e
--- /dev/null
+++ b/libdino/src/crypto/gnu/dtls_srtp.vala
@@ -0,0 +1,245 @@
+using GnuTLS;
+
+namespace Dino.Crypto.DtlsSrtp {
+
+public class CredentialsCapsuleGnuTLS : CredentialsCapsule {
+    internal X509.Certificate[] own_cert;
+    internal X509.PrivateKey private_key;
+}
+
+private uint8[] get_fingerprint(X509.Certificate certificate, DigestAlgorithm digest_algo) {
+    uint8[] buf = new uint8[512];
+    size_t buf_out_size = 512;
+    certificate.get_fingerprint(digest_algo, buf, ref buf_out_size);
+
+    uint8[] ret = new uint8[buf_out_size];
+    for (int i = 0; i < buf_out_size; i++) {
+        ret[i] = buf[i];
+    }
+    return ret;
+}
+
+public CredentialsCapsule generate_credentials () throws GLib.Error {
+    int err = 0;
+
+    X509.PrivateKey private_key = X509.PrivateKey.create ();
+    err = private_key.generate (PKAlgorithm.ECDSA, 256);
+    throw_if_error (err);
+
+    var start_time = new DateTime.now_local().add_days(-1);
+    var end_time = start_time.add_days (2);
+
+    X509.Certificate cert = X509.Certificate.create ();
+    cert.set_key (private_key);
+    cert.set_version (1);
+    cert.set_activation_time ((time_t) start_time.to_unix ());
+    cert.set_expiration_time ((time_t) end_time.to_unix ());
+
+    uint32 serial = 1;
+    cert.set_serial (&serial, sizeof(uint32));
+
+    cert.sign (cert, private_key);
+
+    uint8[] own_fingerprint = get_fingerprint (cert, DigestAlgorithm.SHA256);
+    X509.Certificate[] own_cert = new X509.Certificate[] { (owned)cert };
+
+    var creds = new CredentialsCapsuleGnuTLS();
+    creds.own_fingerprint = own_fingerprint;
+    creds.own_cert = (owned) own_cert;
+    creds.private_key = (owned) private_key;
+
+    return creds;
+}
+
+public class Handler : AbstractHandler {
+
+    public Handler.with_cert(CredentialsCapsule creds) {
+        base.with_cert(creds);
+    }
+
+    protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread() {
+        InitFlags server_or_client = mode == Mode.SERVER ? InitFlags.SERVER : InitFlags.CLIENT;
+        debug("Setting up DTLS connection using GnuTLS. We're %s", mode.to_string());
+
+        CertificateCredentials cert_cred = CertificateCredentials.create();
+        int err = cert_cred.set_x509_key(((CredentialsCapsuleGnuTLS)credentials).own_cert, ((CredentialsCapsuleGnuTLS)credentials).private_key);
+        throw_if_error(err);
+
+        Session? session = Session.create(server_or_client | InitFlags.DATAGRAM);
+        session.enable_heartbeat(1);
+        session.set_srtp_profile_direct("SRTP_AES128_CM_HMAC_SHA1_80");
+        session.set_credentials(GnuTLS.CredentialsType.CERTIFICATE, cert_cred);
+        session.server_set_request(CertificateRequest.REQUEST);
+        session.set_priority_from_string("NORMAL:!VERS-TLS-ALL:+VERS-DTLS-ALL:+CTYPE-CLI-X509");
+
+        session.set_transport_pointer(this);
+        session.set_pull_function(pull_function);
+        session.set_pull_timeout_function(pull_timeout_function);
+        session.set_push_function(push_function);
+        session.set_verify_function(verify_function);
+
+        DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
+        do {
+            err = session.handshake();
+
+            DateTime current_time = new DateTime.now_utc();
+            if (maximum_time.compare(current_time) < 0) {
+                warning("DTLS handshake timeouted");
+                err = ErrorCode.APPLICATION_ERROR_MIN + 1;
+                break;
+            }
+            if (stop) {
+                debug("DTLS handshake stopped");
+                err = ErrorCode.APPLICATION_ERROR_MIN + 2;
+                break;
+            }
+        } while (err < 0 && !((ErrorCode)err).is_fatal());
+
+        buffer_mutex.lock();
+        if (stop) {
+            stop = false;
+            running = false;
+            bool restart = restart;
+            buffer_mutex.unlock();
+            if (restart) {
+                debug("Restarting DTLS handshake");
+                return setup_dtls_connection_thread();
+            }
+            return null;
+        }
+        buffer_mutex.unlock();
+        if (err != ErrorCode.SUCCESS) {
+            warning("DTLS handshake failed: %s", ((ErrorCode)err).to_string());
+            return null;
+        }
+
+        uint8[] km = new uint8[150];
+        Datum? client_key, client_salt, server_key, server_salt;
+        session.get_srtp_keys(km, km.length, out client_key, out client_salt, out server_key, out server_salt);
+        if (client_key == null || client_salt == null || server_key == null || server_salt == null) {
+            warning("SRTP client/server key/salt null");
+        }
+
+        debug("Finished DTLS connection. We're %s", mode.to_string());
+        if (mode == Mode.SERVER) {
+            srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract());
+            srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract());
+        } else {
+            srtp_session.set_encryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key.extract(), client_salt.extract());
+            srtp_session.set_decryption_key(Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key.extract(), server_salt.extract());
+        }
+        return new Xmpp.Xep.Jingle.ContentEncryption(Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint);
+    }
+
+    private static ssize_t pull_function(void* transport_ptr, uint8[] buffer) {
+        Handler self = transport_ptr as Handler;
+
+        self.buffer_mutex.lock();
+        while (self.buffer_queue.size == 0) {
+            self.buffer_cond.wait(self.buffer_mutex);
+            if (self.stop) {
+                self.buffer_mutex.unlock();
+                debug("DTLS handshake pull_function stopped");
+                return -1;
+            }
+        }
+        Bytes data = self.buffer_queue.remove_at(0);
+        self.buffer_mutex.unlock();
+
+        uint8[] data_uint8 = Bytes.unref_to_data((owned) data);
+        Memory.copy(buffer, data_uint8, data_uint8.length);
+
+        // The callback should return 0 on connection termination, a positive number indicating the number of bytes received, and -1 on error.
+        return (ssize_t)data_uint8.length;
+    }
+
+    private static int pull_timeout_function(void* transport_ptr, uint ms) {
+        Handler self = transport_ptr as Handler;
+
+        int64 end_time = get_monotonic_time() + ms * 1000;
+
+        self.buffer_mutex.lock();
+        while (self.buffer_queue.size == 0) {
+            self.buffer_cond.wait_until(self.buffer_mutex, end_time);
+            if (self.stop) {
+                self.buffer_mutex.unlock();
+                debug("DTLS handshake pull_timeout_function stopped");
+                return -1;
+            }
+
+            if (get_monotonic_time() > end_time) {
+                self.buffer_mutex.unlock();
+                return 0;
+            }
+        }
+        self.buffer_mutex.unlock();
+
+        // The callback should return 0 on timeout, a positive number if data can be received, and -1 on error.
+        return 1;
+    }
+
+    private static ssize_t push_function(void* transport_ptr, uint8[] buffer) {
+        Handler self = transport_ptr as Handler;
+        self.send_data(buffer);
+
+        // The callback should return a positive number indicating the bytes sent, and -1 on error.
+        return (ssize_t)buffer.length;
+    }
+
+    private static int verify_function(Session session) {
+        Handler self = session.get_transport_pointer() as Handler;
+        try {
+            bool valid = self.verify_peer_cert(session);
+            if (!valid) {
+                warning("DTLS certificate invalid. Aborting handshake.");
+                return 1;
+            }
+        } catch (Error e) {
+            warning("Error during DTLS certificate validation: %s. Aborting handshake.", e.message);
+            return 1;
+        }
+
+        // The callback function should return 0 for the handshake to continue or non-zero to terminate.
+        return 0;
+    }
+
+    private bool verify_peer_cert(Session session) throws GLib.Error {
+        unowned Datum[] cert_datums = session.get_peer_certificates();
+        if (cert_datums.length == 0) {
+            warning("No peer certs");
+            return false;
+        }
+        if (cert_datums.length > 1) warning("More than one peer cert");
+
+        X509.Certificate peer_cert = X509.Certificate.create();
+        peer_cert.import(ref cert_datums[0], CertificateFormat.DER);
+
+        DigestAlgorithm algo;
+        switch (peer_fp_algo) {
+            case "sha-256":
+                algo = DigestAlgorithm.SHA256;
+                break;
+            default:
+                warning("Unkown peer fingerprint algorithm: %s", peer_fp_algo);
+                return false;
+        }
+
+        uint8[] real_peer_fp = get_fingerprint(peer_cert, algo);
+
+        if (real_peer_fp.length != this.peer_fingerprint.length) {
+            warning("Fingerprint lengths not equal %i vs %i", real_peer_fp.length, peer_fingerprint.length);
+            return false;
+        }
+
+        for (int i = 0; i < real_peer_fp.length; i++) {
+            if (real_peer_fp[i] != this.peer_fingerprint[i]) {
+                warning("First cert in peer cert list doesn't equal advertised one: %s vs %s", format_fingerprint(real_peer_fp), format_fingerprint(peer_fingerprint));
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/gnu/omemo.c b/libdino/src/crypto/gnu/omemo.c
new file mode 100644
index 00000000..765e3d79
--- /dev/null
+++ b/libdino/src/crypto/gnu/omemo.c
@@ -0,0 +1,257 @@
+#include "../omemo/helper.h"
+#include <gcrypt.h>
+
+int signal_vala_random_generator(uint8_t *data, size_t len, void *user_data) {
+    gcry_randomize(data, len, GCRY_STRONG_RANDOM);
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_init(void **hmac_context, const uint8_t *key, size_t key_len, void *user_data) {
+    gcry_mac_hd_t* ctx = malloc(sizeof(gcry_mac_hd_t));
+    if (!ctx) return SG_ERR_NOMEM;
+
+    if (gcry_mac_open(ctx, GCRY_MAC_HMAC_SHA256, 0, 0)) {
+        free(ctx);
+        return SG_ERR_UNKNOWN;
+    }
+
+    if (gcry_mac_setkey(*ctx, key, key_len)) {
+        free(ctx);
+        return SG_ERR_UNKNOWN;
+    }
+
+    *hmac_context = ctx;
+
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_update(void *hmac_context, const uint8_t *data, size_t data_len, void *user_data) {
+    gcry_mac_hd_t* ctx = hmac_context;
+
+    if (gcry_mac_write(*ctx, data, data_len)) return SG_ERR_UNKNOWN;
+
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_final(void *hmac_context, signal_buffer **output, void *user_data) {
+    size_t len = gcry_mac_get_algo_maclen(GCRY_MAC_HMAC_SHA256);
+    uint8_t md[len];
+    gcry_mac_hd_t* ctx = hmac_context;
+
+    if (gcry_mac_read(*ctx, md, &len)) return SG_ERR_UNKNOWN;
+
+    signal_buffer *output_buffer = signal_buffer_create(md, len);
+    if (!output_buffer) return SG_ERR_NOMEM;
+
+    *output = output_buffer;
+
+    return SG_SUCCESS;
+}
+
+void signal_vala_hmac_sha256_cleanup(void *hmac_context, void *user_data) {
+    gcry_mac_hd_t* ctx = hmac_context;
+    if (ctx) {
+        gcry_mac_close(*ctx);
+        free(ctx);
+    }
+}
+
+static int aes_cipher(int cipher, size_t key_len, int* algo, int* mode) {
+    switch (key_len) {
+        case 16:
+            *algo = GCRY_CIPHER_AES128;
+            break;
+        case 24:
+            *algo = GCRY_CIPHER_AES192;
+            break;
+        case 32:
+            *algo = GCRY_CIPHER_AES256;
+            break;
+        default:
+            return SG_ERR_UNKNOWN;
+    }
+    switch (cipher) {
+        case SG_CIPHER_AES_CBC_PKCS5:
+            *mode = GCRY_CIPHER_MODE_CBC;
+            break;
+        case SG_CIPHER_AES_CTR_NOPADDING:
+            *mode = GCRY_CIPHER_MODE_CTR;
+            break;
+        case SG_CIPHER_AES_GCM_NOPADDING:
+            *mode = GCRY_CIPHER_MODE_GCM;
+            break;
+        default:
+            return SG_ERR_UNKNOWN;
+    }
+    return SG_SUCCESS;
+}
+
+int signal_vala_encrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *plaintext, size_t plaintext_len,
+        void *user_data) {
+    int algo, mode, error_code = SG_ERR_UNKNOWN;
+    if (aes_cipher(cipher, key_len, &algo, &mode)) return SG_ERR_INVAL;
+
+    gcry_cipher_hd_t ctx = {0};
+
+    if (gcry_cipher_open(&ctx, algo, mode, 0)) return SG_ERR_NOMEM;
+
+    signal_buffer* padded = 0;
+    signal_buffer* out_buf = 0;
+    goto no_error;
+error:
+    gcry_cipher_close(ctx);
+    if (padded != 0) {
+        signal_buffer_bzero_free(padded);
+    }
+    if (out_buf != 0) {
+        signal_buffer_free(out_buf);
+    }
+    return error_code;
+no_error:
+
+    if (gcry_cipher_setkey(ctx, key, key_len)) goto error;
+
+    uint8_t tag_len = 0, pad_len = 0;
+    switch (cipher) {
+        case SG_CIPHER_AES_CBC_PKCS5:
+            if (gcry_cipher_setiv(ctx, iv, iv_len)) goto error;
+            pad_len = 16 - (plaintext_len % 16);
+            if (pad_len == 0) pad_len = 16;
+            break;
+        case SG_CIPHER_AES_CTR_NOPADDING:
+            if (gcry_cipher_setctr(ctx, iv, iv_len)) goto error;
+            break;
+        case SG_CIPHER_AES_GCM_NOPADDING:
+            if (gcry_cipher_setiv(ctx, iv, iv_len)) goto error;
+            tag_len = 16;
+            break;
+        default:
+            return SG_ERR_UNKNOWN;
+    }
+
+    size_t padded_len = plaintext_len + pad_len;
+    padded = signal_buffer_alloc(padded_len);
+    if (padded == 0) {
+        error_code = SG_ERR_NOMEM;
+        goto error;
+    }
+
+    memset(signal_buffer_data(padded) + plaintext_len, pad_len, pad_len);
+    memcpy(signal_buffer_data(padded), plaintext, plaintext_len);
+
+    out_buf = signal_buffer_alloc(padded_len + tag_len);
+    if (out_buf == 0) {
+        error_code = SG_ERR_NOMEM;
+        goto error;
+    }
+
+    if (gcry_cipher_encrypt(ctx, signal_buffer_data(out_buf), padded_len, signal_buffer_data(padded), padded_len)) goto error;
+
+    if (tag_len > 0) {
+        if (gcry_cipher_gettag(ctx, signal_buffer_data(out_buf) + padded_len, tag_len)) goto error;
+    }
+
+    *output = out_buf;
+    out_buf = 0;
+
+    signal_buffer_bzero_free(padded);
+    padded = 0;
+
+    gcry_cipher_close(ctx);
+    return SG_SUCCESS;
+}
+
+int signal_vala_decrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *ciphertext, size_t ciphertext_len,
+        void *user_data) {
+    int algo, mode, error_code = SG_ERR_UNKNOWN;
+    *output = 0;
+    if (aes_cipher(cipher, key_len, &algo, &mode)) return SG_ERR_INVAL;
+    if (ciphertext_len == 0) return SG_ERR_INVAL;
+
+    gcry_cipher_hd_t ctx = {0};
+
+    if (gcry_cipher_open(&ctx, algo, mode, 0)) return SG_ERR_NOMEM;
+
+    signal_buffer* out_buf = 0;
+    goto no_error;
+error:
+    gcry_cipher_close(ctx);
+    if (out_buf != 0) {
+        signal_buffer_bzero_free(out_buf);
+    }
+    return error_code;
+no_error:
+
+    if (gcry_cipher_setkey(ctx, key, key_len)) goto error;
+
+    uint8_t tag_len = 0, pkcs_pad = FALSE;
+    switch (cipher) {
+        case SG_CIPHER_AES_CBC_PKCS5:
+            if (gcry_cipher_setiv(ctx, iv, iv_len)) goto error;
+            pkcs_pad = TRUE;
+            break;
+        case SG_CIPHER_AES_CTR_NOPADDING:
+            if (gcry_cipher_setctr(ctx, iv, iv_len)) goto error;
+            break;
+        case SG_CIPHER_AES_GCM_NOPADDING:
+            if (gcry_cipher_setiv(ctx, iv, iv_len)) goto error;
+            if (ciphertext_len < 16) goto error;
+            tag_len = 16;
+            break;
+        default:
+            goto error;
+    }
+
+    size_t padded_len = ciphertext_len - tag_len;
+    out_buf = signal_buffer_alloc(padded_len);
+    if (out_buf == 0) {
+        error_code = SG_ERR_NOMEM;
+        goto error;
+    }
+
+    if (gcry_cipher_decrypt(ctx, signal_buffer_data(out_buf), signal_buffer_len(out_buf), ciphertext, padded_len)) goto error;
+
+    if (tag_len > 0) {
+        if (gcry_cipher_checktag(ctx, ciphertext + padded_len, tag_len)) goto error;
+    }
+
+    if (pkcs_pad) {
+        uint8_t pad_len = signal_buffer_data(out_buf)[padded_len - 1];
+        if (pad_len > 16 || pad_len > padded_len) goto error;
+        *output = signal_buffer_create(signal_buffer_data(out_buf), padded_len - pad_len);
+        signal_buffer_bzero_free(out_buf);
+        out_buf = 0;
+    } else {
+        *output = out_buf;
+        out_buf = 0;
+    }
+
+    gcry_cipher_close(ctx);
+    return SG_SUCCESS;
+}
+
+void setup_signal_vala_crypto_provider(signal_context *context) {
+    gcry_check_version(NULL);
+
+    signal_crypto_provider provider = {
+            .random_func = signal_vala_random_generator,
+            .hmac_sha256_init_func = signal_vala_hmac_sha256_init,
+            .hmac_sha256_update_func = signal_vala_hmac_sha256_update,
+            .hmac_sha256_final_func = signal_vala_hmac_sha256_final,
+            .hmac_sha256_cleanup_func = signal_vala_hmac_sha256_cleanup,
+            .encrypt_func = signal_vala_encrypt,
+            .decrypt_func = signal_vala_decrypt,
+            .user_data = 0
+    };
+
+    signal_context_set_crypto_provider(context, &provider);
+}
+
diff --git a/libdino/src/crypto/gnu/utils.vala b/libdino/src/crypto/gnu/utils.vala
new file mode 100644
index 00000000..8a25ab27
--- /dev/null
+++ b/libdino/src/crypto/gnu/utils.vala
@@ -0,0 +1,21 @@
+namespace Dino.Crypto {
+
+public static void randomize(uint8[] buffer) {
+    GCrypt.Random.randomize(buffer);
+}
+
+internal void may_throw_gcrypt_error(GCrypt.Error e) throws Error {
+    if (((int)e) != 0) {
+        throw new Crypto.Error.GCRYPT(e.to_string());
+    }
+}
+
+public SymmetricCipherEncryption create_symmetric_cipher_encryption(string algo_name) throws Error {
+    return new SymmetricCipherGcrypt(algo_name);
+}
+
+public SymmetricCipherDecryption create_symmetric_cipher_decryption(string algo_name) throws Error {
+    return new SymmetricCipherGcrypt(algo_name);
+}
+
+}
diff --git a/libdino/src/crypto/omemo/context.h b/libdino/src/crypto/omemo/context.h
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/libdino/src/crypto/omemo/context.h
diff --git a/libdino/src/crypto/omemo/context.vala b/libdino/src/crypto/omemo/context.vala
new file mode 100644
index 00000000..3238dc3d
--- /dev/null
+++ b/libdino/src/crypto/omemo/context.vala
@@ -0,0 +1,113 @@
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public class Context {
+    public NativeContext native_context;
+    private RecMutex mutex = RecMutex();
+
+    static void locking_function_lock(void* user_data) {
+        Context ctx = (Context) user_data;
+        ctx.mutex.lock();
+    }
+
+    static void locking_function_unlock(void* user_data) {
+        Context ctx = (Context) user_data;
+        ctx.mutex.unlock();
+    }
+
+    static void stderr_log(LogLevel level, string message, size_t len, void* user_data) {
+        printerr(@"$level: $message\n");
+    }
+
+    public Context(bool log = false) throws Error {
+        throw_by_code(NativeContext.create(out native_context, this), "Error initializing native context");
+        throw_by_code(native_context.set_locking_functions(locking_function_lock, locking_function_unlock), "Error initializing native locking functions");
+        if (log) native_context.set_log_function(stderr_log);
+        setup_crypto_provider(native_context);
+    }
+
+    public Store create_store() {
+        return new Store(this);
+    }
+
+    public SignedPreKeyRecord generate_signed_pre_key(IdentityKeyPair identity_key_pair, int32 id, uint64 timestamp = 0) throws Error {
+        if (timestamp == 0) timestamp = new DateTime.now_utc().to_unix();
+        SignedPreKeyRecord res;
+        throw_by_code(Protocol.KeyHelper.generate_signed_pre_key(out res, identity_key_pair, id, timestamp, native_context));
+        return res;
+    }
+
+    public Gee.Set<PreKeyRecord> generate_pre_keys(uint start, uint count) throws Error {
+        Gee.Set<PreKeyRecord> res = new Gee.HashSet<PreKeyRecord>();
+        for(uint i = start; i < start+count; i++) {
+            ECKeyPair pair = generate_key_pair();
+            PreKeyRecord record;
+            throw_by_code(PreKeyRecord.create(out record, i, pair));
+            res.add(record);
+        }
+        return res;
+    }
+
+    public ECPublicKey decode_public_key(uint8[] bytes) throws Error {
+        ECPublicKey public_key;
+        throw_by_code(curve_decode_point(out public_key, bytes, native_context), "Error decoding public key");
+        return public_key;
+    }
+
+    public ECPrivateKey decode_private_key(uint8[] bytes) throws Error {
+        ECPrivateKey private_key;
+        throw_by_code(curve_decode_private_point(out private_key, bytes, native_context), "Error decoding private key");
+        return private_key;
+    }
+
+    public ECKeyPair generate_key_pair() throws Error {
+        ECKeyPair key_pair;
+        throw_by_code(curve_generate_key_pair(native_context, out key_pair), "Error generating key pair");
+        return key_pair;
+    }
+
+    public uint8[] calculate_signature(ECPrivateKey signing_key, uint8[] message) throws Error {
+        Buffer signature;
+        throw_by_code(Curve.calculate_signature(native_context, out signature, signing_key, message), "Error calculating signature");
+        return signature.data;
+    }
+
+    public OmemoMessage deserialize_signal_message(uint8[] data) throws Error {
+        OmemoMessage res;
+        throw_by_code(message_deserialize(out res, data, native_context));
+        return res;
+    }
+
+    public OmemoMessage deserialize_omemo_message(uint8[] data) throws Error {
+        OmemoMessage res;
+        throw_by_code(message_deserialize_omemo(out res, data, native_context));
+        return res;
+    }
+
+    public OmemoMessage copy_message(CiphertextMessage original) throws Error {
+        OmemoMessage res;
+        throw_by_code(message_copy(out res, (OmemoMessage) original, native_context));
+        return res;
+    }
+
+    public PreKeyOmemoMessage deserialize_signal_pre_key_message(uint8[] data) throws Error {
+        PreKeyOmemoMessage res;
+        throw_by_code(pre_key_message_deserialize(out res, data, native_context));
+        return res;
+    }
+
+    public PreKeyOmemoMessage deserialize_omemo_pre_key_message(uint8[] data, uint32 remote_registration_id) throws Error {
+        PreKeyOmemoMessage res;
+        throw_by_code(pre_key_message_deserialize_omemo(out res, data, remote_registration_id, native_context));
+        return res;
+    }
+
+    public PreKeyOmemoMessage copy_pre_key_message(CiphertextMessage original) throws Error {
+        PreKeyOmemoMessage res;
+        throw_by_code(pre_key_message_copy(out res, (PreKeyOmemoMessage) original, native_context));
+        return res;
+    }
+}
+
+}
diff --git a/libdino/src/crypto/omemo/helper.c b/libdino/src/crypto/omemo/helper.c
new file mode 100644
index 00000000..1fafd2b0
--- /dev/null
+++ b/libdino/src/crypto/omemo/helper.c
@@ -0,0 +1,64 @@
+#include "src/crypto/omemo/helper.h"
+
+signal_type_base* signal_type_ref_vapi(void* instance) {
+    g_return_val_if_fail(instance != NULL, NULL);
+    signal_type_ref(instance);
+    return instance;
+}
+
+signal_type_base* signal_type_unref_vapi(void* instance) {
+    g_return_val_if_fail(instance != NULL, NULL);
+    signal_type_unref(instance);
+    return NULL;
+}
+
+signal_protocol_address* signal_protocol_address_new(const gchar* name, int32_t device_id) {
+    g_return_val_if_fail(name != NULL, NULL);
+    signal_protocol_address* address = malloc(sizeof(signal_protocol_address));
+    address->device_id = -1;
+    address->name = NULL;
+    signal_protocol_address_set_name(address, name);
+    signal_protocol_address_set_device_id(address, device_id);
+    return address;
+}
+
+void signal_protocol_address_free(signal_protocol_address* ptr) {
+    g_return_if_fail(ptr != NULL);
+    if (ptr->name) {
+        g_free((void*)ptr->name);
+    }
+    return free(ptr);
+}
+
+void signal_protocol_address_set_name(signal_protocol_address* self, const gchar* name) {
+    g_return_if_fail(self != NULL);
+    g_return_if_fail(name != NULL);
+    gchar* n = g_malloc(strlen(name)+1);
+    memcpy(n, name, strlen(name));
+    n[strlen(name)] = 0;
+    if (self->name) {
+        g_free((void*)self->name);
+    }
+    self->name = n;
+    self->name_len = strlen(n);
+}
+
+gchar* signal_protocol_address_get_name(signal_protocol_address* self) {
+    g_return_val_if_fail(self != NULL, NULL);
+    g_return_val_if_fail(self->name != NULL, 0);
+    gchar* res = g_malloc(sizeof(char) * (self->name_len + 1));
+    memcpy(res, self->name, self->name_len);
+    res[self->name_len] = 0;
+    return res;
+}
+
+int32_t signal_protocol_address_get_device_id(signal_protocol_address* self) {
+    g_return_val_if_fail(self != NULL, -1);
+    return self->device_id;
+}
+
+void signal_protocol_address_set_device_id(signal_protocol_address* self, int32_t device_id) {
+    g_return_if_fail(self != NULL);
+    self->device_id = device_id;
+}
+
diff --git a/libdino/src/crypto/omemo/helper.h b/libdino/src/crypto/omemo/helper.h
new file mode 100644
index 00000000..cbbe220f
--- /dev/null
+++ b/libdino/src/crypto/omemo/helper.h
@@ -0,0 +1,40 @@
+#ifndef SIGNAL_PROTOCOL_VALA_HELPER
+#define SIGNAL_PROTOCOL_VALA_HELPER 1
+
+#include <omemo/signal_protocol.h>
+#include <string.h>
+#include <glib.h>
+
+#define SG_CIPHER_AES_GCM_NOPADDING 1000
+
+signal_type_base* signal_type_ref_vapi(void* what);
+signal_type_base* signal_type_unref_vapi(void* what);
+
+signal_protocol_address* signal_protocol_address_new(const gchar* name, int32_t device_id);
+void signal_protocol_address_free(signal_protocol_address* ptr);
+void signal_protocol_address_set_name(signal_protocol_address* self, const gchar* name);
+gchar* signal_protocol_address_get_name(signal_protocol_address* self);
+void signal_protocol_address_set_device_id(signal_protocol_address* self, int32_t device_id);
+int32_t signal_protocol_address_get_device_id(signal_protocol_address* self);
+
+int signal_vala_random_generator(uint8_t *data, size_t len, void *user_data);
+int signal_vala_hmac_sha256_init(void **hmac_context, const uint8_t *key, size_t key_len, void *user_data);
+int signal_vala_hmac_sha256_update(void *hmac_context, const uint8_t *data, size_t data_len, void *user_data);
+int signal_vala_hmac_sha256_final(void *hmac_context, signal_buffer **output, void *user_data);
+void signal_vala_hmac_sha256_cleanup(void *hmac_context, void *user_data);
+
+int signal_vala_encrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *plaintext, size_t plaintext_len,
+        void *user_data);
+int signal_vala_decrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *ciphertext, size_t ciphertext_len,
+        void *user_data);
+void setup_signal_vala_crypto_provider(signal_context *context);
+
+#endif
diff --git a/libdino/src/crypto/omemo/simple_iks.vala b/libdino/src/crypto/omemo/simple_iks.vala
new file mode 100644
index 00000000..1c9c8a1d
--- /dev/null
+++ b/libdino/src/crypto/omemo/simple_iks.vala
@@ -0,0 +1,60 @@
+using Gee;
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public class SimpleIdentityKeyStore : IdentityKeyStore {
+    public signal void trusted_identity_added(TrustedIdentity id);
+    public signal void trusted_identity_updated(TrustedIdentity id);
+
+    public override Bytes identity_key_private { get; set; }
+    public override Bytes identity_key_public { get; set; }
+    public override uint32 local_registration_id { get; set; }
+    private Map<string, Map<int, TrustedIdentity>> trusted_identities = new HashMap<string, Map<int, TrustedIdentity>>();
+
+    public override void save_identity(Address address, uint8[] key) throws Error {
+        string name = address.name;
+        if (trusted_identities.has_key(name)) {
+            if (trusted_identities[name].has_key(address.device_id)) {
+                trusted_identities[name][address.device_id].key = key;
+                trusted_identity_updated(trusted_identities[name][address.device_id]);
+            } else {
+                trusted_identities[name][address.device_id] = new TrustedIdentity.by_address(address, key);
+                trusted_identity_added(trusted_identities[name][address.device_id]);
+            }
+        } else {
+            trusted_identities[name] = new HashMap<int, TrustedIdentity>();
+            trusted_identities[name][address.device_id] = new TrustedIdentity.by_address(address, key);
+            trusted_identity_added(trusted_identities[name][address.device_id]);
+        }
+    }
+
+    public override bool is_trusted_identity(Address address, uint8[] key) throws Error {
+        if (!trusted_identities.has_key(address.name)) return true;
+        if (!trusted_identities[address.name].has_key(address.device_id)) return true;
+        uint8[] other_key = trusted_identities[address.name][address.device_id].key;
+        if (other_key.length != key.length) return false;
+        for (int i = 0; i < key.length; i++) {
+            if (other_key[i] != key[i]) return false;
+        }
+        return true;
+    }
+
+    public class TrustedIdentity {
+        public uint8[] key { get; set; }
+        public string name { get; private set; }
+        public int device_id { get; private set; }
+
+        public TrustedIdentity(string name, int device_id, uint8[] key) {
+            this.key = key;
+            this.name = name;
+            this.device_id = device_id;
+        }
+
+        public TrustedIdentity.by_address(Address address, uint8[] key) {
+            this(address.name, address.device_id, key);
+        }
+    }
+}
+
+}
diff --git a/libdino/src/crypto/omemo/simple_pks.vala b/libdino/src/crypto/omemo/simple_pks.vala
new file mode 100644
index 00000000..f22def89
--- /dev/null
+++ b/libdino/src/crypto/omemo/simple_pks.vala
@@ -0,0 +1,47 @@
+using Gee;
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public class SimplePreKeyStore : PreKeyStore {
+    public signal void pre_key_stored(Key key);
+    public signal void pre_key_deleted(Key key);
+
+    private Map<uint32, Key> pre_key_map = new HashMap<uint32, Key>();
+
+    public override uint8[]? load_pre_key(uint32 pre_key_id) throws Error {
+        if (contains_pre_key(pre_key_id)) {
+            return pre_key_map[pre_key_id].record;
+        }
+        return null;
+    }
+
+    public override void store_pre_key(uint32 pre_key_id, uint8[] record) throws Error {
+        Key key = new Key(pre_key_id, record);
+        pre_key_map[pre_key_id] = key;
+        pre_key_stored(key);
+    }
+
+    public override bool contains_pre_key(uint32 pre_key_id) throws Error {
+        return pre_key_map.has_key(pre_key_id);
+    }
+
+    public override void delete_pre_key(uint32 pre_key_id) throws Error {
+        Key key;
+        if (pre_key_map.unset(pre_key_id, out key)) {
+            pre_key_deleted(key);
+        }
+    }
+
+    public class Key {
+        public uint32 key_id { get; private set; }
+        public uint8[] record { get; private set; }
+
+        public Key(uint32 key_id, uint8[] record) {
+            this.key_id = key_id;
+            this.record = record;
+        }
+    }
+}
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/omemo/simple_spks.vala b/libdino/src/crypto/omemo/simple_spks.vala
new file mode 100644
index 00000000..b4a1b610
--- /dev/null
+++ b/libdino/src/crypto/omemo/simple_spks.vala
@@ -0,0 +1,47 @@
+using Gee;
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public class SimpleSignedPreKeyStore : SignedPreKeyStore {
+    public signal void signed_pre_key_stored(Key key);
+    public signal void signed_pre_key_deleted(Key key);
+
+    private Map<uint32, Key> pre_key_map = new HashMap<uint32, Key>();
+
+    public override uint8[]? load_signed_pre_key(uint32 pre_key_id) throws Error {
+        if (contains_signed_pre_key(pre_key_id)) {
+            return pre_key_map[pre_key_id].record;
+        }
+        return null;
+    }
+
+    public override void store_signed_pre_key(uint32 pre_key_id, uint8[] record) throws Error {
+        Key key = new Key(pre_key_id, record);
+        pre_key_map[pre_key_id] = key;
+        signed_pre_key_stored(key);
+    }
+
+    public override bool contains_signed_pre_key(uint32 pre_key_id) throws Error {
+        return pre_key_map.has_key(pre_key_id);
+    }
+
+    public override void delete_signed_pre_key(uint32 pre_key_id) throws Error {
+        Key key;
+        if (pre_key_map.unset(pre_key_id, out key)) {
+            signed_pre_key_deleted(key);
+        }
+    }
+
+    public class Key {
+        public uint32 key_id { get; private set; }
+        public uint8[] record { get; private set; }
+
+        public Key(uint32 key_id, uint8[] record) {
+            this.key_id = key_id;
+            this.record = record;
+        }
+    }
+}
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/omemo/simple_ss.vala b/libdino/src/crypto/omemo/simple_ss.vala
new file mode 100644
index 00000000..8c095c6d
--- /dev/null
+++ b/libdino/src/crypto/omemo/simple_ss.vala
@@ -0,0 +1,84 @@
+using Gee;
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public class SimpleSessionStore : SessionStore {
+    public signal void session_stored(Session session);
+    public signal void session_removed(Session session);
+
+    private Map<string, ArrayList<Session>> session_map = new HashMap<string, ArrayList<Session>>();
+
+    public override uint8[]? load_session(Address address) throws Error {
+        if (session_map.has_key(address.name)) {
+            foreach (Session session in session_map[address.name]) {
+                if (session.device_id == address.device_id) return session.record;
+            }
+        }
+        return null;
+    }
+
+    public override IntList get_sub_device_sessions(string name) throws Error {
+        IntList res = new IntList();
+        if (session_map.has_key(name)) {
+            foreach (Session session in session_map[name]) {
+                res.add(session.device_id);
+            }
+        }
+        return res;
+    }
+
+    public override void store_session(Address address, uint8[] record) throws Error {
+        if (contains_session(address)) {
+            delete_session(address);
+        }
+        if (!session_map.has_key(address.name)) {
+            session_map[address.name] = new ArrayList<Session>();
+        }
+        Session session = new Session() { name = address.name, device_id = address.device_id, record = record };
+        session_map[address.name].add(session);
+        session_stored(session);
+    }
+
+    public override bool contains_session(Address address) throws Error {
+        if (!session_map.has_key(address.name)) return false;
+        foreach (Session session in session_map[address.name]) {
+            if (session.device_id == address.device_id) return true;
+        }
+        return false;
+    }
+
+    public override void delete_session(Address address) throws Error {
+        if (!session_map.has_key(address.name)) throw_by_code(ErrorCode.UNKNOWN, "No session found");
+        foreach (Session session in session_map[address.name]) {
+            if (session.device_id == address.device_id) {
+                session_map[address.name].remove(session);
+                if (session_map[address.name].size == 0) {
+                    session_map.unset(address.name);
+                }
+                session_removed(session);
+                return;
+            }
+        }
+    }
+
+    public override void delete_all_sessions(string name) throws Error {
+        if (session_map.has_key(name)) {
+            foreach (Session session in session_map[name]) {
+                session_map[name].remove(session);
+                if (session_map[name].size == 0) {
+                    session_map.unset(name);
+                }
+                session_removed(session);
+            }
+        }
+    }
+
+    public class Session {
+        public string name;
+        public int device_id;
+        public uint8[] record;
+    }
+}
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/omemo/store.vala b/libdino/src/crypto/omemo/store.vala
new file mode 100644
index 00000000..746c07d7
--- /dev/null
+++ b/libdino/src/crypto/omemo/store.vala
@@ -0,0 +1,361 @@
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public abstract class IdentityKeyStore : Object {
+    public abstract Bytes identity_key_private { get; set; }
+    public abstract Bytes identity_key_public { get; set; }
+    public abstract uint32 local_registration_id { get; set; }
+
+    public abstract void save_identity(Address address, uint8[] key) throws Error ;
+
+    public abstract bool is_trusted_identity(Address address, uint8[] key) throws Error ;
+}
+
+public abstract class SessionStore : Object {
+    public abstract uint8[]? load_session(Address address) throws Error ;
+
+    public abstract IntList get_sub_device_sessions(string name) throws Error ;
+
+    public abstract void store_session(Address address, uint8[] record) throws Error ;
+
+    public abstract bool contains_session(Address address) throws Error ;
+
+    public abstract void delete_session(Address address) throws Error ;
+
+    public abstract void delete_all_sessions(string name) throws Error ;
+}
+
+public abstract class PreKeyStore : Object {
+    public abstract uint8[]? load_pre_key(uint32 pre_key_id) throws Error ;
+
+    public abstract void store_pre_key(uint32 pre_key_id, uint8[] record) throws Error ;
+
+    public abstract bool contains_pre_key(uint32 pre_key_id) throws Error ;
+
+    public abstract void delete_pre_key(uint32 pre_key_id) throws Error ;
+}
+
+public abstract class SignedPreKeyStore : Object {
+    public abstract uint8[]? load_signed_pre_key(uint32 pre_key_id) throws Error ;
+
+    public abstract void store_signed_pre_key(uint32 pre_key_id, uint8[] record) throws Error ;
+
+    public abstract bool contains_signed_pre_key(uint32 pre_key_id) throws Error ;
+
+    public abstract void delete_signed_pre_key(uint32 pre_key_id) throws Error ;
+}
+
+public class Store : Object {
+    public Context context { get; private set; }
+    public IdentityKeyStore identity_key_store { get; set; default = new SimpleIdentityKeyStore(); }
+    public SessionStore session_store { get; set; default = new SimpleSessionStore(); }
+    public PreKeyStore pre_key_store { get; set; default = new SimplePreKeyStore(); }
+    public SignedPreKeyStore signed_pre_key_store { get; set; default = new SimpleSignedPreKeyStore(); }
+    public uint32 local_registration_id { get { return identity_key_store.local_registration_id; } }
+    public NativeStoreContext native_context {get { return native_store_context_; }}
+    private NativeStoreContext native_store_context_;
+
+    static int iks_get_identity_key_pair(out Buffer public_data, out Buffer private_data, void* user_data) {
+        Store store = (Store) user_data;
+        public_data = new Buffer.from(store.identity_key_store.identity_key_public.get_data());
+        private_data = new Buffer.from(store.identity_key_store.identity_key_private.get_data());
+        return 0;
+    }
+
+    static int iks_get_local_registration_id(void* user_data, out uint32 registration_id) {
+        Store store = (Store) user_data;
+        registration_id = store.identity_key_store.local_registration_id;
+        return 0;
+    }
+
+    static int iks_save_identity(Address address, uint8[] key, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.identity_key_store.save_identity(address, key);
+            return 0;
+        });
+    }
+
+    static int iks_is_trusted_identity(Address address, uint8[] key, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            return store.identity_key_store.is_trusted_identity(address, key) ? 1 : 0;
+        });
+    }
+
+    static void iks_destroy_func(void* user_data) {
+    }
+
+    static int ss_load_session_func(out Buffer? record, out Buffer? user_record, Address address, void* user_data) {
+        Store store = (Store) user_data;
+        user_record = null; // No support for user_record
+        uint8[]? res = null;
+        try {
+            res = store.session_store.load_session(address);
+        } catch (Error e) {
+            record = null;
+            return e.code;
+        }
+        if (res == null) {
+            record = null;
+            return 0;
+        }
+        record = new Buffer.from((!)res);
+        if (record == null) return ErrorCode.NOMEM;
+        return 1;
+    }
+
+    static int ss_get_sub_device_sessions_func(out IntList? sessions, char[] name, void* user_data) {
+        Store store = (Store) user_data;
+        try {
+            sessions = store.session_store.get_sub_device_sessions(carr_to_string(name));
+        } catch (Error e) {
+            sessions = null;
+            return e.code;
+        }
+        return 0;
+    }
+
+    static int ss_store_session_func(Address address, uint8[] record, uint8[] user_record, void* user_data) {
+        // Ignoring user_record
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.session_store.store_session(address, record);
+            return 0;
+        });
+    }
+
+    static int ss_contains_session_func(Address address, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            return store.session_store.contains_session(address) ? 1 : 0;
+        });
+    }
+
+    static int ss_delete_session_func(Address address, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.session_store.delete_session(address);
+            return 0;
+        });
+    }
+
+    static int ss_delete_all_sessions_func(char[] name, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.session_store.delete_all_sessions(carr_to_string(name));
+            return 0;
+        });
+    }
+
+    static void ss_destroy_func(void* user_data) {
+    }
+
+    static int pks_load_pre_key(out Buffer? record, uint32 pre_key_id, void* user_data) {
+        Store store = (Store) user_data;
+        uint8[]? res = null;
+        try {
+            res = store.pre_key_store.load_pre_key(pre_key_id);
+        } catch (Error e) {
+            record = null;
+            return e.code;
+        }
+        if (res == null) {
+            record = new Buffer(0);
+            return 0;
+        }
+        record = new Buffer.from((!)res);
+        if (record == null) return ErrorCode.NOMEM;
+        return 1;
+    }
+
+    static int pks_store_pre_key(uint32 pre_key_id, uint8[] record, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.pre_key_store.store_pre_key(pre_key_id, record);
+            return 0;
+        });
+    }
+
+    static int pks_contains_pre_key(uint32 pre_key_id, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            return store.pre_key_store.contains_pre_key(pre_key_id) ? 1 : 0;
+        });
+    }
+
+    static int pks_remove_pre_key(uint32 pre_key_id, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.pre_key_store.delete_pre_key(pre_key_id);
+            return 0;
+        });
+    }
+
+    static void pks_destroy_func(void* user_data) {
+    }
+
+    static int spks_load_signed_pre_key(out Buffer? record, uint32 pre_key_id, void* user_data) {
+        Store store = (Store) user_data;
+        uint8[]? res = null;
+        try {
+            res = store.signed_pre_key_store.load_signed_pre_key(pre_key_id);
+        } catch (Error e) {
+            record = null;
+            return e.code;
+        }
+        if (res == null) {
+            record = new Buffer(0);
+            return 0;
+        }
+        record = new Buffer.from((!)res);
+        if (record == null) return ErrorCode.NOMEM;
+        return 1;
+    }
+
+    static int spks_store_signed_pre_key(uint32 pre_key_id, uint8[] record, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.signed_pre_key_store.store_signed_pre_key(pre_key_id, record);
+            return 0;
+        });
+    }
+
+    static int spks_contains_signed_pre_key(uint32 pre_key_id, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            return store.signed_pre_key_store.contains_signed_pre_key(pre_key_id) ? 1 : 0;
+        });
+    }
+
+    static int spks_remove_signed_pre_key(uint32 pre_key_id, void* user_data) {
+        Store store = (Store) user_data;
+        return catch_to_code(() => {
+            store.signed_pre_key_store.delete_signed_pre_key(pre_key_id);
+            return 0;
+        });
+    }
+
+    static void spks_destroy_func(void* user_data) {
+    }
+
+    internal Store(Context context) {
+        this.context = context;
+        NativeStoreContext.create(out native_store_context_, context.native_context);
+
+        NativeIdentityKeyStore iks = NativeIdentityKeyStore() {
+            get_identity_key_pair = iks_get_identity_key_pair,
+            get_local_registration_id = iks_get_local_registration_id,
+            save_identity = iks_save_identity,
+            is_trusted_identity = iks_is_trusted_identity,
+            destroy_func = iks_destroy_func,
+            user_data = this
+        };
+        native_context.set_identity_key_store(iks);
+
+        NativeSessionStore ss = NativeSessionStore() {
+            load_session_func = ss_load_session_func,
+            get_sub_device_sessions_func = ss_get_sub_device_sessions_func,
+            store_session_func = ss_store_session_func,
+            contains_session_func = ss_contains_session_func,
+            delete_session_func = ss_delete_session_func,
+            delete_all_sessions_func = ss_delete_all_sessions_func,
+            destroy_func = ss_destroy_func,
+            user_data = this
+        };
+        native_context.set_session_store(ss);
+
+        NativePreKeyStore pks = NativePreKeyStore() {
+            load_pre_key = pks_load_pre_key,
+            store_pre_key = pks_store_pre_key,
+            contains_pre_key = pks_contains_pre_key,
+            remove_pre_key = pks_remove_pre_key,
+            destroy_func = pks_destroy_func,
+            user_data = this
+        };
+        native_context.set_pre_key_store(pks);
+
+        NativeSignedPreKeyStore spks = NativeSignedPreKeyStore() {
+            load_signed_pre_key = spks_load_signed_pre_key,
+            store_signed_pre_key = spks_store_signed_pre_key,
+            contains_signed_pre_key = spks_contains_signed_pre_key,
+            remove_signed_pre_key = spks_remove_signed_pre_key,
+            destroy_func = spks_destroy_func,
+            user_data = this
+        };
+        native_context.set_signed_pre_key_store(spks);
+    }
+
+    public SessionBuilder create_session_builder(Address other) throws Error {
+        SessionBuilder builder;
+        throw_by_code(session_builder_create(out builder, native_context, other, context.native_context), "Error creating session builder");
+        return builder;
+    }
+
+    public SessionCipher create_session_cipher(Address other) throws Error {
+        SessionCipher cipher;
+        throw_by_code(session_cipher_create(out cipher, native_context, other, context.native_context));
+        return cipher;
+    }
+
+    public IdentityKeyPair identity_key_pair {
+        owned get {
+            IdentityKeyPair pair;
+            Protocol.Identity.get_key_pair(native_context, out pair);
+            return pair;
+        }
+    }
+
+    public bool is_trusted_identity(Address address, ECPublicKey key) throws Error {
+        return throw_by_code(Protocol.Identity.is_trusted_identity(native_context, address, key)) == 1;
+    }
+
+    public void save_identity(Address address, ECPublicKey key) throws Error {
+        throw_by_code(Protocol.Identity.save_identity(native_context, address, key));
+    }
+
+    public bool contains_session(Address other) throws Error {
+        return throw_by_code(Protocol.Session.contains_session(native_context, other)) == 1;
+    }
+
+    public void delete_session(Address address) throws Error {
+        throw_by_code(Protocol.Session.delete_session(native_context, address));
+    }
+
+    public SessionRecord load_session(Address other) throws Error {
+        SessionRecord record;
+        throw_by_code(Protocol.Session.load_session(native_context, out record, other));
+        return record;
+    }
+
+    public bool contains_pre_key(uint32 pre_key_id) throws Error {
+        return throw_by_code(Protocol.PreKey.contains_key(native_context, pre_key_id)) == 1;
+    }
+
+    public void store_pre_key(PreKeyRecord record) throws Error {
+        throw_by_code(Protocol.PreKey.store_key(native_context, record));
+    }
+
+    public PreKeyRecord load_pre_key(uint32 pre_key_id) throws Error {
+        PreKeyRecord res;
+        throw_by_code(Protocol.PreKey.load_key(native_context, out res, pre_key_id));
+        return res;
+    }
+
+    public bool contains_signed_pre_key(uint32 pre_key_id) throws Error {
+        return throw_by_code(Protocol.SignedPreKey.contains_key(native_context, pre_key_id)) == 1;
+    }
+
+    public void store_signed_pre_key(SignedPreKeyRecord record) throws Error {
+        throw_by_code(Protocol.SignedPreKey.store_key(native_context, record));
+    }
+
+    public SignedPreKeyRecord load_signed_pre_key(uint32 pre_key_id) throws Error {
+        SignedPreKeyRecord res;
+        throw_by_code(Protocol.SignedPreKey.load_key(native_context, out res, pre_key_id));
+        return res;
+    }
+}
+
+}
diff --git a/libdino/src/crypto/omemo/util.vala b/libdino/src/crypto/omemo/util.vala
new file mode 100644
index 00000000..eca12fbb
--- /dev/null
+++ b/libdino/src/crypto/omemo/util.vala
@@ -0,0 +1,47 @@
+using Omemo;
+
+namespace Dino.Crypto.Omemo {
+
+public ECPublicKey generate_public_key(ECPrivateKey private_key) throws Error {
+    ECPublicKey public_key;
+    throw_by_code(ECPublicKey.generate(out public_key, private_key), "Error generating public key");
+
+    return public_key;
+}
+
+public uint8[] calculate_agreement(ECPublicKey public_key, ECPrivateKey private_key) throws Error {
+    uint8[] res;
+    int len = Curve.calculate_agreement(out res, public_key, private_key);
+    throw_by_code(len, "Error calculating agreement");
+    res.length = len;
+    return res;
+}
+
+public bool verify_signature(ECPublicKey signing_key, uint8[] message, uint8[] signature) throws Error {
+    return throw_by_code(Curve.verify_signature(signing_key, message, signature)) == 1;
+}
+
+public PreKeyBundle create_pre_key_bundle(uint32 registration_id, int device_id, uint32 pre_key_id, ECPublicKey? pre_key_public,
+        uint32 signed_pre_key_id, ECPublicKey? signed_pre_key_public, uint8[]? signed_pre_key_signature, ECPublicKey? identity_key) throws Error {
+    PreKeyBundle res;
+    throw_by_code(PreKeyBundle.create(out res, registration_id, device_id, pre_key_id, pre_key_public, signed_pre_key_id, signed_pre_key_public, signed_pre_key_signature, identity_key), "Error creating PreKeyBundle");
+    return res;
+}
+
+internal string carr_to_string(char[] carr) {
+    char[] nu = new char[carr.length + 1];
+    Memory.copy(nu, carr, carr.length);
+    return (string) nu;
+}
+
+internal delegate int CodeErroringFunc() throws Error;
+
+internal int catch_to_code(CodeErroringFunc func) {
+    try {
+        return func();
+    } catch (Error e) {
+        return e.code;
+    }
+}
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/openssl/cipher.vala b/libdino/src/crypto/openssl/cipher.vala
new file mode 100644
index 00000000..02064770
--- /dev/null
+++ b/libdino/src/crypto/openssl/cipher.vala
@@ -0,0 +1,156 @@
+namespace Dino.Crypto {
+
+internal class SymmetricCipherEncryptionOpenssl : SymmetricCipher, SymmetricCipherEncryption, Object {
+    private OpenSSL.EVP.CipherContext? cipher;
+    private bool is_finalized = false;
+
+    public SymmetricCipherEncryptionOpenssl(string algo_name) throws Error {
+        if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+        cipher = new OpenSSL.EVP.CipherContext();
+    }
+
+    public void set_key(uint8[] key) throws Error {
+        unowned OpenSSL.EVP.Cipher algo;
+        if (key.length == 16) {
+            algo = OpenSSL.EVP.aes_128_gcm();
+        } else if (key.length == 32) {
+            algo = OpenSSL.EVP.aes_256_gcm();
+        } else {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM");
+        }
+        try {
+            cipher.encrypt_init(algo, null, null);
+            cipher.encrypt_init(null, key, null);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void set_iv(uint8[] iv) throws Error {
+        if (iv.length != 12) {
+            cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null);
+        }
+        try {
+            cipher.encrypt_init(null, null, iv);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void reset() throws Error {
+        throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context");
+    }
+
+    public uint8[] get_tag(size_t taglen) throws Error {
+        uint8[] tag = new uint8[taglen];
+        if (!is_finalized) {
+            uint8[] empty = new uint8[0];
+            int empty_len = 0;
+            try {
+                cipher.encrypt_final(empty, out empty_len);
+            } catch (GLib.Error e) {
+                throw new Crypto.Error.OPENSSL(e.message);
+            }
+            if (empty_len != 0) {
+                throw new Crypto.Error.ILLEGAL_ARGUMENTS("get_tag called on a stream with remaining data");
+            }
+        }
+        if (cipher.ctrl(OpenSSL.EVP.Control.GCM_GET_TAG, (int)taglen, tag) != 1) {
+            openssl_error();
+        }
+        return tag;
+    }
+
+    public int encrypt(uint8[] output, uint8[] input) throws Error {
+        int output_length = output.length;
+        if (is_finalized) {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("encrypt called after get_tag");
+        }
+        try {
+            cipher.encrypt_update(output, out output_length, input);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+        return output_length;
+    }
+}
+
+internal class SymmetricCipherDecryptionOpenssl : SymmetricCipher, SymmetricCipherDecryption, Object {
+    private OpenSSL.EVP.CipherContext? cipher;
+    private bool is_finalized = false;
+
+    public SymmetricCipherDecryptionOpenssl(string algo_name) throws Error {
+        if (algo_name != "AES-GCM") throw new Error.ILLEGAL_ARGUMENTS(@"The algorithm $algo_name is not supported");
+        cipher = new OpenSSL.EVP.CipherContext();
+        try {
+            cipher.decrypt_init(OpenSSL.EVP.aes_128_gcm(), null, null);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void set_key(uint8[] key) throws Error {
+        unowned OpenSSL.EVP.Cipher algo;
+        if (key.length == 16) {
+            algo = OpenSSL.EVP.aes_128_gcm();
+        } else if (key.length == 32) {
+            algo = OpenSSL.EVP.aes_256_gcm();
+        } else {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("key length must be 16 or 32 for AES-GCM");
+        }
+        try {
+            cipher.decrypt_init(algo, null, null);
+            cipher.decrypt_init(null, key, null);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void set_iv(uint8[] iv) throws Error {
+        if (iv.length != 12) {
+            cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_IVLEN, iv.length, null);
+        }
+        try {
+            cipher.decrypt_init(null, null, iv);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+    }
+
+    public void reset() throws Error {
+        throw new Crypto.Error.ILLEGAL_ARGUMENTS("can't reset OpenSSL cipher context");
+    }
+
+    public void check_tag(uint8[] tag) throws Error {
+        if (cipher.ctrl(OpenSSL.EVP.Control.GCM_SET_TAG, tag.length, tag) != 1) {
+            openssl_error();
+        }
+        if (!is_finalized) {
+            uint8[] empty = new uint8[0];
+            int empty_len = 0;
+            try {
+                cipher.decrypt_final(empty, out empty_len);
+            } catch (GLib.Error e) {
+                throw new Crypto.Error.OPENSSL(e.message);
+            }
+            if (empty_len != 0) {
+                throw new Crypto.Error.ILLEGAL_ARGUMENTS("check_tag called on a stream with remaining data");
+            }
+        }
+    }
+
+    public int decrypt(uint8[] output, uint8[] input) throws Error {
+        if (is_finalized) {
+            throw new Crypto.Error.ILLEGAL_ARGUMENTS("decrypt called after check_tag");
+        }
+        int output_length = output.length;
+        try {
+            cipher.decrypt_update(output, out output_length, input);
+        } catch (GLib.Error e) {
+            throw new Crypto.Error.OPENSSL(e.message);
+        }
+        return output_length;
+    }
+}
+
+}
diff --git a/libdino/src/crypto/openssl/dtls_srtp.vala b/libdino/src/crypto/openssl/dtls_srtp.vala
new file mode 100644
index 00000000..192f0da2
--- /dev/null
+++ b/libdino/src/crypto/openssl/dtls_srtp.vala
@@ -0,0 +1,202 @@
+using OpenSSL;
+
+namespace Dino.Crypto.DtlsSrtp {
+
+public class CredentialsCapsuleOpenSSL : CredentialsCapsule {
+    internal X509.Certificate own_cert;
+    internal EVP.Key private_key;
+}
+
+public CredentialsCapsule generate_credentials () throws GLib.Error {
+    EVP.Key key = new EVP.Key.generate_ecdsa ("prime256v1");
+
+    var start_time = new DateTime.now_local().add_days(-1);
+    var end_time = start_time.add_days (2);
+
+    X509.Certificate cert = new X509.Certificate ();
+    cert.set_public_key (key);
+    cert.set_version (1);
+    cert.not_before.set ((time_t) start_time.to_unix ());
+    cert.not_after.set ((time_t) end_time.to_unix ());
+    cert.serial_number.set (1);
+
+    cert.sign (key, EVP.sha256 ());
+
+    CredentialsCapsuleOpenSSL credentials = new CredentialsCapsuleOpenSSL ();
+    credentials.own_fingerprint = cert.digest (EVP.sha256 ());
+    credentials.own_cert = (owned) cert;
+    credentials.private_key = (owned) key;
+    return credentials;
+}
+
+public class Handler : AbstractHandler {
+
+    public Handler.with_cert (CredentialsCapsule creds) {
+        base.with_cert (creds);
+    }
+
+    protected override Xmpp.Xep.Jingle.ContentEncryption? setup_dtls_connection_thread () {
+        debug("Setting up DTLS connection using OpenSSL. We're %s", mode.to_string());
+        SSL.Context context = new SSL.Context (mode == Mode.SERVER ? SSL.Method.DTLS_SERVER : SSL.Method.DTLS_CLIENT);
+        context.set_tlsext_use_srtp ("SRTP_AES128_CM_SHA1_80");
+        context.use_certificate (((CredentialsCapsuleOpenSSL) credentials).own_cert);
+        context.use_private_key (((CredentialsCapsuleOpenSSL) credentials).private_key);
+        SSL session = new SSL (context);
+        BIO<Handler> bio = new BIO<Handler>(get_handler_based_bio_method());
+        bio.data = this;
+        session.rbio = bio;
+        session.wbio = bio;
+
+        DateTime maximum_time = new DateTime.now_utc().add_seconds(20);
+        int err = 0;
+        if (mode == Mode.SERVER) {
+            session.set_accept_state ();
+        } else {
+            session.set_connect_state ();
+        }
+        do {
+            try {
+                SSL.Error ret = session.do_handshake();
+                switch (ret) {
+                    case SSL.Error.NONE:
+                        err = 1;
+                        break;
+                    case SSL.Error.WANT_READ:
+                        debug ("DTLS wants to read, but nothing in queue, wait for buffer");
+                        buffer_mutex.lock();
+                        if (buffer_queue.size == 0) {
+                            buffer_cond.wait_until(buffer_mutex, get_monotonic_time() + maximum_time.difference(new DateTime.now_utc()));
+                        }
+                        buffer_mutex.unlock();
+                        err = -1;
+                        break;
+                    default:
+                        warning ("DTLS Error: %s", @"$ret");
+                        err = 4;
+                        break;
+                }
+            } catch (Error e) {
+                warning ("DTLS Error: %s", e.message);
+                err = e.code;
+            }
+
+            DateTime current_time = new DateTime.now_utc();
+            if (maximum_time.compare(current_time) < 0) {
+                debug ("DTLS handshake timeouted");
+                err = 2;
+                break;
+            }
+            if (stop) {
+                debug ("DTLS handshake stopped");
+                err = 3;
+                break;
+            }
+        } while (err < 0);
+
+        buffer_mutex.lock();
+        if (stop) {
+            stop = false;
+            running = false;
+            bool restart = restart;
+            buffer_mutex.unlock();
+            if (restart) {
+                debug ("Restarting DTLS handshake");
+                return setup_dtls_connection_thread();
+            }
+            return null;
+        }
+        buffer_mutex.unlock();
+        if (err != 1) {
+            debug ("DTLS handshake failed");
+            return null;
+        }
+
+        // TODO: Check peer certificate
+
+        uint8[] km = new uint8[60];
+        session.export_keying_material (km, "EXTRACTOR-dtls_srtp");
+        uint8[] client_key = km[0:16];
+        uint8[] server_key = km[16:32];
+        uint8[] client_salt = km[32:46];
+        uint8[] server_salt = km[46:60];
+
+        debug ("Finished DTLS connection. We're %s", mode.to_string());
+        if (mode == Mode.SERVER) {
+            srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt);
+            srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt);
+        } else {
+            srtp_session.set_encryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, client_key, client_salt);
+            srtp_session.set_decryption_key (Crypto.Srtp.AES_CM_128_HMAC_SHA1_80, server_key, server_salt);
+        }
+        return new Xmpp.Xep.Jingle.ContentEncryption (Xmpp.Xep.JingleIceUdp.DTLS_NS_URI, "DTLS-SRTP", credentials.own_fingerprint, peer_fingerprint);
+    }
+
+    private int read_impl (BIO<Handler> bio, uint8[] out_buf) {
+        Bytes data = get_buffer_if_present ();
+        if (data == null) {
+            if (!stop) {
+                debug ("No pending buffer in queue, but end not reached yet, set_retry_read");
+                bio.set_retry_read ();
+            }
+            return -1;
+        }
+        if (data.length > out_buf.length) {
+            warning ("Buffer in queue does not fit in out_buf");
+            return -1;
+        }
+        debug ("Read %d bytes from queue", data.length);
+
+        uint8[] data_uint8 = Bytes.unref_to_data((owned) data);
+        Memory.copy (out_buf, data_uint8, data_uint8.length);
+        bio.clear_retry_flags ();
+        return data_uint8.length;
+    }
+
+    private int write_impl (BIO<Handler> bio, uint8[] buf) {
+        debug ("Write %d bytes to network", buf.length);
+        send_data (buf);
+        return buf.length;
+    }
+
+    private long ctrl_impl (BIO<Handler> bio, BIO.ControlCommand cmd, long num, void* ptr) {
+        switch (cmd) {
+            case BIO.ControlCommand.FLUSH:
+                // Datagrams are sent out immediately
+                return 1;
+            case BIO.ControlCommand.DGRAM_SET_NEXT_TIMEOUT:
+                // Datagrams are sent out immediately
+                return 1;
+            case BIO.ControlCommand.DGRAM_GET_MTU_OVERHEAD:
+                // Just some safe estimate
+                return 70;
+            case BIO.ControlCommand.DGRAM_QUERY_MTU:
+                // Just some safe estimate
+                return 1200;
+            case BIO.ControlCommand.WPENDING:
+                // Datagrams are sent out immediately
+                return 0;
+            case BIO.ControlCommand.POP:
+            case BIO.ControlCommand.PUSH:
+                // Ignored
+                return 0;
+            default:
+                warning (@"Unimplemented ctrl cmd:$cmd, num:$num");
+                return 0;
+        }
+    }
+
+    private static BIO.Method<Handler> _handler_based_bio_method_instance = null;
+
+    private static unowned BIO.Method<Handler> get_handler_based_bio_method () {
+        if (_handler_based_bio_method_instance != null) return _handler_based_bio_method_instance;
+        _handler_based_bio_method_instance = new BIO.Method<Handler> (BIO.Type.SOURCE_SINK | BIO.Type.DGRAM, "Dino DTLS Handler BIO");
+        _handler_based_bio_method_instance.read = (bio, out_buf) => bio.data.read_impl (bio, out_buf);
+        _handler_based_bio_method_instance.write = (bio, buf) => bio.data.write_impl (bio, buf);
+        _handler_based_bio_method_instance.ctrl = (bio, cmd, num, ptr) => bio.data.ctrl_impl (bio, cmd, num, ptr);
+        return _handler_based_bio_method_instance;
+    }
+}
+
+
+
+}
\ No newline at end of file
diff --git a/libdino/src/crypto/openssl/omemo.c b/libdino/src/crypto/openssl/omemo.c
new file mode 100644
index 00000000..0912c172
--- /dev/null
+++ b/libdino/src/crypto/openssl/omemo.c
@@ -0,0 +1,313 @@
+#include "../omemo/helper.h"
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+
+int signal_vala_random_generator(uint8_t *data, size_t len, void *user_data) {
+    return RAND_bytes(data, len) == 1 ? SG_SUCCESS : SG_ERR_UNKNOWN;
+}
+
+struct SIGNAL_VALA_HMAC_CTX {
+    EVP_PKEY *pkey;
+    EVP_MD_CTX *ctx;
+};
+
+int signal_vala_hmac_sha256_init(void **hmac_context, const uint8_t *key, size_t key_len, void *user_data) {
+    EVP_PKEY *pkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL, key, key_len);
+    if (!pkey) {
+        return SG_ERR_NOMEM;
+    }
+    EVP_MD_CTX *ctx = EVP_MD_CTX_new();
+    if (!ctx) {
+        EVP_PKEY_free(pkey);
+        return SG_ERR_NOMEM;
+    }
+    if (EVP_DigestSignInit(ctx, NULL, EVP_sha256(), NULL, pkey) != 1) {
+        EVP_MD_CTX_free(ctx);
+        EVP_PKEY_free(pkey);
+        return SG_ERR_UNKNOWN;
+    }
+
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = malloc(sizeof(*hmac_ctx));
+    hmac_ctx->pkey = pkey;
+    hmac_ctx->ctx = ctx;
+    *hmac_context = hmac_ctx;
+
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_update(void *hmac_context, const uint8_t *data, size_t data_len, void *user_data) {
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = hmac_context;
+    if (EVP_DigestSignUpdate(hmac_ctx->ctx, data, data_len) != 1) {
+        return SG_ERR_UNKNOWN;
+    }
+    return SG_SUCCESS;
+}
+
+int signal_vala_hmac_sha256_final(void *hmac_context, signal_buffer **output, void *user_data) {
+    size_t len;
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = hmac_context;
+    if (EVP_DigestSignFinal(hmac_ctx->ctx, NULL, &len) != 1) {
+        return SG_ERR_UNKNOWN;
+    }
+    signal_buffer *output_buffer = signal_buffer_alloc(len);
+    if (!output_buffer) {
+        return SG_ERR_NOMEM;
+    }
+    size_t another_len = len;
+    if (EVP_DigestSignFinal(hmac_ctx->ctx, signal_buffer_data(output_buffer), &another_len) != 1) {
+        signal_buffer_free(output_buffer);
+        return SG_ERR_UNKNOWN;
+    }
+    if (another_len != len) {
+        signal_buffer_free(output_buffer);
+        return SG_ERR_UNKNOWN;
+    }
+    *output = output_buffer;
+    return SG_SUCCESS;
+}
+
+void signal_vala_hmac_sha256_cleanup(void *hmac_context, void *user_data) {
+    struct SIGNAL_VALA_HMAC_CTX *hmac_ctx = hmac_context;
+    if (hmac_ctx) {
+        EVP_MD_CTX_free(hmac_ctx->ctx);
+        EVP_PKEY_free(hmac_ctx->pkey);
+        free(hmac_ctx);
+    }
+}
+
+static const EVP_CIPHER *aes_cipher(int cipher, size_t key_len) {
+    switch (cipher) {
+        case SG_CIPHER_AES_CBC_PKCS5:
+            switch (key_len) {
+                case 16: return EVP_aes_128_cbc();
+                case 24: return EVP_aes_192_cbc();
+                case 32: return EVP_aes_256_cbc();
+            }
+            break;
+        case SG_CIPHER_AES_CTR_NOPADDING:
+            switch (key_len) {
+                case 16: return EVP_aes_128_ctr();
+                case 24: return EVP_aes_192_ctr();
+                case 32: return EVP_aes_256_ctr();
+            }
+            break;
+        case SG_CIPHER_AES_GCM_NOPADDING:
+            switch (key_len) {
+                case 16: return EVP_aes_128_gcm();
+                case 24: return EVP_aes_192_gcm();
+                case 32: return EVP_aes_256_gcm();
+            }
+            break;
+
+    }
+    return NULL;
+}
+
+int signal_vala_encrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *plaintext, size_t plaintext_len,
+        void *user_data) {
+    int result = 0;
+    uint8_t *out_buf = NULL;
+    const EVP_CIPHER *evp_cipher = aes_cipher(cipher, key_len);
+    if (!evp_cipher) {
+        // fprintf(stderr, "invalid AES mode or key size: %zu\n", key_len);
+        return SG_ERR_INVAL;
+    }
+    if (plaintext_len > INT_MAX - EVP_CIPHER_block_size(evp_cipher)) {
+        // fprintf(stderr, "invalid plaintext length: %zu\n", plaintext_len);
+        return SG_ERR_UNKNOWN;
+    }
+    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+    int buf_extra = 0;
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        // In GCM mode we use the last 16 bytes as auth tag
+        buf_extra += 16;
+
+        if (EVP_EncryptInit_ex(ctx, evp_cipher, NULL, NULL, NULL) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, NULL) != 1) {
+            // fprintf(stderr, "cannot set iv size\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_EncryptInit_ex(ctx, NULL, NULL, key, iv) != 1) {
+            // fprintf(stderr, "cannot set key/iv\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    } else {
+        // TODO: set ivlen?
+        if (EVP_EncryptInit_ex(ctx, evp_cipher, 0, key, iv) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    if (cipher == SG_CIPHER_AES_CTR_NOPADDING || cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_set_padding(ctx, 0) != 1) {
+            // fprintf(stderr, "cannot set padding\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    out_buf = malloc(plaintext_len + EVP_CIPHER_block_size(evp_cipher) + buf_extra);
+    if (!out_buf) {
+        // fprintf(stderr, "cannot allocate output buffer\n");
+        result = SG_ERR_NOMEM;
+        goto complete;
+    }
+
+    int out_len = 0;
+    if (EVP_EncryptUpdate(ctx, out_buf, &out_len, plaintext, plaintext_len) != 1) {
+        // fprintf(stderr, "cannot encrypt plaintext\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    int final_len = 0;
+    if (EVP_EncryptFinal_ex(ctx, out_buf + out_len, &final_len) != 1) {
+        // fprintf(stderr, "cannot finish encrypting plaintext\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, 16, out_buf + out_len + final_len) != 1) {
+            // fprintf(stderr, "cannot get tag\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    *output = signal_buffer_create(out_buf, out_len + final_len + buf_extra);
+
+complete:
+    EVP_CIPHER_CTX_free(ctx);
+    if (out_buf) {
+        free(out_buf);
+    }
+    return result;
+}
+
+int signal_vala_decrypt(signal_buffer **output,
+        int cipher,
+        const uint8_t *key, size_t key_len,
+        const uint8_t *iv, size_t iv_len,
+        const uint8_t *ciphertext, size_t ciphertext_len,
+        void *user_data) {
+    int result = 0;
+    uint8_t *out_buf = NULL;
+    const EVP_CIPHER *evp_cipher = aes_cipher(cipher, key_len);
+    if (!evp_cipher) {
+        // fprintf(stderr, "invalid AES mode or key size: %zu\n", key_len);
+        return SG_ERR_INVAL;
+    }
+    if (ciphertext_len > INT_MAX - EVP_CIPHER_block_size(evp_cipher)) {
+        // fprintf(stderr, "invalid ciphertext length: %zu\n", ciphertext_len);
+        return SG_ERR_UNKNOWN;
+    }
+
+    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        // In GCM mode we use the last 16 bytes as auth tag
+        ciphertext_len -= 16;
+
+        if (EVP_DecryptInit_ex(ctx, evp_cipher, NULL, NULL, NULL) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, NULL) != 1) {
+            // fprintf(stderr, "cannot set iv size\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+
+        if (EVP_DecryptInit_ex(ctx, NULL, NULL, key, iv) != 1) {
+            // fprintf(stderr, "cannot set key/iv\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    } else {
+        // TODO: set ivlen?
+        if (EVP_DecryptInit_ex(ctx, evp_cipher, 0, key, iv) != 1) {
+            // fprintf(stderr, "cannot initialize cipher\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    if (cipher == SG_CIPHER_AES_CTR_NOPADDING || cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_set_padding(ctx, 0) != 1) {
+            // fprintf(stderr, "cannot set padding\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    out_buf = malloc(ciphertext_len + EVP_CIPHER_block_size(evp_cipher));
+    if (!out_buf) {
+        // fprintf(stderr, "cannot allocate output buffer\n");
+        result = SG_ERR_NOMEM;
+        goto complete;
+    }
+
+    int out_len = 0;
+    if (EVP_DecryptUpdate(ctx, out_buf, &out_len, ciphertext, ciphertext_len) != 1) {
+        // fprintf(stderr, "cannot decrypt ciphertext\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    if (cipher == SG_CIPHER_AES_GCM_NOPADDING) {
+        if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, 16, (void *)(ciphertext + ciphertext_len)) != 1) {
+            // fprintf(stderr, "cannot set tag\n");
+            result = SG_ERR_UNKNOWN;
+            goto complete;
+        }
+    }
+
+    int final_len = 0;
+    if (EVP_DecryptFinal_ex(ctx, out_buf + out_len, &final_len) != 1) {
+        // fprintf(stderr, "cannot finish decrypting ciphertexts\n");
+        result = SG_ERR_UNKNOWN;
+        goto complete;
+    }
+
+    *output = signal_buffer_create(out_buf, out_len + final_len);
+
+complete:
+    EVP_CIPHER_CTX_free(ctx);
+    if (out_buf) {
+        free(out_buf);
+    }
+    return result;
+}
+
+void setup_signal_vala_crypto_provider(signal_context *context) {
+    signal_crypto_provider provider = {
+            .random_func = signal_vala_random_generator,
+            .hmac_sha256_init_func = signal_vala_hmac_sha256_init,
+            .hmac_sha256_update_func = signal_vala_hmac_sha256_update,
+            .hmac_sha256_final_func = signal_vala_hmac_sha256_final,
+            .hmac_sha256_cleanup_func = signal_vala_hmac_sha256_cleanup,
+            .encrypt_func = signal_vala_encrypt,
+            .decrypt_func = signal_vala_decrypt,
+            .user_data = 0
+    };
+
+    signal_context_set_crypto_provider(context, &provider);
+}
diff --git a/libdino/src/crypto/openssl/utils.c b/libdino/src/crypto/openssl/utils.c
new file mode 100644
index 00000000..1a84f642
--- /dev/null
+++ b/libdino/src/crypto/openssl/utils.c
@@ -0,0 +1,49 @@
+#include "utils.h"
+#include <openssl/opensslv.h>
+#include <openssl/ec.h>
+
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x30000000L
+// This is for OpenSSL 3.0.0 and newer
+
+EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) {
+    // Generate EVP_PKEY directly
+    EVP_PKEY *pkey = EVP_EC_gen (curve);
+    return pkey;
+}
+
+#else
+// This is for OpenSSL before 3.0.0 and forks of earlier OpenSSL versions like LibreSSL
+
+EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve) {
+    // Get NID from curve name
+    int nid = OBJ_sn2nid (curve);
+    if (nid == NID_undef) return NULL;
+
+    // Create EC_KEY
+    EC_KEY *ec_key = EC_KEY_new_by_curve_name (nid);
+    if (!ec_key) return NULL;
+
+    // Generate key
+    if (!EC_KEY_generate_key (ec_key)) {
+        EC_KEY_free (ec_key);
+        return NULL;
+    }
+
+    // Create EVP_PKEY
+    EVP_PKEY *pkey = EVP_PKEY_new ();
+    if (!pkey) {
+        EC_KEY_free (ec_key);
+        return NULL;
+    }
+
+    // Assign EC_KEY to EVP_PKEY
+    if (!EVP_PKEY_assign_EC_KEY (pkey, ec_key)) {
+        EC_KEY_free (ec_key);
+        return NULL;
+    }
+
+    // EVP_PKEY_assign_EC_KEY takes ownership of ec_key, no need to free it explicitly
+    return pkey;
+}
+
+#endif
diff --git a/libdino/src/crypto/openssl/utils.h b/libdino/src/crypto/openssl/utils.h
new file mode 100644
index 00000000..bcc6f53a
--- /dev/null
+++ b/libdino/src/crypto/openssl/utils.h
@@ -0,0 +1,8 @@
+#ifndef DINO_OPENSSL_UTILS_H
+#define DINO_OPENSSL_UTILS_H
+
+#include <openssl/evp.h>
+
+EVP_PKEY *EVP_PKEY_new_generate_ecdsa (const char* curve);
+
+#endif //DINO_OPENSSL_UTILS_H
\ No newline at end of file
diff --git a/libdino/src/crypto/openssl/utils.vala b/libdino/src/crypto/openssl/utils.vala
new file mode 100644
index 00000000..7a9ed9b6
--- /dev/null
+++ b/libdino/src/crypto/openssl/utils.vala
@@ -0,0 +1,19 @@
+namespace Dino.Crypto {
+
+public static void randomize(uint8[] buffer) {
+    OpenSSL.RAND.bytes(buffer);
+}
+
+internal void openssl_error() throws Error {
+    throw new Crypto.Error.OPENSSL(OpenSSL.ERR.reason_error_string(OpenSSL.ERR.get_error()));
+}
+
+public SymmetricCipherEncryption create_symmetric_cipher_encryption(string algo_name) throws Error {
+    return new SymmetricCipherEncryptionOpenssl(algo_name);
+}
+
+public SymmetricCipherDecryption create_symmetric_cipher_decryption(string algo_name) throws Error {
+    return new SymmetricCipherDecryptionOpenssl(algo_name);
+}
+
+}
diff --git a/libdino/src/crypto/srtp.vala b/libdino/src/crypto/srtp.vala
new file mode 100644
index 00000000..852dccdc
--- /dev/null
+++ b/libdino/src/crypto/srtp.vala
@@ -0,0 +1,122 @@
+using Srtp;
+
+namespace Dino.Crypto.Srtp {
+public const string AES_CM_128_HMAC_SHA1_80 = "AES_CM_128_HMAC_SHA1_80";
+public const string AES_CM_128_HMAC_SHA1_32 = "AES_CM_128_HMAC_SHA1_32";
+public const string F8_128_HMAC_SHA1_80 = "F8_128_HMAC_SHA1_80";
+
+public class Session {
+    public bool has_encrypt { get; private set; default = false; }
+    public bool has_decrypt { get; private set; default = false; }
+
+    private Context encrypt_context;
+    private Context decrypt_context;
+
+    static construct {
+        init();
+        install_log_handler(log);
+    }
+
+    private static void log(LogLevel level, string msg) {
+        print(@"SRTP[$level]: $msg\n");
+    }
+
+    public Session() {
+        Context.create(out encrypt_context, null);
+        Context.create(out decrypt_context, null);
+    }
+
+    public uint8[] encrypt_rtp(uint8[] data) throws Error {
+        uint8[] buf = new uint8[data.length + MAX_TRAILER_LEN];
+        Memory.copy(buf, data, data.length);
+        int buf_use = data.length;
+        ErrorStatus res = encrypt_context.protect(buf, ref buf_use);
+        if (res != ErrorStatus.ok) {
+            throw new Error.UNKNOWN(@"SRTP encrypt failed: $res");
+        }
+        buf.length = buf_use;
+        return buf;
+    }
+
+    public uint8[] decrypt_rtp(uint8[] data) throws Error {
+        uint8[] buf = new uint8[data.length];
+        Memory.copy(buf, data, data.length);
+        int buf_use = data.length;
+        ErrorStatus res = decrypt_context.unprotect(buf, ref buf_use);
+        switch (res) {
+            case ErrorStatus.auth_fail:
+                throw new Error.AUTHENTICATION_FAILED("SRTP packet failed the message authentication check");
+            case ErrorStatus.ok:
+                break;
+            default:
+                throw new Error.UNKNOWN(@"SRTP decrypt failed: $res");
+        }
+        uint8[] ret = new uint8[buf_use];
+        GLib.Memory.copy(ret, buf, buf_use);
+        return ret;
+    }
+
+    public uint8[] encrypt_rtcp(uint8[] data) throws Error {
+        uint8[] buf = new uint8[data.length + MAX_TRAILER_LEN + 4];
+        Memory.copy(buf, data, data.length);
+        int buf_use = data.length;
+        ErrorStatus res = encrypt_context.protect_rtcp(buf, ref buf_use);
+        if (res != ErrorStatus.ok) {
+            throw new Error.UNKNOWN(@"SRTCP encrypt failed: $res");
+        }
+        buf.length = buf_use;
+        return buf;
+    }
+
+    public uint8[] decrypt_rtcp(uint8[] data) throws Error {
+        uint8[] buf = new uint8[data.length];
+        Memory.copy(buf, data, data.length);
+        int buf_use = data.length;
+        ErrorStatus res = decrypt_context.unprotect_rtcp(buf, ref buf_use);
+        switch (res) {
+            case ErrorStatus.auth_fail:
+                throw new Error.AUTHENTICATION_FAILED("SRTCP packet failed the message authentication check");
+            case ErrorStatus.ok:
+                break;
+            default:
+                throw new Error.UNKNOWN(@"SRTCP decrypt failed: $res");
+        }
+        uint8[] ret = new uint8[buf_use];
+        GLib.Memory.copy(ret, buf, buf_use);
+        return ret;
+    }
+
+    private Policy create_policy(string profile) {
+        Policy policy = Policy();
+        switch (profile) {
+            case AES_CM_128_HMAC_SHA1_80:
+                policy.rtp.set_aes_cm_128_hmac_sha1_80();
+                policy.rtcp.set_aes_cm_128_hmac_sha1_80();
+                break;
+        }
+        return policy;
+    }
+
+    public void set_encryption_key(string profile, uint8[] key, uint8[] salt) {
+        Policy policy = create_policy(profile);
+        policy.ssrc.type = SsrcType.any_outbound;
+        policy.key = new uint8[key.length + salt.length];
+        Memory.copy(policy.key, key, key.length);
+        Memory.copy(((uint8*)policy.key) + key.length, salt, salt.length);
+        policy.next = null;
+        encrypt_context.add_stream(ref policy);
+        has_encrypt = true;
+    }
+
+    public void set_decryption_key(string profile, uint8[] key, uint8[] salt) {
+        Policy policy = create_policy(profile);
+        policy.ssrc.type = SsrcType.any_inbound;
+        policy.key = new uint8[key.length + salt.length];
+        Memory.copy(policy.key, key, key.length);
+        Memory.copy(((uint8*)policy.key) + key.length, salt, salt.length);
+        policy.next = null;
+        decrypt_context.add_stream(ref policy);
+        has_decrypt = true;
+    }
+}
+}
\ No newline at end of file
diff --git a/libdino/src/entity/conversation.vala b/libdino/src/entity/conversation.vala
index e6991973..3853389c 100644
--- a/libdino/src/entity/conversation.vala
+++ b/libdino/src/entity/conversation.vala
@@ -34,7 +34,7 @@ public class Conversation : Object {
         }
     }
     public Encryption encryption { get; set; default = Encryption.UNKNOWN; }
-    public Message? read_up_to { get; set; }
+    public int read_up_to_message_id { get; set; default=-1; }
     public int read_up_to_item { get; set; default=-1; }
 
     public enum NotifySetting { DEFAULT, ON, OFF, HIGHLIGHT }
@@ -69,9 +69,12 @@ public class Conversation : Object {
         int64? last_active = row[db.conversation.last_active];
         if (last_active != null) this.last_active = new DateTime.from_unix_utc(last_active);
         encryption = (Encryption) row[db.conversation.encryption];
-        int? read_up_to = row[db.conversation.read_up_to];
-        if (read_up_to != null) this.read_up_to = db.get_message_by_id(read_up_to);
-        read_up_to_item = row[db.conversation.read_up_to_item];
+        if (!db.conversation.read_up_to.is_null(row)) {
+            read_up_to_message_id = row[db.conversation.read_up_to];
+        }
+        if (!db.conversation.read_up_to_item.is_null(row)) {
+            read_up_to_item = row[db.conversation.read_up_to_item];
+        }
         notify_setting = (NotifySetting) row[db.conversation.notification];
         send_typing = (Setting) row[db.conversation.send_typing];
         send_marker = (Setting) row[db.conversation.send_marker];
@@ -95,8 +98,8 @@ public class Conversation : Object {
                 .value(db.conversation.send_typing, send_typing)
                 .value(db.conversation.send_marker, send_marker)
                 .value(db.conversation.pinned, pinned);
-        if (read_up_to != null) {
-            insert.value(db.conversation.read_up_to, read_up_to.id);
+        if (read_up_to_message_id != -1) {
+            insert.value(db.conversation.read_up_to, read_up_to_message_id);
         }
         if (read_up_to_item != -1) {
             insert.value(db.conversation.read_up_to_item, read_up_to_item);
@@ -175,20 +178,10 @@ public class Conversation : Object {
                 update.set(db.conversation.type_, type_); break;
             case "encryption":
                 update.set(db.conversation.encryption, encryption); break;
-            case "read-up-to":
-                if (read_up_to != null) {
-                    update.set(db.conversation.read_up_to, read_up_to.id);
-                } else {
-                    update.set_null(db.conversation.read_up_to);
-                }
-                break;
+            case "read-up-to-message-id":
+                update.set(db.conversation.read_up_to, read_up_to_message_id); break;
             case "read-up-to-item":
-                if (read_up_to_item != -1) {
-                    update.set(db.conversation.read_up_to_item, read_up_to_item);
-                } else {
-                    update.set_null(db.conversation.read_up_to_item);
-                }
-                break;
+                update.set(db.conversation.read_up_to_item, read_up_to_item); break;
             case "nickname":
                 update.set(db.conversation.resource, nickname); break;
             case "active":
diff --git a/libdino/src/entity/file_transfer_group.vala b/libdino/src/entity/file_transfer_group.vala
new file mode 100644
index 00000000..94b9ccb6
--- /dev/null
+++ b/libdino/src/entity/file_transfer_group.vala
@@ -0,0 +1,53 @@
+using Xmpp;
+
+namespace Dino.Entities {
+
+    public class FileTransferGroup : Object {
+        public Gee.ArrayList<FileTransfer> file_transfers = new Gee.ArrayList<FileTransfer>();
+
+        public int id { get; set; default=-1; }
+        public int message_id { get; set; default=-1; }
+
+        private Database? db;
+
+        public FileTransferGroup.from_row(Database db, Qlite.Row row, Gee.ArrayList<FileTransfer> file_transfers) throws InvalidJidError {
+            this.db = db;
+            this.file_transfers = file_transfers;
+
+            id = row[db.file_transfer_group.id];
+            message_id = row[db.file_transfer_group.message_id];
+
+            notify.connect(on_update);
+        }
+
+        public void persist(Database db) {
+            if (id != -1) return;
+
+            this.db = db;
+
+            id = (int) db.file_transfer_group.insert()
+                    .value(db.file_transfer_group.message_id, message_id)
+                    .perform();
+
+
+            Qlite.InsertBuilder builder = db.file_transfer_group_file_transfer.insert();
+            foreach (FileTransfer file_transfer in file_transfers) {
+                db.file_transfer_group_file_transfer.insert()
+                        .value(db.file_transfer_group_file_transfer.file_transfer_group_id, id)
+                        .value(db.file_transfer_group_file_transfer.file_transfer_id, file_transfer.id)
+                        .perform();
+            }
+
+            notify.connect(on_update);
+        }
+
+        private void on_update(Object o, ParamSpec sp) {
+            Qlite.UpdateBuilder update_builder = db.file_transfer_group.update().with(db.file_transfer_group.id, "=", id);
+            switch (sp.name) {
+                case "message-id":
+                    update_builder.set(db.file_transfer_group.message_id, message_id); break;
+            }
+            update_builder.perform();
+        }
+    }
+}
\ No newline at end of file
diff --git a/libdino/src/file_transfer/file_manager2.vala b/libdino/src/file_transfer/file_manager2.vala
new file mode 100644
index 00000000..104a170e
--- /dev/null
+++ b/libdino/src/file_transfer/file_manager2.vala
@@ -0,0 +1,252 @@
+using Gdk;
+using Gee;
+
+using Xmpp;
+using Xmpp.Xep;
+using Dino.Entities;
+
+namespace Dino {
+
+    public class FileManager2 : StreamInteractionModule, Object {
+        public static ModuleIdentity<FileManager2> IDENTITY = new ModuleIdentity<FileManager2>("file2");
+        public string id { get { return IDENTITY.id; } }
+
+        public signal void received_file(FileTransfer file_group, Conversation conversation);
+        public signal void received_file_group(FileTransferGroup file_group, Conversation conversation);
+
+        private StreamInteractor stream_interactor;
+        private Database db;
+
+        public const int HTTP_PROVIDER_ID = 0;
+        public const int SFS_PROVIDER_ID = 2;
+
+        public StatelessFileSharing sfs {
+            owned get { return stream_interactor.get_module(StatelessFileSharing.IDENTITY); }
+            private set {}
+        }
+
+        public FileManager fm {
+            owned get { return stream_interactor.get_module(FileManager.IDENTITY); }
+            private set {}
+        }
+
+        public HttpFileTransfers http_ft = null;
+
+        public static void start(StreamInteractor stream_interactor, Database db) {
+            FileManager2 m = new FileManager2(stream_interactor, db);
+            stream_interactor.add_module(m);
+        }
+
+        public static string get_storage_dir() {
+            return Path.build_filename(Dino.get_storage_dir(), "files");
+        }
+
+        private FileManager2(StreamInteractor stream_interactor, Database db) {
+            this.stream_interactor = stream_interactor;
+            this.db = db;
+            this.http_ft = new HttpFileTransfers(stream_interactor, db);
+
+            stream_interactor.get_module(MessageProcessor.IDENTITY).received_pipeline.connect(new ReceivedMessageListener(this));
+        }
+
+        public async void send_files(Gee.List<File> files, Conversation conversation) {
+            bool can_reference_element = conversation.type_ == Conversation.Type.CHAT || (
+                // The stable stanza ID XEP is not clear about an announcing MUC having to attach stanza-ids, thus we also check for MAM, which requires this.
+                stream_interactor.get_module(EntityInfo.IDENTITY).has_feature_cached(conversation.account, conversation.counterpart, Xep.UniqueStableStanzaIDs.NS_URI) &&
+                stream_interactor.get_module(EntityInfo.IDENTITY).has_feature_cached(conversation.account, conversation.counterpart, Xmpp.MessageArchiveManagement.NS_URI)
+            );
+
+            // Share unencrypted files via SFS (only if we'll be able to reference messages)
+            if (conversation.encryption == Encryption.NONE && can_reference_element) {
+                yield send_unencrypted_sfs(files, conversation);
+            } else {
+                foreach (File file in files) {
+                    fm.send_file(file, conversation);
+                }
+            }
+        }
+
+//        private async void send_file(File file, Conversation conversation) {
+//            FileTransfer file_transfer = yield create_init_outgoing_file_transfer(file, conversation);
+//            received_file(file_transfer, conversation);
+//
+//            try {
+//                string file_name = file_transfer.file_name;
+//                int64 file_size = file_transfer.size;
+//                FileContentType? file_content_type = file_transfer.content_type;
+//                print(@"$(file_name) $(file_size) $(file_content_type.get_mime_type())\n");
+//
+//                Omemo.OmemoHttpFileMeta? encrypted_file_meta = null;
+//
+//                if (conversation.encryption == Encryption.OMEMO) {
+//                    encrypted_file_meta = omemo_file_encryption.encrypt_file(conversation, file_transfer);
+////                    file_name = encrypted_file_meta.file_name;
+//                    file_size = encrypted_file_meta.size;
+//                    file_content_type = encrypted_file_meta.content_type;
+//                }
+//                HttpFileSlot? upload_slot = yield http_ft.request_upload_slot(conversation.account, file_name, file_size, file_content_type);
+//                yield http_ft.upload(file_transfer, upload_slot.url_up, upload_slot.headers, file_size);
+//
+//                string url_down = upload_slot.url_down;
+//
+//                if (conversation.encryption == Encryption.OMEMO) {
+//                    url_down = omemo_file_encryption.generate_aesgcm_url(upload_slot.url_down, encrypted_file_meta.iv, encrypted_file_meta.key);
+//                }
+//
+//                // Update current upload progress in the FileTransfer
+//                LimitInputStream? limit_stream = file_transfer.input_stream as LimitInputStream;
+//                if (limit_stream == null) {
+//                    limit_stream = new LimitInputStream(file_transfer.input_stream, file_size);
+//                    file_transfer.input_stream = limit_stream;
+//                }
+//                if (limit_stream != null) {
+//                    limit_stream.bind_property("retrieved-bytes", file_transfer, "transferred-bytes", BindingFlags.SYNC_CREATE);
+//                }
+//
+//                file_transfer.state = FileTransfer.State.IN_PROGRESS;
+//
+//                http_ft.send_http_file_message(conversation, file_transfer, url_down, true); // TODO true
+//
+//                file_transfer.state = FileTransfer.State.COMPLETE;
+//            } catch (Error e) {
+//                warning("Send file error: %s", e.message);
+//                file_transfer.state = FileTransfer.State.FAILED;
+//            }
+//        }
+
+        private async void send_unencrypted_sfs(Gee.List<File> files, Conversation conversation) {
+            FileTransferGroup file_transfer_group = new FileTransferGroup();
+            foreach (var file in files) {
+                var file_transfer = yield create_init_outgoing_file_transfer(file, conversation);
+                file_transfer_group.file_transfers.add(file_transfer);
+            }
+
+            stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file_group(file_transfer_group);
+            received_file_group(file_transfer_group, conversation);
+
+            // TODO message-id not known here -> not cached by it
+            var sfs_message = yield sfs.announce_files(file_transfer_group, conversation);
+
+            foreach (var file_transfer in file_transfer_group.file_transfers) {
+                upload_unencrypted_sfs_file.begin(file_transfer, conversation, sfs_message);
+            }
+        }
+
+        private async void upload_unencrypted_sfs_file(FileTransfer file_transfer, Conversation conversation, Message sfs_message) {
+            var upload_slot_data = yield http_ft.request_upload_slot(conversation.account, file_transfer.server_file_name, file_transfer.size, file_transfer.content_type);
+
+            // Upload file
+            yield http_ft.upload(file_transfer, upload_slot_data.url_up, upload_slot_data.headers, file_transfer.size);
+
+            // Wait until we know the server id of the file share message (in MUCs; we get that from the reflected message)
+            if (conversation.type_.is_muc_semantic()) {
+                if (sfs_message.server_id == null) {
+                    ulong server_id_notify_id = sfs_message.notify["server-id"].connect(() => {
+                        Idle.add(upload_unencrypted_sfs_file.callback);
+                    });
+                    yield;
+                    sfs_message.disconnect(server_id_notify_id);
+                }
+            }
+
+            file_transfer.sfs_sources.add(new Xep.StatelessFileSharing.HttpSource() { url=upload_slot_data.url_down } );
+
+            string attach_to_id = stream_interactor.get_module(MessageStorage.IDENTITY).get_reference_id(sfs_message, conversation);
+            sfs.attach_source(file_transfer, conversation, upload_slot_data.url_down, attach_to_id);
+        }
+
+        private async FileTransfer? create_init_outgoing_file_transfer(File file, Conversation conversation) {
+            FileTransfer file_transfer = yield create_outgoing_file_transfer(file, conversation);
+
+            try {
+                file_transfer.input_stream = yield file.read_async();
+                yield save_file(file_transfer);
+
+                stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file(file_transfer);
+                conversation.last_active = file_transfer.time;
+
+                return file_transfer;
+            } catch (Error e) {
+                file_transfer.state = FileTransfer.State.FAILED;
+                warning("Error saving outgoing file: %s", e.message);
+                return null;
+            }
+        }
+
+        private async FileTransfer create_outgoing_file_transfer(File file, Conversation conversation) {
+            FileTransfer file_transfer = new FileTransfer();
+            file_transfer.account = conversation.account;
+            file_transfer.counterpart = conversation.counterpart;
+            if (conversation.type_.is_muc_semantic()) {
+                file_transfer.ourpart = stream_interactor.get_module(MucManager.IDENTITY).get_own_jid(conversation.counterpart, conversation.account) ?? conversation.account.bare_jid;
+            } else {
+                file_transfer.ourpart = conversation.account.full_jid;
+            }
+            file_transfer.direction = FileTransfer.DIRECTION_SENT;
+            file_transfer.time = new DateTime.now_utc();
+            file_transfer.local_time = new DateTime.now_utc();
+            file_transfer.encryption = conversation.encryption;
+
+            Xep.FileMetadataElement.FileMetadata metadata = new Xep.FileMetadataElement.FileMetadata();
+            foreach (FileMetadataProvider file_metadata_provider in fm.file_metadata_providers) {
+                if (file_metadata_provider.supports_file(file)) {
+                    yield file_metadata_provider.fill_metadata(file, metadata);
+                }
+            }
+            file_transfer.file_metadata = metadata;
+            return file_transfer;
+        }
+
+        public async void save_file(FileTransfer file_transfer) throws FileSendError {
+            try {
+                string filename = Random.next_int().to_string("%x") + "_" + file_transfer.file_name;
+                File file = File.new_for_path(Path.build_filename(get_storage_dir(), filename));
+                OutputStream os = file.create(FileCreateFlags.REPLACE_DESTINATION);
+                yield os.splice_async(file_transfer.input_stream, OutputStreamSpliceFlags.CLOSE_SOURCE | OutputStreamSpliceFlags.CLOSE_TARGET);
+                file_transfer.state = FileTransfer.State.COMPLETE;
+                file_transfer.path = filename;
+                file_transfer.input_stream = new LimitInputStream(yield file.read_async(), file_transfer.size);
+            } catch (Error e) {
+                throw new FileSendError.SAVE_FAILED("Saving file error: %s".printf(e.message));
+            }
+        }
+
+        public bool is_sender_trustworthy(FileTransfer file_transfer, Conversation conversation) {
+            if (file_transfer.direction == FileTransfer.DIRECTION_SENT) return true;
+
+            Jid relevant_jid = conversation.counterpart;
+            if (conversation.type_ == Conversation.Type.GROUPCHAT) {
+                relevant_jid = stream_interactor.get_module(MucManager.IDENTITY).get_real_jid(file_transfer.from, conversation.account);
+            }
+            if (relevant_jid == null) return false;
+
+            bool in_roster = stream_interactor.get_module(RosterManager.IDENTITY).get_roster_item(conversation.account, relevant_jid) != null;
+            return in_roster;
+        }
+
+        private class ReceivedMessageListener : MessageListener {
+
+            public string[] after_actions_const = new string[]{ "STORE" };
+            public override string action_group { get { return "MESSAGE_REINTERPRETING"; } }
+            public override string[] after_actions { get { return after_actions_const; } }
+
+            private FileManager2 outer;
+            private StreamInteractor stream_interactor;
+
+            public ReceivedMessageListener(FileManager2 outer) {
+                this.outer = outer;
+                this.stream_interactor = outer.stream_interactor;
+            }
+
+            public override async bool run(Entities.Message message, Xmpp.MessageStanza stanza, Conversation conversation) {
+                bool is_sfs = yield outer.sfs.try_process_sfs(message, stanza, conversation);
+                if (is_sfs) return true;
+
+                bool is_http = outer.http_ft.try_parse_http_transfer(message, stanza, conversation);
+                if (is_http) return true;
+
+                return false;
+            }
+        }
+    }
+}
\ No newline at end of file
diff --git a/libdino/src/file_transfer/http_transfer.vala b/libdino/src/file_transfer/http_transfer.vala
new file mode 100644
index 00000000..ec97dfb3
--- /dev/null
+++ b/libdino/src/file_transfer/http_transfer.vala
@@ -0,0 +1,319 @@
+using Gee;
+
+using Dino.Entities;
+using Xmpp;
+
+namespace Dino {
+
+    public class HttpFileSlot : FileSendData {
+        public string url_down { get; set; }
+        public string url_up { get; set; }
+        public HashMap<string, string> headers { get; set; }
+    }
+
+    public class HttpFileTransfers : Object {
+
+        private StreamInteractor stream_interactor;
+        private Dino.Database dino_db;
+        private Soup.Session session;
+        private HttpFileProvider http_file_provider;
+        private HttpFileSender http_file_sender;
+        public static Regex http_url_regex = /^https?:\/\/([^\s#]*)$/; // Spaces are invalid in URLs and we can't use fragments for downloads
+        public static Regex omemo_url_regex = /^aesgcm:\/\/(.*)#(([A-Fa-f0-9]{2}){48}|([A-Fa-f0-9]{2}){44})$/;
+        public HashMap<Account, long> max_file_sizes = new HashMap<Account, long>(Account.hash_func, Account.equals_func);
+
+        public FileManager fm {
+            owned get { return stream_interactor.get_module(FileManager.IDENTITY); }
+            private set {}
+        }
+
+        public HttpFileTransfers(StreamInteractor stream_interactor, Dino.Database dino_db) {
+            this.stream_interactor = stream_interactor;
+            this.dino_db = dino_db;
+            this.session = new Soup.Session();
+            this.http_file_provider = new HttpFileProvider(this, stream_interactor);
+            this.http_file_sender = new HttpFileSender(stream_interactor, this);
+            fm.add_provider(http_file_provider);
+            fm.add_sender(http_file_sender);
+
+            session.user_agent = @"Dino/$(Dino.get_short_version()) ";
+
+            stream_interactor.stream_negotiated.connect(on_stream_negotiated);
+        }
+
+        public HttpFileReceiveData? get_file_receive_data(FileTransfer file_transfer) {
+            if (file_transfer.provider == FileManager.SFS_PROVIDER_ID) {
+                if (!file_transfer.sfs_sources.is_empty) {
+                    var http_source = file_transfer.sfs_sources.get(0) as Xep.StatelessFileSharing.HttpSource;
+                    if (http_source != null) {
+                        var receive_data = new HttpFileReceiveData();
+                        receive_data.url = http_source.url;
+                        return receive_data;
+                    }
+                }
+                return null;
+            }
+
+            Conversation? conversation = stream_interactor.get_module(ConversationManager.IDENTITY).get_conversation(file_transfer.counterpart.bare_jid, file_transfer.account);
+            if (conversation == null) return null;
+
+            Message? message = stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_id(int.parse(file_transfer.info), conversation);
+            if (message == null) return null;
+
+            var receive_data = new HttpFileReceiveData();
+            receive_data.url = message.body;
+
+            return receive_data;
+        }
+
+        public async InputStream download(FileTransfer file_transfer, HttpFileReceiveData receive_data, int64 file_size = -1) throws IOError {
+            var get_message = new Soup.Message("GET", receive_data.url);
+
+            string transfer_host = Uri.parse(receive_data.url, UriFlags.NONE).get_host();
+            get_message.accept_certificate.connect((peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(transfer_host, peer_cert, errors); });
+            InputStream stream = yield session.send_async(get_message, GLib.Priority.LOW, file_transfer.cancellable);
+
+            if (file_size != -1) {
+                return new LimitInputStream(stream, file_size);
+            } else {
+                return stream;
+            }
+        }
+
+        public bool try_parse_http_transfer(Entities.Message message, Xmpp.MessageStanza stanza, Conversation conversation) {
+            string? oob_url = Xmpp.Xep.OutOfBandData.get_url_from_message(stanza);
+            bool normal_file = oob_url != null && oob_url == message.body && HttpFileTransfers.http_url_regex.match(message.body);
+            bool omemo_file = HttpFileTransfers.omemo_url_regex.match(message.body);
+            if (normal_file || omemo_file) {
+                http_file_provider.on_file_message(message, conversation);
+                return true;
+            }
+            return false;
+        }
+
+        public async HttpFileSlot? request_upload_slot(Account account, string file_name, int64 file_size, FileContentType file_content_type) throws FileSendError {
+            HttpFileSlot upload_slot = new HttpFileSlot();
+            if (upload_slot == null) return null;
+
+            Xmpp.XmppStream? stream = stream_interactor.get_stream(account);
+            if (stream == null) return null;
+
+            try {
+                var slot_result = yield stream_interactor.module_manager.get_module(account, Xmpp.Xep.HttpFileUpload.Module.IDENTITY).request_slot(stream, file_name, file_size, file_content_type);
+                upload_slot.url_down = slot_result.url_get;
+                upload_slot.url_up = slot_result.url_put;
+                upload_slot.headers = slot_result.headers;
+            } catch (Xep.HttpFileUpload.HttpFileTransferError e) {
+                throw new FileSendError.UPLOAD_FAILED("Http file upload XMPP error: %s".printf(e.message));
+            }
+
+            return upload_slot;
+        }
+
+        public async void upload(FileTransfer file_transfer, string upload_url, HashMap<string, string> header_fields, int64 upload_size) throws FileSendError {
+            Xmpp.XmppStream? stream = stream_interactor.get_stream(file_transfer.account);
+            if (stream == null) return;
+
+            var put_message = new Soup.Message("PUT", upload_url);
+
+            string transfer_host = Uri.parse(upload_url, UriFlags.NONE).get_host();
+            put_message.accept_certificate.connect((peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(transfer_host, peer_cert, errors); });
+            put_message.set_request_body(file_transfer.content_type.get_mime_type(), file_transfer.input_stream, (ssize_t) upload_size);
+
+            foreach (var entry in header_fields) {
+                put_message.request_headers.append(entry.key, entry.value);
+            }
+            try {
+                yield session.send_async(put_message, GLib.Priority.LOW, file_transfer.cancellable);
+
+                if (put_message.status_code < 200 || put_message.status_code >= 300) {
+                    throw new FileSendError.UPLOAD_FAILED("HTTP status code %s".printf(put_message.status_code.to_string()));
+                }
+            } catch (Error e) {
+                throw new FileSendError.UPLOAD_FAILED("HTTP upload error: %s".printf(e.message));
+            }
+        }
+
+        /** @param use_conversation_encryption With OpenPGP, the file on the server is encrypted and the file transfer is safe even if the message is not encrypted.
+         *                                     With OMEMO, the decryption key is part of the message, thus it has to be encrypted.
+         */
+        public void send_http_file_message(Conversation conversation, FileTransfer file_transfer, string download_url, bool use_conversation_encryption = true) {
+            Entities.Message message = stream_interactor.get_module(MessageProcessor.IDENTITY).create_out_message(download_url, conversation);
+            file_transfer.info = message.id.to_string();
+
+            message.encryption = use_conversation_encryption ? conversation.encryption : Encryption.NONE;
+            stream_interactor.get_module(MessageProcessor.IDENTITY).send_xmpp_message(message, conversation);
+        }
+
+        public async FileMeta request_meta_data(FileTransfer file_transfer, FileReceiveData receive_data, FileMeta file_meta) throws FileReceiveError {
+            HttpFileReceiveData? http_receive_data = receive_data as HttpFileReceiveData;
+            if (http_receive_data == null) return file_meta;
+
+            var head_message = new Soup.Message("HEAD", http_receive_data.url);
+            head_message.request_headers.append("Accept-Encoding", "identity");
+            string transfer_host = Uri.parse(http_receive_data.url, UriFlags.NONE).get_host();
+            head_message.accept_certificate.connect((peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(transfer_host, peer_cert, errors); });
+
+            try {
+                yield session.send_async(head_message, GLib.Priority.LOW, null);
+            } catch (Error e) {
+                throw new FileReceiveError.GET_METADATA_FAILED("HEAD request failed");
+            }
+
+            string? content_type = null, content_length = null;
+            head_message.response_headers.foreach((name, val) => {
+                if (name.down() == "content-type") content_type = val;
+                if (name.down() == "content-length") content_length = val;
+            });
+            file_meta.content_type = new FileContentType.from_mime_type(content_type);
+            if (content_length != null) {
+                file_meta.size = int64.parse(content_length);
+            }
+
+            return file_meta;
+        }
+
+        private void on_stream_negotiated(Account account, XmppStream stream) {
+            stream_interactor.module_manager.get_module(account, Xmpp.Xep.HttpFileUpload.Module.IDENTITY).feature_available.connect((stream, max_file_size) => {
+                max_file_sizes[account] = max_file_size;
+                http_file_sender.upload_available(account);
+            });
+        }
+
+        public string extract_file_name_from_url(string url) {
+            string ret = url;
+            if (ret.contains("#")) {
+                ret = ret.substring(0, ret.last_index_of("#"));
+            }
+            ret = Uri.unescape_string(ret.substring(ret.last_index_of("/") + 1));
+            return ret;
+        }
+    }
+
+    public class HttpFileProvider : Dino.FileProvider, Object {
+
+        private HttpFileTransfers http_ft;
+        private StreamInteractor stream_interactor;
+
+        public HttpFileProvider(HttpFileTransfers http_ft, StreamInteractor stream_interactor) {
+            this.http_ft = http_ft;
+            this.stream_interactor = stream_interactor;
+        }
+
+        public async FileMeta get_meta_info(FileTransfer file_transfer, FileReceiveData receive_data, FileMeta file_meta) throws FileReceiveError {
+            return yield http_ft.request_meta_data(file_transfer, receive_data, file_meta);
+        }
+
+        public Encryption get_encryption(FileTransfer file_transfer, FileReceiveData receive_data, FileMeta file_meta) {
+            return Encryption.NONE;
+        }
+
+        public async InputStream download(FileTransfer file_transfer, FileReceiveData receive_data, FileMeta file_meta) throws IOError {
+            return yield http_ft.download(file_transfer, (HttpFileReceiveData)receive_data, file_transfer.size);
+        }
+
+        public FileMeta get_file_meta(FileTransfer file_transfer) throws FileReceiveError {
+            if (file_transfer.provider == FileManager.SFS_PROVIDER_ID) {
+                var file_meta = new HttpFileMeta();
+                file_meta.size = file_transfer.size;
+                file_meta.content_type = file_transfer.content_type;
+                file_meta.file_name = file_transfer.file_name;
+                file_meta.message = null;
+                return file_meta;
+            }
+
+            Conversation? conversation = stream_interactor.get_module(ConversationManager.IDENTITY).get_conversation(file_transfer.counterpart.bare_jid, file_transfer.account);
+            if (conversation == null) throw new FileReceiveError.GET_METADATA_FAILED("No conversation");
+
+            Message? message = stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_id(int.parse(file_transfer.info), conversation);
+            if (message == null) throw new FileReceiveError.GET_METADATA_FAILED("No message");
+
+            var file_meta = new HttpFileMeta();
+            file_meta.size = file_transfer.size;
+            file_meta.content_type = file_transfer.content_type;
+
+            file_meta.file_name = http_ft.extract_file_name_from_url(message.body);
+
+            file_meta.message = message;
+
+            return file_meta;
+        }
+
+        public FileReceiveData? get_file_receive_data(FileTransfer file_transfer) {
+            return  http_ft.get_file_receive_data(file_transfer);
+        }
+
+        public int get_id() { return 0; }
+
+        public void on_file_message(Entities.Message message, Conversation conversation) {
+            var additional_info = message.id.to_string();
+
+            var receive_data = new HttpFileReceiveData();
+            receive_data.url = message.body;
+
+            var file_meta = new HttpFileMeta();
+            file_meta.file_name = http_ft.extract_file_name_from_url(message.body);
+            file_meta.message = message;
+
+            file_incoming(additional_info, message.from, message.time, message.local_time, conversation, receive_data, file_meta);
+        }
+    }
+
+    public class HttpFileSender : FileSender, Object {
+        private StreamInteractor stream_interactor;
+        private HttpFileTransfers http_ft;
+
+        public HttpFileSender(StreamInteractor stream_interactor, HttpFileTransfers http_ft) {
+            this.http_ft = http_ft;
+        }
+
+        public async FileSendData? prepare_send_file(Conversation conversation, FileTransfer file_transfer, FileMeta file_meta) throws FileSendError {
+            HttpFileSendData send_data = new HttpFileSendData();
+            if (send_data == null) return null;
+
+            try {
+                var slot_result = yield http_ft.request_upload_slot(conversation.account, file_transfer.server_file_name, file_meta.size, file_transfer.content_type);
+                send_data.url_down = slot_result.url_down;
+                send_data.url_up = slot_result.url_up;
+                send_data.headers = slot_result.headers;
+            } catch (Xep.HttpFileUpload.HttpFileTransferError e) {
+                throw new FileSendError.UPLOAD_FAILED("Http file upload XMPP error: %s".printf(e.message));
+            }
+
+            return send_data;
+        }
+
+        public async void send_file(Conversation conversation, FileTransfer file_transfer, FileSendData file_send_data, FileMeta file_meta) throws FileSendError {
+            HttpFileSendData http_file_send_data = file_send_data as HttpFileSendData;
+            yield http_ft.upload(file_transfer, http_file_send_data.url_up, http_file_send_data.headers, file_meta.size);
+
+            http_ft.send_http_file_message(conversation, file_transfer, http_file_send_data.url_down, true);
+        }
+
+        public async bool can_send(Conversation conversation, FileTransfer file_transfer) {
+            if (!http_ft.max_file_sizes.has_key(conversation.account)) return false;
+
+            return file_transfer.size < http_ft.max_file_sizes[conversation.account];
+        }
+
+        public async long get_file_size_limit(Conversation conversation) {
+            long? max_size = http_ft.max_file_sizes[conversation.account];
+            if (max_size != null) {
+                return max_size;
+            }
+            return -1;
+        }
+
+        public async bool can_encrypt(Conversation conversation, FileTransfer file_transfer) {
+            return false;
+        }
+
+        public async bool is_upload_available(Conversation conversation) {
+            return http_ft.max_file_sizes.has_key(conversation.account);
+        }
+
+        public int get_id() { return 0; }
+
+        public float get_priority() { return 100; }
+    }
+}
diff --git a/libdino/src/plugin/loader.vala b/libdino/src/plugin/loader.vala
index 8b0d93ad..dc93ee1e 100644
--- a/libdino/src/plugin/loader.vala
+++ b/libdino/src/plugin/loader.vala
@@ -81,6 +81,10 @@ public class Loader : Object {
         Info info = new Plugins.Info(type, (owned) module);
         infos += info;
 
+        return load_type(type);
+    }
+
+    public RootInterface load_type(Type type) {
         RootInterface plugin = (RootInterface) Object.new (type);
         plugins += plugin;
         plugin.registered(app);
diff --git a/libdino/src/qlite/column.vala b/libdino/src/qlite/column.vala
new file mode 100644
index 00000000..8f45307f
--- /dev/null
+++ b/libdino/src/qlite/column.vala
@@ -0,0 +1,190 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public abstract class Column<T> {
+    public const string DEFAULT_TABLE_NAME = "";
+
+    public string name { get; private set; }
+    public string? default { get; set; }
+    public int sqlite_type { get; private set; }
+    public bool primary_key { get; set; }
+    public bool auto_increment { get; set; }
+    public bool unique { get; set; }
+    public virtual bool not_null { get; set; }
+    public long min_version { get; set; default = -1; }
+    public long max_version { get; set; default = long.MAX; }
+    internal Table table { get; set; }
+
+    public abstract T get(Row row, string? table_name = DEFAULT_TABLE_NAME);
+
+    public virtual bool is_null(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+        return false;
+    }
+
+    internal abstract void bind(Statement stmt, int index, T value);
+
+    public string to_string() {
+        return table == null ? name : (table.name + "." + name);
+    }
+
+    public string to_column_definition() {
+        string res = name;
+        switch (sqlite_type) {
+            case INTEGER:
+                res += " INTEGER";
+                break;
+            case FLOAT:
+                res += " REAL";
+                break;
+            case TEXT:
+                res += " TEXT";
+                break;
+            default:
+                res += " UNKNOWN";
+                break;
+        }
+        if (primary_key) {
+            res += " PRIMARY KEY";
+            if (auto_increment) res += " AUTOINCREMENT";
+        }
+        if (not_null) res += " NOT NULL";
+        if (unique) res += " UNIQUE";
+        if (default != null) res += @" DEFAULT $((!) default)";
+
+        return res;
+    }
+
+    Column(string name, int type) {
+        this.name = name;
+        this.sqlite_type = type;
+    }
+
+    public class Integer : Column<int> {
+        public Integer(string name) {
+            base(name, INTEGER);
+        }
+
+        public override int get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return (int) row.get_integer(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        public override bool is_null(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return !row.has_integer(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        internal override void bind(Statement stmt, int index, int value) {
+            stmt.bind_int(index, value);
+        }
+    }
+
+    public class Long : Column<long> {
+        public Long(string name) {
+            base(name, INTEGER);
+        }
+
+        public override long get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return (long) row.get_integer(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        public override bool is_null(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return !row.has_integer(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        internal override void bind(Statement stmt, int index, long value) {
+            stmt.bind_int64(index, value);
+        }
+    }
+
+    public class NullableReal : Column<double?> {
+        public NullableReal(string name) {
+            base(name, FLOAT);
+        }
+
+        public override bool not_null { get { return false; } set {} }
+
+        public override double? get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return row.get_real(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        public override bool is_null(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return !row.has_real(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        internal override void bind(Statement stmt, int index, double? value) {
+            stmt.bind_double(index, value);
+        }
+    }
+
+    public class Text : Column<string?> {
+        public Text(string name) {
+            base(name, TEXT);
+        }
+
+        public override string? get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return row.get_text(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        public override bool is_null(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return get(row, table_name == DEFAULT_TABLE_NAME ? table.name : table_name) == null;
+        }
+
+        internal override void bind(Statement stmt, int index, string? value) {
+            if (value != null) {
+                stmt.bind_text(index, (!) value);
+            } else {
+                stmt.bind_null(index);
+            }
+        }
+    }
+
+    public class NonNullText : Column<string> {
+        public NonNullText(string name) {
+            base(name, TEXT);
+        }
+
+        public override bool not_null { get { return true; } set {} }
+
+        public override string get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return (!)row.get_text(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name);
+        }
+
+        public override bool is_null(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return false;
+        }
+
+        internal override void bind(Statement stmt, int index, string value) {
+            stmt.bind_text(index, (!) value);
+        }
+    }
+
+    public class BoolText : Column<bool> {
+        public BoolText(string name) {
+            base(name, TEXT);
+        }
+
+        public override bool get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return row.get_text(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name) == "1";
+        }
+
+        internal override void bind(Statement stmt, int index, bool value) {
+            stmt.bind_text(index, value ? "1" : "0");
+        }
+    }
+
+    public class BoolInt : Column<bool> {
+        public BoolInt(string name) {
+            base(name, INTEGER);
+        }
+
+        public override bool get(Row row, string? table_name = DEFAULT_TABLE_NAME) {
+            return row.get_integer(name, table_name == DEFAULT_TABLE_NAME ? table.name : table_name) == 1;
+        }
+
+        internal override void bind(Statement stmt, int index, bool value) {
+            stmt.bind_int(index, value ? 1 : 0);
+        }
+    }
+}
+
+}
diff --git a/libdino/src/qlite/database.vala b/libdino/src/qlite/database.vala
new file mode 100644
index 00000000..e55d5b59
--- /dev/null
+++ b/libdino/src/qlite/database.vala
@@ -0,0 +1,163 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class Database {
+    private string file_name;
+    private Sqlite.Database db;
+    private long expected_version;
+    private Table[]? tables;
+
+    private Column<string?> meta_name = new Column.Text("name") { primary_key = true };
+    private Column<long> meta_int_val = new Column.Long("int_val");
+    private Column<string?> meta_text_val = new Column.Text("text_val");
+    private Table meta_table;
+
+    public bool debug = false;
+
+    public Database(string file_name, long expected_version) {
+        this.file_name = file_name;
+        this.expected_version = expected_version;
+        meta_table = new Table(this, "_meta");
+        meta_table.init({meta_name, meta_int_val, meta_text_val});
+    }
+
+    public void init(Table[] tables) {
+        Sqlite.config(Config.SERIALIZED);
+        int ec = Sqlite.Database.open_v2(file_name, out db, OPEN_READWRITE | OPEN_CREATE | 0x00010000);
+        if (ec != Sqlite.OK) {
+            error(@"SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+        this.tables = tables;
+        if (debug) db.trace((message) => print(@"Qlite trace: $message\n"));
+        start_migration();
+    }
+
+    public void ensure_init() {
+        if (tables == null) error(@"Database $file_name was not initialized, call init()");
+    }
+
+    private void start_migration() {
+        try {
+            exec("BEGIN TRANSACTION");
+        } catch (Error e) {
+            error("SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+        meta_table.create_table_at_version(expected_version);
+        long old_version = 0;
+        old_version = meta_table.row_with(meta_name, "version")[meta_int_val, -1];
+        if (old_version == -1) {
+            foreach (Table t in tables) {
+                t.create_table_at_version(expected_version);
+            }
+            meta_table.insert().value(meta_name, "version").value(meta_int_val, expected_version).perform();
+        } else if (expected_version != old_version) {
+            foreach (Table t in tables) {
+                t.create_table_at_version(old_version);
+            }
+            foreach (Table t in tables) {
+                t.add_columns_for_version(old_version, expected_version);
+            }
+            migrate(old_version);
+            foreach (Table t in tables) {
+                t.delete_columns_for_version(old_version, expected_version);
+            }
+            if (old_version == -1) {
+                meta_table.insert().value(meta_name, "version").value(meta_int_val, expected_version).perform();
+            } else {
+                meta_table.update().with(meta_name, "=", "version").set(meta_int_val, expected_version).perform();
+            }
+        }
+        foreach (Table t in tables) {
+            t.post();
+        }
+        try {
+            exec("END TRANSACTION");
+        } catch (Error e) {
+            error("SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+    }
+
+    internal int errcode() {
+        return db.errcode();
+    }
+
+    internal string errmsg() {
+        return db.errmsg();
+    }
+
+    internal int64 last_insert_rowid() {
+        return db.last_insert_rowid();
+    }
+
+    // To be implemented by actual implementation if required
+    // new table columns are added, outdated columns are still present and will be removed afterwards
+    public virtual void migrate(long old_version) {
+    }
+
+    public QueryBuilder select(Column[]? columns = null) {
+        ensure_init();
+        return new QueryBuilder(this).select(columns);
+    }
+
+    internal MatchQueryBuilder match_query(Table table) {
+        ensure_init();
+        return new MatchQueryBuilder(this, table);
+    }
+
+    public InsertBuilder insert() {
+        ensure_init();
+        return new InsertBuilder(this);
+    }
+
+    public UpdateBuilder update(Table table) {
+        ensure_init();
+        return new UpdateBuilder(this, table);
+    }
+
+    public UpsertBuilder upsert(Table table) {
+        ensure_init();
+        return new UpsertBuilder(this, table);
+    }
+
+    public UpdateBuilder update_named(string table) {
+        ensure_init();
+        return new UpdateBuilder.for_name(this, table);
+    }
+
+    public DeleteBuilder delete() {
+        ensure_init();
+        return new DeleteBuilder(this);
+    }
+
+    public RowIterator query_sql(string sql, string[]? args = null) {
+        ensure_init();
+        return new RowIterator(this, sql, args);
+    }
+
+    internal Statement prepare(string sql) {
+        ensure_init();
+        Sqlite.Statement statement;
+        if (db.prepare_v2(sql, sql.length, out statement) != OK) {
+            error("SQLite error: %d - %s: %s", db.errcode(), db.errmsg(), sql);
+        }
+        return statement;
+    }
+
+    public void exec(string sql) throws Error {
+        ensure_init();
+        if (db.exec(sql) != OK) {
+            throw new Error(-1, 0, "SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+    }
+
+    public bool is_known_column(string table, string field) {
+        ensure_init();
+        foreach (Table t in tables) {
+            if (t.is_known_column(field)) return true;
+        }
+        return false;
+    }
+}
+
+}
diff --git a/libdino/src/qlite/delete_builder.vala b/libdino/src/qlite/delete_builder.vala
new file mode 100644
index 00000000..df63bba6
--- /dev/null
+++ b/libdino/src/qlite/delete_builder.vala
@@ -0,0 +1,62 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class DeleteBuilder : StatementBuilder {
+
+    // DELETE FROM [...]
+    private Table? table;
+    private string table_name;
+
+    // WHERE [...]
+    private string selection = "1";
+    private StatementBuilder.AbstractField[] selection_args = {};
+
+    internal DeleteBuilder(Database db) {
+        base(db);
+    }
+
+    public DeleteBuilder from(Table table) {
+        if (this.table != null) error("Qlite Error: ILLEGAL QUERY: cannot use from() multiple times.");
+        this.table = table;
+        this.table_name = table.name;
+        return this;
+    }
+
+    public DeleteBuilder from_name(string table) {
+        this.table_name = table;
+        return this;
+    }
+
+    public DeleteBuilder where(string selection, string[]? selection_args = null) {
+        if (this.selection != "1") error("selection was already done, but where() was called.");
+        this.selection = selection;
+        foreach (string arg in selection_args) {
+            this.selection_args += new StatementBuilder.StringField(arg);
+        }
+        return this;
+    }
+
+    public DeleteBuilder with<T>(Column<T> column, string comp, T value) {
+        selection_args += new Field<T>(column, value);
+        selection = @"($selection) AND $(column.name) $comp ?";
+        return this;
+    }
+
+    internal override Statement prepare() {
+        Statement stmt = db.prepare(@"DELETE FROM $table_name WHERE $selection");
+        for (int i = 0; i < selection_args.length; i++) {
+            selection_args[i].bind(stmt, i+1);
+        }
+        return stmt;
+    }
+
+    public void perform() {
+        if (prepare().step() != DONE) {
+            critical(@"SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+    }
+
+}
+
+}
diff --git a/libdino/src/qlite/insert_builder.vala b/libdino/src/qlite/insert_builder.vala
new file mode 100644
index 00000000..3383f0e2
--- /dev/null
+++ b/libdino/src/qlite/insert_builder.vala
@@ -0,0 +1,84 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class InsertBuilder : StatementBuilder {
+
+    // INSERT [OR ...]
+    private bool replace_val;
+    private string? or_val;
+
+    // INTO [...]
+    private Table table;
+    private string table_name;
+
+    // VALUES [...]
+    private StatementBuilder.AbstractField[] fields = {};
+
+    internal InsertBuilder(Database db) {
+        base(db);
+    }
+
+    public InsertBuilder replace() {
+        this.replace_val = true;
+        return this;
+    }
+
+    public InsertBuilder or(string or) {
+        this.or_val = or;
+        return this;
+    }
+
+    public InsertBuilder into(Table table) {
+        this.table = table;
+        this.table_name = table.name;
+        return this;
+    }
+
+    public InsertBuilder into_name(string table) {
+        this.table_name = table;
+        return this;
+    }
+
+    public InsertBuilder value<T>(Column<T> column, T value) {
+        fields += new Field<T>(column, value);
+        return this;
+    }
+
+    public InsertBuilder value_null<T>(Column<T> column) {
+        if (column.not_null) error("Qlite Error: ILLEGAL QUERY: Can't set non-null column %s to null", column.name);
+        fields += new NullField<T>(column);
+        return this;
+    }
+
+    internal override Statement prepare() {
+        string fields_text = "";
+        string value_qs = "";
+        for (int i = 0; i < fields.length; i++) {
+            if (i != 0) {
+                value_qs += ", ";
+                fields_text += ", ";
+            }
+            fields_text += ((!)fields[i].column).name;
+            value_qs += "?";
+        }
+        string sql = replace_val ? "REPLACE" : "INSERT";
+        if (!replace_val && or_val != null) sql += @" OR $((!)or_val)";
+        sql += @" INTO $table_name ( $fields_text ) VALUES ($value_qs)";
+        Statement stmt = db.prepare(sql);
+        for (int i = 0; i < fields.length; i++) {
+            fields[i].bind(stmt, i+1);
+        }
+        return stmt;
+    }
+
+    public int64 perform() {
+        if (prepare().step() != DONE) {
+            critical(@"SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+        return db.last_insert_rowid();
+    }
+
+}
+
+}
diff --git a/libdino/src/qlite/query_builder.vala b/libdino/src/qlite/query_builder.vala
new file mode 100644
index 00000000..40514fd5
--- /dev/null
+++ b/libdino/src/qlite/query_builder.vala
@@ -0,0 +1,238 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class QueryBuilder : StatementBuilder {
+    private bool single_result;
+
+    // SELECT [...]
+    private string column_selector = "*";
+    private Column[] columns = {};
+
+    // FROM [...]
+    protected Table? table;
+    protected string? table_name;
+
+    // JOIN [...]
+    private string joins = "";
+
+    // WHERE [...]
+    protected string selection = "1";
+    internal StatementBuilder.AbstractField[] selection_args = {};
+
+    // ORDER BY [...]
+    private OrderingTerm[]? order_by_terms = {};
+
+    // GROUP BY [...]
+    private string? group_by_term;
+
+    // LIMIT [...] OFFSET [...]
+    private int limit_val;
+    private int offset_val;
+
+    internal QueryBuilder(Database db) {
+        base(db);
+    }
+
+    public QueryBuilder select(Column[] columns = {}) {
+        this.columns = columns;
+        if (columns.length != 0) {
+            for (int i = 0; i < columns.length; i++) {
+                if (column_selector == "*") {
+                    column_selector = columns[i].to_string();
+                } else {
+                    column_selector += ", " + columns[i].to_string();
+                }
+            }
+        } else {
+            column_selector = "*";
+        }
+        return this;
+    }
+
+    public QueryBuilder select_string(string column_selector) {
+        this.columns = {};
+        this.column_selector = column_selector;
+        return this;
+    }
+
+    public virtual QueryBuilder from(Table table) {
+        if (this.table_name != null) error("cannot use from() multiple times.");
+        this.table = table;
+        this.table_name = table.name;
+        return this;
+    }
+
+    public virtual QueryBuilder from_name(string table) {
+        this.table_name = table;
+        return this;
+    }
+
+    public QueryBuilder outer_join_with<T>(Table table, Column<T> lhs, Column<T> rhs, string? as = null) {
+        return outer_join_on(table, @"$lhs = $rhs", as);
+    }
+
+    public QueryBuilder outer_join_on(Table table, string on, string? as = null) {
+        if (as == null) as = table.name;
+        joins += @" LEFT OUTER JOIN $(table.name) AS $as ON $on";
+        return this;
+    }
+
+    public QueryBuilder join_with<T>(Table table, Column<T> lhs, Column<T> rhs, string? as = null) {
+        return join_on(table, @"$lhs = $rhs", as);
+    }
+
+    public QueryBuilder join_on(Table table, string on, string? as = null) {
+        if (as == null) as = table.name;
+        joins += @" JOIN $(table.name) AS $as ON $on";
+        return this;
+    }
+
+    internal QueryBuilder join_name(string table_name, string on) {
+        joins += @" JOIN $table_name ON $on";
+        return this;
+    }
+
+    public QueryBuilder where(string selection, string[] selection_args = {}) {
+        this.selection = @"($(this.selection)) AND ($selection)";
+        foreach (string arg in selection_args) {
+            this.selection_args += new StatementBuilder.StringField(arg);
+        }
+        return this;
+    }
+
+    public QueryBuilder with<T>(Column<T> column, string comp, T value) {
+        if ((column.unique || column.primary_key) && comp == "=") single_result = true;
+        selection_args += new Field<T>(column, value);
+        selection = @"($selection) AND $column $comp ?";
+        return this;
+    }
+
+    public QueryBuilder with_null<T>(Column<T> column) {
+        selection = @"($selection) AND $column ISNULL";
+        return this;
+    }
+
+    public QueryBuilder without_null<T>(Column<T> column) {
+        selection = @"($selection) AND $column NOT NULL";
+        return this;
+    }
+
+    public QueryBuilder order_by(Column column, string dir = "ASC") {
+        order_by_terms += new OrderingTerm(column, dir);
+        return this;
+    }
+
+    public QueryBuilder order_by_name(string name, string dir) {
+        order_by_terms += new OrderingTerm.by_name(name, dir);
+        return this;
+    }
+
+    public QueryBuilder group_by(Column[] columns) {
+        foreach(Column col in columns) {
+            if (group_by_term == null) {
+                group_by_term = col.to_string();
+            } else {
+                group_by_term += @", $col";
+            }
+        }
+        return this;
+    }
+
+    public QueryBuilder limit(int limit) {
+        if (this.limit_val != 0 && limit > this.limit_val) error("tried to increase an existing limit");
+        this.limit_val = limit;
+        return this;
+    }
+
+    public QueryBuilder offset(int offset) {
+        if (this.limit_val == 0) error("limit required before offset");
+        this.offset_val = offset;
+        return this;
+    }
+
+    public QueryBuilder single() {
+        this.single_result = true;
+        return limit(1);
+    }
+
+    public int64 count() {
+        this.column_selector = @"COUNT($column_selector) AS count";
+        this.single_result = true;
+        return row().get_integer("count");
+    }
+
+    private Row? row_() {
+        if (!single_result) error("query is not suited to return a single row, but row() was called.");
+        return iterator().get_next();
+    }
+
+    public RowOption row() {
+        return new RowOption(row_());
+    }
+
+    public T get<T>(Column<T> field, T def = null) {
+        return row().get(field, def);
+    }
+
+    internal override Statement prepare() {
+        Statement stmt = db.prepare(@"SELECT $column_selector $(table_name == null ? "" : @"FROM $((!) table_name)") $joins WHERE $selection $(group_by_term == null ? "" : @"GROUP BY $group_by_term") $(OrderingTerm.all_to_string(order_by_terms)) $(limit_val > 0 ? @" LIMIT $limit_val OFFSET $offset_val" : "")");
+        for (int i = 0; i < selection_args.length; i++) {
+            selection_args[i].bind(stmt, i+1);
+        }
+        return stmt;
+    }
+
+    public RowIterator iterator() {
+        return new RowIterator.from_query_builder(db, this);
+    }
+
+    class OrderingTerm {
+        Column? column;
+        string column_name;
+        string dir;
+
+        public OrderingTerm(Column column, string dir) {
+            this.column = column;
+            this.column_name = column.to_string();
+            this.dir = dir;
+        }
+
+        public OrderingTerm.by_name(string column_name, string dir) {
+            this.column_name = column_name;
+            this.dir = dir;
+        }
+
+        public string to_string() {
+            return @"$column_name $dir";
+        }
+
+        public static string all_to_string(OrderingTerm[]? terms) {
+            if (terms == null || terms.length == 0) return "";
+            string res = "ORDER BY "+terms[0].to_string();
+            for (int i = 1; i < terms.length; i++) {
+                res += @", $(terms[i])";
+            }
+            return res;
+        }
+    }
+}
+
+public class MatchQueryBuilder : QueryBuilder {
+    internal MatchQueryBuilder(Database db, Table table) {
+        base(db);
+        if (table.fts_columns == null) error("MATCH query on non FTS table");
+        from(table);
+        join_name(@"_fts_$table_name", @"_fts_$table_name.docid = $table_name.rowid");
+    }
+
+    public MatchQueryBuilder match(Column<string> column, string match) {
+        if (table == null) error("MATCH must occur after FROM statement");
+        if (!(column in table.fts_columns)) error("MATCH selection on non FTS column");
+        selection_args += new StatementBuilder.StringField(match);
+        selection = @"($selection) AND _fts_$table_name.$(column.name) MATCH ?";
+        return this;
+    }
+}
+
+}
diff --git a/libdino/src/qlite/row.vala b/libdino/src/qlite/row.vala
new file mode 100644
index 00000000..98fc902a
--- /dev/null
+++ b/libdino/src/qlite/row.vala
@@ -0,0 +1,148 @@
+using Gee;
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class Row {
+    private Map<string, string?> text_map = new HashMap<string, string?>();
+    private Map<string, long> int_map = new HashMap<string, long>();
+    private Map<string, double?> real_map = new HashMap<string, double?>();
+
+    internal Row(Statement stmt) {
+        for (int i = 0; i < stmt.column_count(); i++) {
+            string column_name;
+            string origin_name = stmt.column_origin_name(i);
+            if (origin_name != null) {
+                column_name = field_name(origin_name, stmt.column_table_name(i));
+            } else {
+                column_name = stmt.column_name(i);
+            }
+            switch(stmt.column_type(i)) {
+                case TEXT:
+                    text_map[column_name] = stmt.column_text(i);
+                    break;
+                case INTEGER:
+                    int_map[column_name] = (long) stmt.column_int64(i);
+                    break;
+                case FLOAT:
+                    real_map[column_name] = stmt.column_double(i);
+                    break;
+            }
+        }
+    }
+
+    public T get<T>(Column<T> field) {
+        return field[this];
+    }
+
+    private static string field_name(string field, string? table) {
+        if (table != null) {
+            return @"$table.$field";
+        } else {
+            return field;
+        }
+    }
+
+    public string? get_text(string field, string? table = null) {
+        if (text_map.has_key(field_name(field, table))) {
+            return text_map[field_name(field, table)];
+        }
+        return null;
+    }
+
+    public long get_integer(string field, string? table = null) {
+        return int_map[field_name(field, table)];
+    }
+
+    public bool has_integer(string field, string? table = null) {
+        return int_map.has_key(field_name(field, table));
+    }
+
+    public double get_real(string field, string? table = null, double def = 0) {
+        return real_map[field_name(field, table)] ?? def;
+    }
+
+    public bool has_real(string field, string? table = null) {
+        return real_map.has_key(field_name(field, table)) && real_map[field_name(field, table)] != null;
+    }
+
+    public string to_string() {
+        string ret = "{";
+
+        foreach (string key in text_map.keys) {
+            if (ret.length > 1) ret += ", ";
+            ret = @"$ret$key: \"$(text_map[key])\"";
+        }
+        foreach (string key in int_map.keys) {
+            if (ret.length > 1) ret += ", ";
+            ret = @"$ret$key: $(int_map[key])";
+        }
+        foreach (string key in real_map.keys) {
+            if (ret.length > 1) ret += ", ";
+            ret = @"$ret$key: $(real_map[key])";
+        }
+
+        return ret + "}";
+    }
+}
+
+public class RowIterator {
+    private Database db;
+    private Statement stmt;
+
+    public RowIterator.from_query_builder(Database db, QueryBuilder query) {
+        this.db = db;
+        this.stmt = query.prepare();
+    }
+
+    public RowIterator(Database db, string sql, string[]? args = null) {
+        this.db = db;
+        this.stmt = db.prepare(sql);
+        if (args != null) {
+            for (int i = 0; i < args.length; i++) {
+                stmt.bind_text(i, sql, sql.length);
+            }
+        }
+    }
+
+    public bool next() {
+        int r = stmt.step();
+        if (r == Sqlite.ROW) return true;
+        if (r == Sqlite.DONE) return false;
+        warning(@"SQLite error: $(db.errcode()) - $(db.errmsg())");
+        return false;
+    }
+
+    public Row get() {
+        return new Row(stmt);
+    }
+
+    public Row? get_next() {
+        if (next()) return get();
+        return null;
+    }
+}
+
+public class RowOption {
+    public Row? inner { get; private set; }
+
+    public RowOption(Row? row) {
+        this.inner = row;
+    }
+
+    public bool is_present() {
+        return inner != null;
+    }
+
+    public T get<T>(Column<T> field, T def = null) {
+        if (inner == null || field.is_null((!)inner)) return def;
+        return field[(!)inner];
+    }
+
+    internal long get_integer(string field, long def = 0) {
+        if (inner == null || !((!)inner).has_integer(field)) return def;
+        return ((!)inner).get_integer(field);
+    }
+}
+
+}
diff --git a/libdino/src/qlite/statement_builder.vala b/libdino/src/qlite/statement_builder.vala
new file mode 100644
index 00000000..5c756ab3
--- /dev/null
+++ b/libdino/src/qlite/statement_builder.vala
@@ -0,0 +1,58 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public abstract class StatementBuilder {
+    protected Database db;
+
+    internal StatementBuilder(Database db) {
+        this.db = db;
+    }
+
+    internal abstract Statement prepare();
+
+    internal abstract class AbstractField<T> {
+        public T value;
+        public Column<T>? column;
+
+        AbstractField(T value) {
+            this.value = value;
+        }
+
+        internal abstract void bind(Statement stmt, int index);
+    }
+
+    internal class Field<T> : AbstractField<T> {
+        public Field(Column<T> column, T value) {
+            base(value);
+            this.column = column;
+        }
+
+        internal override void bind(Statement stmt, int index) {
+            ((!)column).bind(stmt, index, value);
+        }
+    }
+
+    internal class NullField<T> : AbstractField<T> {
+        public NullField(Column<T> column) {
+            base(null);
+            this.column = column;
+        }
+
+        internal override void bind(Statement stmt, int index) {
+            stmt.bind_null(index);
+        }
+    }
+
+    internal class StringField : AbstractField<string> {
+        public StringField(string value) {
+            base(value);
+        }
+
+        internal override void bind(Statement stmt, int index) {
+            stmt.bind_text(index, value);
+        }
+    }
+}
+
+}
diff --git a/libdino/src/qlite/table.vala b/libdino/src/qlite/table.vala
new file mode 100644
index 00000000..3b75e22e
--- /dev/null
+++ b/libdino/src/qlite/table.vala
@@ -0,0 +1,218 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class Table {
+    protected Database db;
+    public string name { get; private set; }
+    protected Column[]? columns;
+    private string constraints = "";
+    private string[] post_statements = {};
+    private string[] create_statements = {};
+    internal Column[]? fts_columns;
+
+    public Table(Database db, string name) {
+        this.db = db;
+        this.name = name;
+    }
+
+    public void init(Column[] columns, string constraints = "") {
+        this.columns = columns;
+        this.constraints = constraints;
+
+        foreach(Column c in columns) {
+            c.table = this;
+        }
+    }
+
+    public void fts(Column[] columns) {
+        if (fts_columns != null) error("Only one FTS index may be used per table.");
+        fts_columns = columns;
+        string cs = "";
+        string cnames = "";
+        string cnews = "";
+        foreach (Column c in columns) {
+            cs += @", $(c.to_column_definition())";
+            cnames += @", $(c.name)";
+            cnews += @", new.$(c.name)";
+        }
+        add_create_statement(@"CREATE VIRTUAL TABLE IF NOT EXISTS _fts_$name USING fts4(tokenize=unicode61, content=\"$name\"$cs)");
+        add_post_statement(@"CREATE TRIGGER IF NOT EXISTS _fts_bu_$(name) BEFORE UPDATE ON $name BEGIN DELETE FROM _fts_$name WHERE docid=old.rowid; END");
+        add_post_statement(@"CREATE TRIGGER IF NOT EXISTS _fts_bd_$(name) BEFORE DELETE ON $name BEGIN DELETE FROM _fts_$name WHERE docid=old.rowid; END");
+        add_post_statement(@"CREATE TRIGGER IF NOT EXISTS _fts_au_$(name) AFTER UPDATE ON $name BEGIN INSERT INTO _fts_$name(docid$cnames) VALUES(new.rowid$cnews); END");
+        add_post_statement(@"CREATE TRIGGER IF NOT EXISTS _fts_ai_$(name) AFTER INSERT ON $name BEGIN INSERT INTO _fts_$name(docid$cnames) VALUES(new.rowid$cnews); END");
+    }
+
+    public void fts_rebuild() {
+        if (fts_columns == null) error("FTS not available on this table.");
+        try {
+            db.exec(@"INSERT INTO _fts_$name(_fts_$name) VALUES('rebuild');");
+        } catch (Error e) {
+            critical(@"Qlite Error: Rebuilding FTS index: $(e.message)");
+        }
+    }
+
+    public void unique(Column[] columns, string? on_conflict = null) {
+        constraints += ", UNIQUE (";
+        bool first = true;
+        foreach (Column c in columns) {
+            if (!first) constraints += ", ";
+            constraints += c.name;
+            first = false;
+        }
+        constraints += ")";
+        if (on_conflict != null) {
+            constraints += " ON CONFLICT " + (!)on_conflict;
+        }
+    }
+
+    public void add_post_statement(string stmt) {
+        post_statements += stmt;
+    }
+
+    public void add_create_statement(string stmt) {
+        create_statements += stmt;
+    }
+
+    public void index(string index_name, Column[] columns, bool unique = false) {
+        string stmt = @"CREATE $(unique ? "UNIQUE" : "") INDEX IF NOT EXISTS $index_name ON $name (";
+        bool first = true;
+        foreach (Column c in columns) {
+            if (!first) stmt += ", ";
+            stmt += c.name;
+            first = false;
+        }
+        stmt += ")";
+        add_post_statement(stmt);
+    }
+
+    private void ensure_init() {
+        if (columns == null) error("Table %s was not initialized, call init()", name);
+    }
+
+    public QueryBuilder select(Column[]? columns = null) {
+        ensure_init();
+        return db.select(columns).from(this);
+    }
+
+    private MatchQueryBuilder match_query() {
+        ensure_init();
+        return db.match_query(this);
+    }
+
+    public MatchQueryBuilder match(Column<string> column, string query) {
+        return match_query().match(column, query);
+    }
+
+    public InsertBuilder insert() {
+        ensure_init();
+        return db.insert().into(this);
+    }
+
+    public UpdateBuilder update() {
+        ensure_init();
+        return db.update(this);
+    }
+
+    public UpsertBuilder upsert() {
+        ensure_init();
+        return db.upsert(this);
+    }
+
+    public DeleteBuilder delete() {
+        ensure_init();
+        return db.delete().from(this);
+    }
+
+    public RowOption row_with<T>(Column<T> column, T value) {
+        ensure_init();
+        if (!column.unique && !column.primary_key) error("%s is not suited to identify a row, but used with row_with()", column.name);
+        return select().with(column, "=", value).row();
+    }
+
+    public bool is_known_column(string column) {
+        ensure_init();
+        foreach (Column c in columns) {
+            if (c.name == column) return true;
+        }
+        return false;
+    }
+
+    public void create_table_at_version(long version) {
+        ensure_init();
+        string sql = @"CREATE TABLE IF NOT EXISTS $name (";
+        bool first = true;
+        for (int i = 0; i < columns.length; i++) {
+            Column c = columns[i];
+            if (c.min_version <= version && c.max_version >= version) {
+                sql += @"$(!first ? "," : "") $(c.to_column_definition())";
+                first = false;
+            }
+        }
+        sql += @"$constraints)";
+        try {
+            db.exec(sql);
+        } catch (Error e) {
+            error(@"Qlite Error: Create table at version: $(e.message)");
+        }
+        foreach (string stmt in create_statements) {
+            try {
+                db.exec(stmt);
+            } catch (Error e) {
+                error(@"Qlite Error: Create table at version: $(e.message)");
+            }
+        }
+    }
+
+    public void add_columns_for_version(long old_version, long new_version) {
+        ensure_init();
+        foreach (Column c in columns) {
+            if (c.min_version <= new_version && c.max_version >= new_version && c.min_version > old_version) {
+                try {
+                    db.exec(@"ALTER TABLE $name ADD COLUMN $(c.to_column_definition())");
+                } catch (Error e) {
+                    critical(@"Qlite Error: Add columns for version: $(e.message)");
+                }
+            }
+        }
+    }
+
+    public void delete_columns_for_version(long old_version, long new_version) {
+        bool column_deletion_required = false;
+        string column_list = "";
+        foreach (Column c in columns) {
+            if (c.min_version <= new_version && c.max_version >= new_version) {
+                if (column_list == "") {
+                    column_list = c.name;
+                } else {
+                    column_list += ", " + c.name;
+                }
+            }
+            if (!(c.min_version <= new_version && c.max_version >= new_version) && c.min_version <= old_version && c.max_version >= old_version) {
+                column_deletion_required = true;
+            }
+        }
+        if (column_deletion_required) {
+            try {
+                db.exec(@"ALTER TABLE $name RENAME TO _$(name)_$old_version");
+                create_table_at_version(new_version);
+                db.exec(@"INSERT INTO $name ($column_list) SELECT $column_list FROM _$(name)_$old_version");
+                db.exec(@"DROP TABLE _$(name)_$old_version");
+            } catch (Error e) {
+                error(@"Qlite Error: Delete columns for version change: $(e.message)");
+            }
+        }
+    }
+
+    internal void post() {
+        foreach (string stmt in post_statements) {
+            try {
+                db.exec(stmt);
+            } catch (Error e) {
+                error(@"Qlite Error: Post: $(e.message)");
+            }
+        }
+    }
+}
+
+}
diff --git a/libdino/src/qlite/update_builder.vala b/libdino/src/qlite/update_builder.vala
new file mode 100644
index 00000000..d371a93a
--- /dev/null
+++ b/libdino/src/qlite/update_builder.vala
@@ -0,0 +1,103 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class UpdateBuilder : StatementBuilder {
+
+    // UPDATE [OR ...]
+    private string? or_val;
+
+    // [...]
+    private Table? table;
+    private string table_name;
+
+    // SET [...]
+    private StatementBuilder.AbstractField[] fields = {};
+
+    // WHERE [...]
+    private string selection = "1";
+    private StatementBuilder.AbstractField[] selection_args = {};
+
+    internal UpdateBuilder(Database db, Table table) {
+        base(db);
+        this.table = table;
+        this.table_name = table.name;
+    }
+
+    internal UpdateBuilder.for_name(Database db, string table) {
+        base(db);
+        this.table_name = table;
+    }
+
+    public UpdateBuilder or(string or) {
+        this.or_val = or;
+        return this;
+    }
+
+    public UpdateBuilder set<T>(Column<T> column, T value) {
+        fields += new Field<T>(column, value);
+        return this;
+    }
+
+    public UpdateBuilder set_null<T>(Column<T> column) {
+        if (column.not_null) error("Can't set non-null column %s to null", column.name);
+        fields += new NullField<T>(column);
+        return this;
+    }
+
+    public UpdateBuilder where(string selection, string[] selection_args = {}) {
+        if (this.selection != "1") error("selection was already done, but where() was called.");
+        this.selection = selection;
+        foreach (string arg in selection_args) {
+            this.selection_args += new StatementBuilder.StringField(arg);
+        }
+        return this;
+    }
+
+    public UpdateBuilder with<T>(Column<T> column, string comp, T value) {
+        selection_args += new Field<T>(column, value);
+        selection = @"($selection) AND $(column.name) $comp ?";
+        return this;
+    }
+
+    public UpdateBuilder with_null<T>(Column<T> column) {
+        selection = @"($selection) AND $(column.name) ISNULL";
+        return this;
+    }
+
+    public UpdateBuilder without_null<T>(Column<T> column) {
+        selection = @"($selection) AND $(column.name) NOT NULL";
+        return this;
+    }
+
+    internal override Statement prepare() {
+        string sql = "UPDATE";
+        if (or_val != null) sql += @" OR $((!)or_val)";
+        sql += @" $table_name SET ";
+        for (int i = 0; i < fields.length; i++) {
+            if (i != 0) {
+                sql += ", ";
+            }
+            sql += @"$(((!)fields[i].column).name) = ?";
+        }
+        sql += @" WHERE $selection";
+        Statement stmt = db.prepare(sql);
+        for (int i = 0; i < fields.length; i++) {
+            fields[i].bind(stmt, i+1);
+        }
+        for (int i = 0; i < selection_args.length; i++) {
+            selection_args[i].bind(stmt, i + fields.length + 1);
+        }
+        return stmt;
+    }
+
+    public void perform() {
+        if (fields.length == 0) return;
+        if (prepare().step() != DONE) {
+            critical("SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+    }
+
+}
+
+}
diff --git a/libdino/src/qlite/upsert_builder.vala b/libdino/src/qlite/upsert_builder.vala
new file mode 100644
index 00000000..e9a73e4f
--- /dev/null
+++ b/libdino/src/qlite/upsert_builder.vala
@@ -0,0 +1,93 @@
+using Sqlite;
+
+namespace Dino.Qlite {
+
+public class UpsertBuilder : StatementBuilder {
+    // INTO [...]
+    private Table table;
+    private string table_name;
+
+    // VALUES [...]
+    private StatementBuilder.AbstractField[] keys = {};
+    private StatementBuilder.AbstractField[] fields = {};
+
+    internal UpsertBuilder(Database db, Table table) {
+        base(db);
+        this.table = table;
+        this.table_name = table.name;
+    }
+
+    public UpsertBuilder value<T>(Column<T> column, T value, bool key = false) {
+        if (key) {
+            keys += new Field<T>(column, value);
+        } else {
+            fields += new Field<T>(column, value);
+        }
+        return this;
+    }
+
+    public UpsertBuilder value_null<T>(Column<T> column, bool key = false) {
+        if (column.not_null) error("Can't set non-null column %s to null", column.name);
+        if (key) {
+            keys += new NullField<T>(column);
+        } else {
+            fields += new NullField<T>(column);
+        }
+        return this;
+    }
+
+    internal override Statement prepare() {
+        error("prepare() not available for upsert.");
+    }
+
+    internal Statement prepare_upsert() {
+        var unique_fields = new StringBuilder();
+        var unique_values = new StringBuilder();
+        var update_fields = new StringBuilder();
+        var update_values = new StringBuilder();
+        var update_fields_vals = new StringBuilder();
+
+        for (int i = 0; i < keys.length; i++) {
+            if (i != 0) {
+                unique_fields.append(", ");
+                unique_values.append(", ");
+            }
+            unique_fields.append(keys[i].column.name);
+            unique_values.append("?");
+        }
+
+        for (int i = 0; i < fields.length; i++) {
+            if (i != 0) {
+                update_fields.append(", ");
+                update_values.append(", ");
+                update_fields_vals.append(", ");
+            }
+            update_fields.append(fields[i].column.name);
+            update_values.append("?");
+            update_fields_vals.append(fields[i].column.name).append("=excluded.").append(fields[i].column.name);
+        }
+
+        string sql = @"INSERT INTO $table_name ($(unique_fields.str), $(update_fields.str)) VALUES ($(unique_values.str), $(update_values.str)) " +
+                @"ON CONFLICT ($(unique_fields.str)) DO UPDATE SET $(update_fields_vals.str)";
+
+        Statement stmt = db.prepare(sql);
+        for (int i = 0; i < keys.length; i++) {
+            keys[i].bind(stmt, i + 1);
+        }
+        for (int i = 0; i < fields.length; i++) {
+            fields[i].bind(stmt, i + keys.length + 1);
+        }
+
+        return stmt;
+    }
+
+    public int64 perform() {
+        if (prepare_upsert().step() != DONE) {
+            critical(@"SQLite error: %d - %s", db.errcode(), db.errmsg());
+        }
+        return db.last_insert_rowid();
+    }
+
+}
+
+}
diff --git a/libdino/src/service/avatar_manager.vala b/libdino/src/service/avatar_manager.vala
index 0c98a8f3..d079b70d 100644
--- a/libdino/src/service/avatar_manager.vala
+++ b/libdino/src/service/avatar_manager.vala
@@ -1,9 +1,9 @@
 using Gdk;
 using Gee;
-using Qlite;
 
-using Xmpp;
 using Dino.Entities;
+using Dino.Qlite;
+using Xmpp;
 
 namespace Dino {
 
@@ -142,7 +142,7 @@ public class AvatarManager : StreamInteractionModule, Object {
     public void unset_avatar(Account account) {
         XmppStream stream = stream_interactor.get_stream(account);
         if (stream == null) return;
-        Xmpp.Xep.UserAvatars.unset_avatar(stream);
+        Xmpp.Xep.UserAvatars.unset_avatar(stream, get_avatar_hash(account, account.bare_jid));
     }
 
     private void on_account_added(Account account) {
@@ -157,19 +157,19 @@ public class AvatarManager : StreamInteractionModule, Object {
         );
 
         foreach (var entry in get_avatar_hashes(account, Source.USER_AVATARS).entries) {
-            on_user_avatar_received(account, entry.key, entry.value);
+            on_user_avatar_received(account, entry.key, entry.value, false);
         }
         foreach (var entry in get_avatar_hashes(account, Source.VCARD).entries) {
-            on_vcard_avatar_received(account, entry.key, entry.value);
+            on_vcard_avatar_received(account, entry.key, entry.value, false);
         }
     }
 
-    private void on_user_avatar_received(Account account, Jid jid_, string id) {
+    private void on_user_avatar_received(Account account, Jid jid_, string id, bool is_live = true) {
         Jid jid = jid_.bare_jid;
 
         if (!user_avatars.has_key(jid) || user_avatars[jid] != id) {
             user_avatars[jid] = id;
-            set_avatar_hash(account, jid, id, Source.USER_AVATARS);
+            if (is_live) set_avatar_hash(account, jid, id, Source.USER_AVATARS);
         }
         received_avatar(jid, account);
     }
@@ -181,13 +181,13 @@ public class AvatarManager : StreamInteractionModule, Object {
         received_avatar(jid, account);
     }
 
-    private void on_vcard_avatar_received(Account account, Jid jid_, string id) {
+    private void on_vcard_avatar_received(Account account, Jid jid_, string id, bool is_live = true) {
         bool is_gc = stream_interactor.get_module(MucManager.IDENTITY).might_be_groupchat(jid_.bare_jid, account);
         Jid jid = is_gc ? jid_ : jid_.bare_jid;
 
         if (!vcard_avatars.has_key(jid) || vcard_avatars[jid] != id) {
             vcard_avatars[jid] = id;
-            if (jid.is_bare()) { // don't save MUC occupant avatars
+            if (is_live && jid.is_bare()) { // don't save MUC occupant avatars
                 set_avatar_hash(account, jid, id, Source.VCARD);
             }
         }
diff --git a/libdino/src/service/call_store.vala b/libdino/src/service/call_store.vala
index bfc8255f..9e32517f 100644
--- a/libdino/src/service/call_store.vala
+++ b/libdino/src/service/call_store.vala
@@ -1,8 +1,8 @@
 using Xmpp;
 using Gee;
-using Qlite;
 
 using Dino.Entities;
+using Dino.Qlite;
 
 namespace Dino {
 
diff --git a/libdino/src/service/chat_interaction.vala b/libdino/src/service/chat_interaction.vala
index b3ec1b93..def9ea86 100644
--- a/libdino/src/service/chat_interaction.vala
+++ b/libdino/src/service/chat_interaction.vala
@@ -170,7 +170,7 @@ public class ChatInteraction : StreamInteractionModule, Object {
         if (conversation == null) return false;
         Entities.Message? message = stream_interactor.get_module(MessageStorage.IDENTITY).get_last_message(conversation);
         if (message == null || message.direction == Entities.Message.DIRECTION_SENT) return false;
-        if (message.equals(conversation.read_up_to)) return false;
+        if (message.id == conversation.read_up_to_message_id) return false;
 
         bool sent_marker = yield send_and_mark_message_displayed(conversation, message);
         return sent_marker;
@@ -242,7 +242,7 @@ public class ChatInteraction : StreamInteractionModule, Object {
         if (message.type_ == Message.Type.GROUPCHAT) return false;
         if (message.stanza_id == null) return false;
         if (message.direction == Entities.Message.DIRECTION_SENT) return false;
-        if (message.equals(conversation.read_up_to)) return false;
+        if (message.id == conversation.read_up_to_message_id) return false;
         if (conversation.get_send_marker_setting(stream_interactor) != Conversation.Setting.ON) return false;
 
         XmppStream? stream = stream_interactor.get_stream(conversation.account);
diff --git a/libdino/src/service/contact_model.vala b/libdino/src/service/contact_model.vala
index 33f6126b..3e52e040 100644
--- a/libdino/src/service/contact_model.vala
+++ b/libdino/src/service/contact_model.vala
@@ -1,6 +1,5 @@
 using Xmpp;
 using Gee;
-using Qlite;
 
 using Dino.Entities;
 
diff --git a/libdino/src/service/content_item_store.vala b/libdino/src/service/content_item_store.vala
index d74f9b05..5e440c76 100644
--- a/libdino/src/service/content_item_store.vala
+++ b/libdino/src/service/content_item_store.vala
@@ -1,7 +1,7 @@
 using Gee;
 
 using Dino.Entities;
-using Qlite;
+using Dino.Qlite;
 using Xmpp;
 
 namespace Dino {
@@ -26,6 +26,8 @@ public class ContentItemStore : StreamInteractionModule, Object {
         this.db = db;
 
         stream_interactor.get_module(FileManager.IDENTITY).received_file.connect(insert_file_transfer);
+        stream_interactor.get_module(FileManager2.IDENTITY).received_file.connect(insert_file_transfer);
+        stream_interactor.get_module(FileManager2.IDENTITY).received_file_group.connect(insert_file_group);
         stream_interactor.get_module(MessageProcessor.IDENTITY).message_received.connect(announce_message);
         stream_interactor.get_module(MessageProcessor.IDENTITY).message_sent.connect(announce_message);
         stream_interactor.get_module(Calls.IDENTITY).call_incoming.connect(insert_call);
@@ -88,6 +90,13 @@ public class ContentItemStore : StreamInteractionModule, Object {
                     return call_item;
                 }
                 break;
+            case 4:
+                FileTransferGroup? file_group = stream_interactor.get_module(FileTransferStorage.IDENTITY).get_file_group_by_id(foreign_id, conversation);
+                if (file_group != null) {
+                    var file_group_item = new FileGroupItem(file_group, conversation, id);
+                    return file_group_item;
+                }
+                break;
             default:
                 warning("Unknown content item type: %i", content_type);
                 break;
@@ -300,6 +309,16 @@ public class ContentItemStore : StreamInteractionModule, Object {
         new_item(item, conversation);
     }
 
+    private void insert_file_group(FileTransferGroup file_group, Conversation conversation) {
+        FileGroupItem item = new FileGroupItem(file_group, conversation, file_group.id);
+        // TODO fix local time
+        item.id = db.add_content_item(conversation, item.time, item.time, 4, file_group.id, false);
+        if (collection_conversations.has_key(conversation)) {
+            collection_conversations.get(conversation).insert_item(item);
+        }
+        new_item(item, conversation);
+    }
+
     private void insert_call(Call call, CallState call_state, Conversation conversation) {
         CallItem item = new CallItem(call, conversation, -1);
         item.id = db.add_content_item(conversation, call.time, call.local_time, 3, call.id, false);
@@ -415,6 +434,21 @@ public class FileItem : ContentItem {
     }
 }
 
+public class FileGroupItem : ContentItem {
+    public const string TYPE = "file_group";
+
+    public FileTransferGroup file_group;
+    public Conversation conversation;
+
+    public FileGroupItem(FileTransferGroup file_group, Conversation conversation, int id) {
+        var file_transfer = file_group.file_transfers.get(0);
+        base(id, TYPE, file_transfer.from, file_transfer.time, file_transfer.encryption, Message.Marked.NONE);
+
+        this.file_group = file_group;
+        this.conversation = conversation;
+    }
+}
+
 public class CallItem : ContentItem {
     public const string TYPE = "call";
 
diff --git a/libdino/src/service/counterpart_interaction_manager.vala b/libdino/src/service/counterpart_interaction_manager.vala
index f60cfb20..d6ca73a9 100644
--- a/libdino/src/service/counterpart_interaction_manager.vala
+++ b/libdino/src/service/counterpart_interaction_manager.vala
@@ -159,8 +159,13 @@ public class CounterpartInteractionManager : StreamInteractionModule, Object {
 
     public bool mark_displayed_up_to_message(Conversation conversation, Message message) {
         // Don't move read marker backwards because we get old info from another client
-        if (conversation.read_up_to != null && conversation.read_up_to.local_time.compare(message.local_time) > 0) return false;
-        conversation.read_up_to = message;
+        if (conversation.read_up_to_message_id != -1) {
+            Message read_up_to_message = stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_id(conversation.read_up_to_message_id, conversation);
+            if (read_up_to_message.local_time.compare(message.local_time) > 0) {
+                return false;
+            }
+        }
+        conversation.read_up_to_message_id = message.id;
 
         ContentItem? content_item = stream_interactor.get_module(ContentItemStore.IDENTITY).get_content_item_for_message(conversation, message);
         if (content_item == null) return true;
diff --git a/libdino/src/service/database.vala b/libdino/src/service/database.vala
index b38ccfca..30032e2c 100644
--- a/libdino/src/service/database.vala
+++ b/libdino/src/service/database.vala
@@ -1,13 +1,13 @@
 using Gee;
-using Qlite;
 using Xmpp;
 
 using Dino.Entities;
+using Dino.Qlite;
 
 namespace Dino {
 
 public class Database : Qlite.Database {
-    private const int VERSION = 33;
+    private const int VERSION = 35;
 
     public class AccountTable : Table {
         public Column<int> id = new Column.Integer("id") { primary_key = true, auto_increment = true };
@@ -49,6 +49,7 @@ public class Database : Qlite.Database {
             base(db, "entity");
             init({id, account_id, jid_id, resource, caps_hash, last_seen});
             unique({account_id, jid_id, resource}, "IGNORE");
+            index("entity_account_jid_resource_idx", {account_id, jid_id, resource});
         }
     }
 
@@ -225,6 +226,28 @@ public class Database : Qlite.Database {
         }
     }
 
+    public class FileTransferGroupTable : Table {
+        public Column<int> id = new Column.Integer("id") { primary_key = true, auto_increment = true };
+        public Column<int> message_id = new Column.Integer("message_id");
+
+        internal FileTransferGroupTable(Database db) {
+            base(db, "file_transfer_group");
+            init({id, message_id});
+            index("file_transfer_group_message_id_idx", {message_id});
+        }
+    }
+
+    public class FileTransferGroupFileTransferTable : Table {
+        public Column<int> file_transfer_group_id = new Column.Integer("file_transfer_group_id");
+        public Column<int> file_transfer_id = new Column.Integer("file_transfer_id");
+
+        internal FileTransferGroupFileTransferTable(Database db) {
+            base(db, "file_transfer_group_file_transfer");
+            init({file_transfer_group_id, file_transfer_id});
+            index("file_transfer_group_file_transfer_id_idx", {file_transfer_group_id});
+        }
+    }
+
     public class FileHashesTable : Table {
         public Column<int> id = new Column.Integer("id");
         public Column<string> algo = new Column.Text("algo") { not_null = true };
@@ -354,6 +377,7 @@ public class Database : Qlite.Database {
             init({entity, feature});
             unique({entity, feature}, "IGNORE");
             index("entity_feature_idx", {entity});
+            index("entity_feature_feature_idx", {entity, feature});
         }
     }
 
@@ -489,6 +513,8 @@ public class Database : Qlite.Database {
     public RealJidTable real_jid { get; private set; }
     public OccupantIdTable occupantid { get; private set; }
     public FileTransferTable file_transfer { get; private set; }
+    public FileTransferGroupTable file_transfer_group { get; private set; }
+    public FileTransferGroupFileTransferTable file_transfer_group_file_transfer { get; private set; }
     public FileHashesTable file_hashes { get; private set; }
     public FileThumbnailsTable file_thumbnails { get; private set; }
     public SourcesTable sfs_sources { get; private set; }
@@ -525,6 +551,8 @@ public class Database : Qlite.Database {
         occupantid = new OccupantIdTable(this);
         real_jid = new RealJidTable(this);
         file_transfer = new FileTransferTable(this);
+        file_transfer_group = new FileTransferGroupTable(this);
+        file_transfer_group_file_transfer = new FileTransferGroupFileTransferTable(this);
         file_hashes = new FileHashesTable(this);
         file_thumbnails = new FileThumbnailsTable(this);
         sfs_sources = new SourcesTable(this);
@@ -542,7 +570,7 @@ public class Database : Qlite.Database {
         settings = new SettingsTable(this);
         account_settings = new AccountSettingsTable(this);
         conversation_settings = new ConversationSettingsTable(this);
-        init({ account, jid, entity, content_item, message, message_occupant_id, body_meta, message_correction, reply, real_jid, occupantid, file_transfer, file_hashes, file_thumbnails, sfs_sources, call, call_counterpart, conversation, avatar, entity_identity, entity_feature, roster, mam_catchup, reaction, muc_affiliation, muc_affiliation_version, settings, account_settings, conversation_settings });
+        init({ account, jid, entity, content_item, message, message_occupant_id, body_meta, message_correction, reply, real_jid, occupantid, file_transfer, file_transfer_group, file_transfer_group_file_transfer, file_hashes, file_thumbnails, sfs_sources, call, call_counterpart, conversation, avatar, entity_identity, entity_feature, roster, mam_catchup, reaction, muc_affiliation, muc_affiliation_version, settings, account_settings, conversation_settings });
 
         try {
             exec("PRAGMA journal_mode = WAL");
@@ -741,65 +769,6 @@ public class Database : Qlite.Database {
             .perform();
     }
 
-    public Gee.List<Message> get_messages(Jid jid, Account account, Message.Type? type, int count, DateTime? before, DateTime? after, int id) {
-        QueryBuilder select = message.select();
-
-        if (before != null) {
-            if (id > 0) {
-                select.where(@"time < ? OR (time = ? AND message.id < ?)", { before.to_unix().to_string(), before.to_unix().to_string(), id.to_string() });
-            } else {
-                select.with(message.id, "<", id);
-            }
-        }
-        if (after != null) {
-            if (id > 0) {
-                select.where(@"time > ? OR (time = ? AND message.id > ?)", { after.to_unix().to_string(), after.to_unix().to_string(), id.to_string() });
-            } else {
-                select.with(message.time, ">", (long) after.to_unix());
-            }
-            if (id > 0) {
-                select.with(message.id, ">", id);
-            }
-        } else {
-            select.order_by(message.time, "DESC");
-        }
-
-        select.with(message.counterpart_id, "=", get_jid_id(jid))
-                .with(message.account_id, "=", account.id)
-                .limit(count);
-        if (jid.resourcepart != null) {
-            select.with(message.counterpart_resource, "=", jid.resourcepart);
-        }
-        if (type != null) {
-            select.with(message.type_, "=", (int) type);
-        }
-
-        select.outer_join_with(real_jid, real_jid.message_id, message.id);
-        select.outer_join_with(message_correction, message_correction.message_id, message.id);
-
-        LinkedList<Message> ret = new LinkedList<Message>();
-        foreach (Row row in select) {
-            try {
-                ret.insert(0, new Message.from_row(this, row));
-            } catch (InvalidJidError e) {
-                warning("Ignoring message with invalid Jid: %s", e.message);
-            }
-        }
-        return ret;
-    }
-
-    public Message? get_message_by_id(int id) {
-        Row? row = message.row_with(message.id, id).inner;
-        if (row != null) {
-            try {
-                return new Message.from_row(this, row);
-            } catch (InvalidJidError e) {
-                warning("Ignoring message with invalid Jid: %s", e.message);
-            }
-        }
-        return null;
-    }
-
     public ArrayList<Conversation> get_conversations(Account account) {
         ArrayList<Conversation> ret = new ArrayList<Conversation>();
         foreach (Row row in conversation.select().with(conversation.account_id, "=", account.id)) {
diff --git a/libdino/src/service/entity_capabilities_storage.vala b/libdino/src/service/entity_capabilities_storage.vala
deleted file mode 100644
index c6d0bbbd..00000000
--- a/libdino/src/service/entity_capabilities_storage.vala
+++ /dev/null
@@ -1,71 +0,0 @@
-using Gee;
-using Qlite;
-using Xmpp;
-using Xmpp.Xep.ServiceDiscovery;
-
-namespace Dino {
-
-public class EntityCapabilitiesStorage : Xep.EntityCapabilities.Storage, Object {
-
-    private Database db;
-    private HashMap<string, Gee.List<string>> features_cache = new HashMap<string, Gee.List<string>>();
-    private HashMap<string, Identity> identity_cache = new HashMap<string, Identity>();
-
-    public EntityCapabilitiesStorage(Database db) {
-        this.db = db;
-    }
-
-    public void store_features(string entity, Gee.List<string> features) {
-        if (features_cache.has_key(entity)) return;
-
-        foreach (string feature in features) {
-            db.entity_feature.insert()
-                    .value(db.entity_feature.entity, entity)
-                    .value(db.entity_feature.feature, feature)
-                    .perform();
-        }
-    }
-
-    public void store_identities(string entity, Gee.Set<Identity> identities) {
-        foreach (Identity identity in identities) {
-            if (identity.category == Identity.CATEGORY_CLIENT) {
-                db.entity_identity.insert()
-                        .value(db.entity_identity.entity, entity)
-                        .value(db.entity_identity.category, identity.category)
-                        .value(db.entity_identity.type, identity.type_)
-                        .value(db.entity_identity.entity_name, identity.name)
-                        .perform();
-                return;
-            }
-        }
-    }
-
-    public Gee.List<string> get_features(string entity) {
-        Gee.List<string>? features = features_cache[entity];
-        if (features != null) {
-            return features;
-        }
-
-        features = new ArrayList<string>();
-        foreach (Row row in db.entity_feature.select({db.entity_feature.feature}).with(db.entity_feature.entity, "=", entity)) {
-            features.add(row[db.entity_feature.feature]);
-        }
-        features_cache[entity] = features;
-        return features;
-    }
-
-    public Identity? get_identities(string entity) {
-        Identity? identity = identity_cache[entity];
-        if (identity != null) {
-            return identity;
-        }
-
-        RowOption row = db.entity_identity.select().with(db.entity_identity.entity, "=", entity).single().row();
-        if (row.is_present()) {
-            identity = new Identity(row[db.entity_identity.category], row[db.entity_identity.type], row[db.entity_identity.entity_name]);
-        }
-        identity_cache[entity] = identity;
-        return identity;
-    }
-}
-}
diff --git a/libdino/src/service/entity_info.vala b/libdino/src/service/entity_info.vala
index 53d14b15..e9a20df1 100644
--- a/libdino/src/service/entity_info.vala
+++ b/libdino/src/service/entity_info.vala
@@ -1,6 +1,6 @@
 using Gee;
 using Dino.Entities;
-using Qlite;
+using Dino.Qlite;
 using Xmpp;
 using Xmpp.Xep;
 using Xmpp.Xep.ServiceDiscovery;
@@ -12,7 +12,6 @@ public class EntityInfo : StreamInteractionModule, Object {
 
     private StreamInteractor stream_interactor;
     private Database db;
-    private EntityCapabilitiesStorage entity_capabilities_storage;
     private Dino.Entities.Settings settings;
 
     private HashMap<Jid, string> entity_caps_hashes = new HashMap<Jid, string>(Jid.hash_func, Jid.equals_func);
@@ -40,7 +39,6 @@ public class EntityInfo : StreamInteractionModule, Object {
     private EntityInfo(StreamInteractor stream_interactor, Database db, Dino.Entities.Settings settings) {
         this.stream_interactor = stream_interactor;
         this.db = db;
-        this.entity_capabilities_storage = new EntityCapabilitiesStorage(db);
         this.settings = settings;
 
         stream_interactor.account_added.connect(on_account_added);
@@ -58,18 +56,32 @@ public class EntityInfo : StreamInteractionModule, Object {
         Timeout.add_seconds(60 * 60, () => { remove_old_entities(); return true; });
     }
 
-    public async Gee.Set<Identity>? get_identities(Account account, Jid jid) {
+    public Gee.Set<Identity>? get_identities_offline(Account account, Jid jid) {
         if (jid_identity.has_key(jid)) {
             return jid_identity[jid];
         }
 
-        string? hash = entity_caps_hashes[jid];
-        if (hash != null) {
-            Gee.Set<Identity>? identities = get_stored_identities(hash);
-            if (identities != null) return identities;
+        var qry = db.entity.select()
+                .with(db.entity.account_id, "=", account.id)
+                .with(db.entity.jid_id, "=", db.get_jid_id(jid))
+                .with(db.entity.resource, "=", jid.resourcepart ?? "")
+                .join_with(db.entity_identity, db.entity.caps_hash, db.entity_identity.entity);
+
+        HashSet<Identity> identities = new HashSet<Identity>(Identity.hash_func, Identity.equals_func);
+
+        foreach (Row row in qry) {
+            var identity = new Identity(row[db.entity_identity.category], row[db.entity_identity.type], row[db.entity_identity.entity_name]);
+            identities.add(identity);
         }
 
-        ServiceDiscovery.InfoResult? info_result = yield get_info_result(account, jid, hash);
+        return identities;
+    }
+
+    public async Gee.Set<Identity>? get_identities(Account account, Jid jid) {
+        var identities = get_identities_offline(account, jid);
+        if (identities != null) return identities;
+
+        ServiceDiscovery.InfoResult? info_result = yield get_info_result(account, jid, entity_caps_hashes[jid]);
         if (info_result != null) {
             return info_result.identities;
         }
@@ -261,7 +273,7 @@ public class EntityInfo : StreamInteractionModule, Object {
         return identities;
     }
 
-    private async ServiceDiscovery.InfoResult? get_info_result(Account account, Jid jid, string? hash = null) {
+    public async ServiceDiscovery.InfoResult? get_info_result(Account account, Jid jid, string? hash = null) {
         XmppStream? stream = stream_interactor.get_stream(account);
         if (stream == null) return null;
 
@@ -298,7 +310,6 @@ public class EntityInfo : StreamInteractionModule, Object {
     }
 
     private void initialize_modules(Account account, ArrayList<XmppStreamModule> modules) {
-        modules.add(new Xep.EntityCapabilities.Module(entity_capabilities_storage));
         var entity_time_module = modules.first_match((it) => it is EntityTime.Module) as EntityTime.Module;
         if (entity_time_module != null) {
             settings.bind_property("share-time", entity_time_module, "enabled", BindingFlags.SYNC_CREATE);
diff --git a/libdino/src/service/fallback_body.vala b/libdino/src/service/fallback_body.vala
index 0ce89ade..09aa839a 100644
--- a/libdino/src/service/fallback_body.vala
+++ b/libdino/src/service/fallback_body.vala
@@ -1,5 +1,4 @@
 using Gee;
-using Qlite;
 
 using Xmpp;
 using Xmpp.Xep;
diff --git a/libdino/src/service/file_manager.vala b/libdino/src/service/file_manager.vala
index 964278a5..60b7fafa 100644
--- a/libdino/src/service/file_manager.vala
+++ b/libdino/src/service/file_manager.vala
@@ -16,17 +16,22 @@ public class FileManager : StreamInteractionModule, Object {
 
     private StreamInteractor stream_interactor;
     private Database db;
-    private Gee.List<FileSender> file_senders = new ArrayList<FileSender>();
+    public Gee.List<FileSender> file_senders = new ArrayList<FileSender>();
     private Gee.List<FileEncryptor> file_encryptors = new ArrayList<FileEncryptor>();
-    private Gee.List<FileDecryptor> file_decryptors = new ArrayList<FileDecryptor>();
+    public Gee.List<FileDecryptor> file_decryptors = new ArrayList<FileDecryptor>();
     private Gee.List<FileProvider> file_providers = new ArrayList<FileProvider>();
-    private Gee.List<FileMetadataProvider> file_metadata_providers = new ArrayList<FileMetadataProvider>();
+    public Gee.List<FileMetadataProvider> file_metadata_providers = new ArrayList<FileMetadataProvider>();
 
     public StatelessFileSharing sfs {
         owned get { return stream_interactor.get_module(StatelessFileSharing.IDENTITY); }
         private set { }
     }
 
+    public FileManager2 fm2 {
+        owned get { return stream_interactor.get_module(FileManager2.IDENTITY); }
+        private set { }
+    }
+
     public static void start(StreamInteractor stream_interactor, Database db) {
         FileManager m = new FileManager(stream_interactor, db);
         stream_interactor.add_module(m);
@@ -97,7 +102,7 @@ public class FileManager : StreamInteractionModule, Object {
         try {
             file_transfer.input_stream = yield file.read_async();
 
-            yield save_file(file_transfer);
+            yield fm2.save_file(file_transfer);
 
             stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file(file_transfer);
             conversation.last_active = file_transfer.time;
@@ -151,7 +156,7 @@ public class FileManager : StreamInteractionModule, Object {
 
             file_transfer.state = FileTransfer.State.IN_PROGRESS;
 
-            // Update current download progress in the FileTransfer
+            // Update current upload progress in the FileTransfer
             LimitInputStream? limit_stream = file_transfer.input_stream as LimitInputStream;
             if (limit_stream == null) {
                 limit_stream = new LimitInputStream(file_transfer.input_stream, file_meta.size);
@@ -216,19 +221,6 @@ public class FileManager : StreamInteractionModule, Object {
         file_metadata_providers.add(file_metadata_provider);
     }
 
-    public bool is_sender_trustworthy(FileTransfer file_transfer, Conversation conversation) {
-        if (file_transfer.direction == FileTransfer.DIRECTION_SENT) return true;
-
-        Jid relevant_jid = conversation.counterpart;
-        if (conversation.type_ == Conversation.Type.GROUPCHAT) {
-            relevant_jid = stream_interactor.get_module(MucManager.IDENTITY).get_real_jid(file_transfer.from, conversation.account);
-        }
-        if (relevant_jid == null) return false;
-
-        bool in_roster = stream_interactor.get_module(RosterManager.IDENTITY).get_roster_item(conversation.account, relevant_jid) != null;
-        return in_roster;
-    }
-
     private async FileMeta get_file_meta(FileProvider file_provider, FileTransfer file_transfer, Conversation conversation, FileReceiveData receive_data_) throws FileReceiveError {
         FileReceiveData receive_data = receive_data_;
         FileMeta file_meta = file_provider.get_file_meta(file_transfer);
@@ -390,7 +382,7 @@ public class FileManager : StreamInteractionModule, Object {
         FileTransfer file_transfer = create_file_transfer_from_provider_incoming(file_provider, info, from, time, local_time, conversation, receive_data, file_meta);
         stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file(file_transfer);
 
-        if (is_sender_trustworthy(file_transfer, conversation)) {
+        if (fm2.is_sender_trustworthy(file_transfer, conversation)) {
             try {
                 yield get_file_meta(file_provider, file_transfer, conversation, receive_data);
             } catch (Error e) {
@@ -408,20 +400,6 @@ public class FileManager : StreamInteractionModule, Object {
         received_file(file_transfer, conversation);
     }
 
-    private async void save_file(FileTransfer file_transfer) throws FileSendError {
-        try {
-            string filename = Random.next_int().to_string("%x") + "_" + file_transfer.file_name;
-            File file = File.new_for_path(Path.build_filename(get_storage_dir(), filename));
-            OutputStream os = file.create(FileCreateFlags.REPLACE_DESTINATION);
-            yield os.splice_async(file_transfer.input_stream, OutputStreamSpliceFlags.CLOSE_SOURCE | OutputStreamSpliceFlags.CLOSE_TARGET);
-            file_transfer.state = FileTransfer.State.COMPLETE;
-            file_transfer.path = filename;
-            file_transfer.input_stream = new LimitInputStream(yield file.read_async(), file_transfer.size);
-        } catch (Error e) {
-            throw new FileSendError.SAVE_FAILED("Saving file error: %s".printf(e.message));
-        }
-    }
-
     public Message? get_message_for_file_transfer(FileTransfer file_transfer, Conversation conversation) {
         if ((file_transfer.provider == 0 || file_transfer.provider == 2) && file_transfer.info != null) {
             return stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_id(int.parse(file_transfer.info), conversation);
diff --git a/libdino/src/service/file_transfer_storage.vala b/libdino/src/service/file_transfer_storage.vala
index 64bb6b81..33ebcbce 100644
--- a/libdino/src/service/file_transfer_storage.vala
+++ b/libdino/src/service/file_transfer_storage.vala
@@ -1,8 +1,8 @@
 using Xmpp;
 using Gee;
-using Qlite;
 
 using Dino.Entities;
+using Dino.Qlite;
 
 namespace Dino {
 
@@ -15,6 +15,8 @@ namespace Dino {
 
         private WeakMap<int, FileTransfer> files_by_db_id = new WeakMap<int, FileTransfer>();
         private WeakMap<int, FileTransfer> files_by_message_id = new WeakMap<int, FileTransfer>();
+        private WeakMap<int, FileTransferGroup> file_group_by_db_id = new WeakMap<int, FileTransferGroup>();
+        private WeakMap<int, FileTransferGroup> file_group_by_message_id = new WeakMap<int, FileTransferGroup>();
         private WeakMap<string, FileTransfer> files_by_message_and_file_id = new WeakMap<string, FileTransfer>();
 
         public static void start(StreamInteractor stream_interactor, Database db) {
@@ -32,7 +34,13 @@ namespace Dino {
             cache_file(file_transfer);
         }
 
-        public FileTransfer? get_file_by_id(int id, Conversation conversation) {
+        public void add_file_group(FileTransferGroup file_group) {
+            file_group.persist(db);
+            cache_file_group(file_group);
+        }
+
+        // `conversation` should be provided, otherwise the FileTransfer.ourpart might be wrong
+        public FileTransfer? get_file_by_id(int id, Conversation? conversation) {
             FileTransfer? file_transfer = files_by_db_id[id];
             if (file_transfer != null) {
                 return file_transfer;
@@ -58,6 +66,29 @@ namespace Dino {
             return create_file_from_row_opt(row_option, conversation);
         }
 
+        public FileTransferGroup? get_file_group_by_id(int id, Conversation conversation) {
+            FileTransferGroup? file_group = file_group_by_db_id[id];
+            if (file_group != null) {
+                return file_group;
+            }
+
+            RowOption row_option = db.file_transfer_group.select().with(db.file_transfer_group.id, "=", id).row();
+            return row_option.is_present() ? create_file_group_from_row(row_option.inner, conversation) : null;
+        }
+
+        public FileTransferGroup get_file_group_by_message_id(int id, Conversation conversation) {
+            FileTransferGroup? file_group = file_group_by_message_id[id];
+            if (file_group != null) {
+                return file_group;
+            }
+
+            foreach (Row row in db.file_transfer_group.select().with(db.file_transfer_group.message_id, "=", id)) {
+                return create_file_group_from_row(row, conversation);
+            }
+
+            return null;
+        }
+
         public FileTransfer get_files_by_message_and_file_id(int message_id, string file_sharing_id, Conversation conversation) {
             string combined_identifier = message_id.to_string() + file_sharing_id;
             FileTransfer? file_transfer = files_by_message_and_file_id[combined_identifier];
@@ -79,13 +110,13 @@ namespace Dino {
             return null;
         }
 
-        private FileTransfer? create_file_from_row_opt(RowOption row_opt, Conversation conversation) {
+        private FileTransfer? create_file_from_row_opt(RowOption row_opt, Conversation? conversation) {
             if (!row_opt.is_present()) return null;
 
             try {
                 FileTransfer file_transfer = new FileTransfer.from_row(db, row_opt.inner, FileManager.get_storage_dir());
 
-                if (conversation.type_.is_muc_semantic()) {
+                if (conversation != null && conversation.type_.is_muc_semantic()) {
                     file_transfer.ourpart = conversation.counterpart.with_resource(file_transfer.ourpart.resourcepart);
                 }
 
@@ -97,6 +128,21 @@ namespace Dino {
             return null;
         }
 
+        private FileTransferGroup? create_file_group_from_row(Row file_transfer_group_row, Conversation conversation) {
+            QueryBuilder query = db.file_transfer_group_file_transfer.select()
+                    .with(db.file_transfer_group_file_transfer.file_transfer_group_id, "=", file_transfer_group_row[db.file_transfer_group.id]);
+            var file_transfers = new ArrayList<FileTransfer>();
+            foreach (Qlite.Row row in query) {
+                FileTransfer file_transfer = get_file_by_id(row[db.file_transfer_group_file_transfer.file_transfer_id], conversation);
+                file_transfers.add(file_transfer);
+            }
+            if (file_transfers.size == 0) return null;
+
+            FileTransferGroup file_group = new FileTransferGroup.from_row(db, file_transfer_group_row, file_transfers);
+            cache_file_group(file_group);
+            return file_group;
+        }
+
         private void cache_file(FileTransfer file_transfer) {
             files_by_db_id[file_transfer.id] = file_transfer;
 
@@ -109,5 +155,10 @@ namespace Dino {
                 }
             }
         }
+
+        private void cache_file_group(FileTransferGroup file_group) {
+            file_group_by_db_id[file_group.id] = file_group;
+//            file_group_by_message_id[file_group.message_id] = file_group;
+        }
     }
 }
\ No newline at end of file
diff --git a/libdino/src/service/history_sync.vala b/libdino/src/service/history_sync.vala
index 9bd3f54f..a7a99d2d 100644
--- a/libdino/src/service/history_sync.vala
+++ b/libdino/src/service/history_sync.vala
@@ -3,7 +3,7 @@ using Gee;
 using Xmpp;
 using Xmpp.Xep;
 using Dino.Entities;
-using Qlite;
+using Dino.Qlite;
 
 public class Dino.HistorySync {
 
diff --git a/libdino/src/service/ice.vala b/libdino/src/service/ice.vala
new file mode 100644
index 00000000..0e168be9
--- /dev/null
+++ b/libdino/src/service/ice.vala
@@ -0,0 +1,538 @@
+using Gee;
+
+using Dino.Crypto;
+using Xmpp;
+using Xmpp.Xep;
+
+private extern const size_t NICE_ADDRESS_STRING_LEN;
+
+public class Dino.IceUdpModule : Xmpp.Xep.JingleIceUdp.Module {
+
+    public string? stun_ip = null;
+    public uint stun_port = 0;
+    public string? turn_ip = null;
+    public Xep.ExternalServiceDiscovery.Service? turn_service = null;
+
+    private static weak Nice.Agent? agent;
+    private HashMap<string, DtlsSrtp.CredentialsCapsule> cerds = new HashMap<string, DtlsSrtp.CredentialsCapsule>();
+
+    private uint timeout = 0;
+
+    public override void attach(XmppStream stream) {
+        base.attach(stream);
+        external_discovery_refresh_services.begin(stream);
+    }
+    public override void detach(XmppStream stream) {
+        base.detach(stream);
+        stop_external_discovery_refresh_services();
+    }
+
+    private Nice.Agent get_agent() {
+        Nice.Agent? agent = this.agent;
+        if (agent == null) {
+            Nice.debug_enable(true);
+            agent = new Nice.Agent(MainContext.@default(), Nice.Compatibility.RFC5245);
+            if (stun_ip != null) {
+                agent.stun_server = stun_ip;
+                agent.stun_server_port = stun_port;
+            }
+            agent.ice_tcp = false;
+            agent.set_software("Dino");
+            agent.weak_ref(agent_unweak);
+            this.agent = agent;
+            debug("STUN server for libnice %s %u", agent.stun_server, agent.stun_server_port);
+        }
+        return agent;
+    }
+
+    private void agent_unweak() {
+        this.agent = null;
+    }
+
+    public override Jingle.TransportParameters create_transport_parameters(XmppStream stream, uint8 components, Jid local_full_jid, Jid peer_full_jid) {
+        DtlsSrtp.CredentialsCapsule? cred = get_create_credentials(local_full_jid, peer_full_jid);
+        return new IceUdpTransportParameters(get_agent(), cred, turn_service, turn_ip, components, local_full_jid, peer_full_jid);
+    }
+
+    public override Jingle.TransportParameters parse_transport_parameters(XmppStream stream, uint8 components, Jid local_full_jid, Jid peer_full_jid, StanzaNode transport) throws Jingle.IqError {
+        DtlsSrtp.CredentialsCapsule? cred = get_create_credentials(local_full_jid, peer_full_jid);
+        return new IceUdpTransportParameters(get_agent(), cred, turn_service, turn_ip, components, local_full_jid, peer_full_jid, transport);
+    }
+
+    private DtlsSrtp.CredentialsCapsule? get_create_credentials(Jid local_full_jid, Jid peer_full_jid) {
+        string from_to_id = local_full_jid.to_string() + peer_full_jid.to_string();
+        try {
+            if (!cerds.has_key(from_to_id)) cerds[from_to_id] = DtlsSrtp.generate_credentials();
+        } catch (GLib.Error e) {
+            warning("Error creating dtls credentials: %s", e.message);
+        }
+        return cerds[from_to_id];
+    }
+
+    private void stop_external_discovery_refresh_services() {
+        if (timeout != 0) {
+            Source.remove(timeout);
+            timeout = 0;
+        }
+    }
+
+    private async void external_discovery_refresh_services(XmppStream stream) {
+        stop_external_discovery_refresh_services();
+        Gee.List<Xep.ExternalServiceDiscovery.Service> services = yield ExternalServiceDiscovery.request_services(stream);
+        foreach (Xep.ExternalServiceDiscovery.Service service in services) {
+            if (service.transport == "udp" && (service.ty == "stun" || service.ty == "turn")) {
+                InetAddress? ip = yield lookup_ipv4_addess(service.host);
+                if (ip == null) continue;
+
+                if (ip.is_any || ip.is_link_local || ip.is_loopback || ip.is_multicast || ip.is_site_local) {
+                    warning("Ignoring STUN/TURN server at %s", service.host);
+                    continue;
+                }
+
+                if (service.ty == "stun") {
+                    debug("Server offers STUN server: %s:%u, resolved to %s", service.host, service.port, ip.to_string());
+                    stun_ip = ip.to_string();
+                    stun_port = service.port;
+                } else if (service.ty == "turn") {
+                    debug("Server offers TURN server: %s:%u, resolved to %s", service.host, service.port, ip.to_string());
+                    turn_ip = ip.to_string();
+                    turn_service = service;
+                }
+            }
+        }
+        if (stun_ip == null) {
+            InetAddress ip = yield lookup_ipv4_addess("stun.dino.im");
+            if (ip == null) return;
+
+            debug("Using fallback STUN server: stun.dino.im:7886, resolved to %s", ip.to_string());
+
+            stun_ip = ip.to_string();
+            stun_port = 7886;
+        }
+
+        // Refresh TURN credentials before they expire
+        if (turn_service != null) {
+            DateTime? expires = turn_service.expires;
+            if (expires != null) {
+                uint refresh_delay = (uint) (expires.to_unix() - new DateTime.now_utc().to_unix()) / 2;
+
+                if (refresh_delay >= 300 && refresh_delay <= (int64) uint.MAX) { // 5 min < refetch < max
+                    debug("Re-fetching TURN credentials in %u sec", refresh_delay);
+
+                    stop_external_discovery_refresh_services();
+                    timeout = Timeout.add_seconds((uint) refresh_delay, () => {
+                        timeout = 0;
+                        external_discovery_refresh_services.begin(stream);
+                        return false;
+                    });
+                } else {
+                    warning("TURN credentials' expiry time = %u, *not* re-fetching", refresh_delay);
+                }
+            }
+        }
+    }
+
+    private async InetAddress? lookup_ipv4_addess(string host) {
+        try {
+            Resolver resolver = Resolver.get_default();
+            GLib.List<GLib.InetAddress>? ips = yield resolver.lookup_by_name_async(host);
+            foreach (GLib.InetAddress ina in ips) {
+                if (ina.get_family() != SocketFamily.IPV4) continue;
+                return ina;
+            }
+        } catch (GLib.Error e) {
+            warning("Failed looking up IP address of %s", host);
+        }
+        return null;
+    }
+}
+
+public class Dino.IceUdpTransportParameters : JingleIceUdp.IceUdpTransportParameters {
+    private Nice.Agent agent;
+    private uint stream_id;
+    private bool we_want_connection;
+    private bool remote_credentials_set;
+    private Map<uint8, DatagramConnection> connections = new HashMap<uint8, DatagramConnection>();
+    private DtlsSrtp.Handler? dtls_srtp_handler;
+    private MainContext thread_context;
+    private MainLoop thread_loop;
+
+    private static bool is_component_ready(Nice.Agent agent, uint stream_id, uint component_id) {
+        var state = agent.get_component_state(stream_id, component_id);
+        return state == Nice.ComponentState.CONNECTED || state == Nice.ComponentState.READY;
+    }
+
+    private class DatagramConnection : Jingle.DatagramConnection {
+        private Nice.Agent agent;
+        private DtlsSrtp.Handler? dtls_srtp_handler;
+        private uint stream_id;
+        private string? error;
+        private ulong datagram_received_id;
+
+        internal DatagramConnection(Nice.Agent agent, DtlsSrtp.Handler? dtls_srtp_handler, uint stream_id, uint8 component_id) {
+            this.agent = agent;
+            this.dtls_srtp_handler = dtls_srtp_handler;
+            this.stream_id = stream_id;
+            this.component_id = component_id;
+            this.datagram_received_id = this.datagram_received.connect((datagram) => {
+                bytes_received += datagram.length;
+            });
+        }
+
+        public override async void terminate(bool we_terminated, string? reason_string = null, string? reason_text = null) {
+            yield base.terminate(we_terminated, reason_string, reason_text);
+            this.disconnect(datagram_received_id);
+            agent = null;
+            dtls_srtp_handler = null;
+        }
+
+        public override void send_datagram(Bytes datagram) {
+            if (this.agent != null && is_component_ready(agent, stream_id, component_id)) {
+                try {
+                    if (dtls_srtp_handler != null) {
+                        uint8[] encrypted_data = dtls_srtp_handler.process_outgoing_data(component_id, datagram.get_data());
+                        if (encrypted_data == null) return;
+                        GLib.OutputVector vector = { encrypted_data, encrypted_data.length };
+                        GLib.OutputVector[] vectors = { vector };
+                        Nice.OutputMessage message = { vectors };
+                        Nice.OutputMessage[] messages = { message };
+                        agent.send_messages_nonblocking(stream_id, component_id, messages);
+                    } else {
+                        GLib.OutputVector vector = { datagram.get_data(), datagram.get_size() };
+                        GLib.OutputVector[] vectors = { vector };
+                        Nice.OutputMessage message = { vectors };
+                        Nice.OutputMessage[] messages = { message };
+                        agent.send_messages_nonblocking(stream_id, component_id, messages);
+                    }
+                    bytes_sent += datagram.length;
+                } catch (GLib.Error e) {
+                    warning("%s while send_datagram stream %u component %u", e.message, stream_id, component_id);
+                }
+            }
+        }
+    }
+
+    internal IceUdpTransportParameters(Nice.Agent agent, DtlsSrtp.CredentialsCapsule? credentials, Xep.ExternalServiceDiscovery.Service? turn_service, string? turn_ip, uint8 components, Jid local_full_jid, Jid peer_full_jid, StanzaNode? node = null) {
+        base(components, local_full_jid, peer_full_jid, node);
+        this.we_want_connection = (node == null);
+        this.agent = agent;
+
+        if (this.peer_fingerprint != null || !incoming) {
+            dtls_srtp_handler = setup_dtls(this, credentials);
+            own_fingerprint = dtls_srtp_handler.own_fingerprint;
+            if (incoming) {
+                own_setup = "active";
+                dtls_srtp_handler.mode = DtlsSrtp.Mode.CLIENT;
+                dtls_srtp_handler.peer_fingerprint = peer_fingerprint;
+                dtls_srtp_handler.peer_fp_algo = peer_fp_algo;
+            } else {
+                own_setup = "actpass";
+                dtls_srtp_handler.mode = DtlsSrtp.Mode.SERVER;
+                dtls_srtp_handler.setup_dtls_connection.begin((_, res) => {
+                    var content_encryption = dtls_srtp_handler.setup_dtls_connection.end(res);
+                    if (content_encryption != null) {
+                        this.content.encryptions[content_encryption.encryption_ns] = content_encryption;
+                    }
+                });
+            }
+        }
+
+        agent.candidate_gathering_done.connect(on_candidate_gathering_done);
+        agent.initial_binding_request_received.connect(on_initial_binding_request_received);
+        agent.component_state_changed.connect(on_component_state_changed);
+        agent.new_selected_pair_full.connect(on_new_selected_pair_full);
+        agent.new_candidate_full.connect(on_new_candidate);
+
+        agent.controlling_mode = !incoming;
+        stream_id = agent.add_stream(components);
+        thread_context = new MainContext();
+        new Thread<void*>(@"ice-thread-$stream_id", () => {
+            thread_context.push_thread_default();
+            thread_loop = new MainLoop(thread_context, false);
+            thread_loop.run();
+            thread_context.pop_thread_default();
+            return null;
+        });
+
+        if (turn_ip != null) {
+            for (uint8 component_id = 1; component_id <= components; component_id++) {
+                agent.set_relay_info(stream_id, component_id, turn_ip, turn_service.port, turn_service.username, turn_service.password, Nice.RelayType.UDP);
+                debug("TURN info (component %i) %s:%u", component_id, turn_ip, turn_service.port);
+            }
+        }
+        string ufrag;
+        string pwd;
+        agent.get_local_credentials(stream_id, out ufrag, out pwd);
+        init(ufrag, pwd);
+
+        for (uint8 component_id = 1; component_id <= components; component_id++) {
+            // We don't properly get local candidates before this call
+            agent.attach_recv(stream_id, component_id, thread_context, on_recv);
+        }
+
+        agent.gather_candidates(stream_id);
+    }
+
+    private static DtlsSrtp.Handler setup_dtls(IceUdpTransportParameters tp, DtlsSrtp.CredentialsCapsule credentials) {
+        var weak_self = WeakRef(tp);
+        DtlsSrtp.Handler dtls_srtp = new DtlsSrtp.Handler.with_cert(credentials);
+        dtls_srtp.send_data.connect((data) => {
+            IceUdpTransportParameters self = (IceUdpTransportParameters) weak_self.get();
+            if (self != null) self.agent.send(self.stream_id, 1, data);
+        });
+        return dtls_srtp;
+    }
+
+    private void on_candidate_gathering_done(uint stream_id) {
+        if (stream_id != this.stream_id) return;
+        debug("on_candidate_gathering_done in %u", stream_id);
+
+        for (uint8 i = 1; i <= components; i++) {
+            foreach (unowned Nice.Candidate nc in agent.get_local_candidates(stream_id, i)) {
+                if (nc.transport == Nice.CandidateTransport.UDP) {
+                    JingleIceUdp.Candidate? candidate = candidate_to_jingle(nc);
+                    if (candidate == null) continue;
+                    debug("Local candidate summary: %s", agent.generate_local_candidate_sdp(nc));
+                }
+            }
+        }
+    }
+
+    private void on_new_candidate(Nice.Candidate nc) {
+        if (nc.stream_id != stream_id) return;
+        JingleIceUdp.Candidate? candidate = candidate_to_jingle(nc);
+        if (candidate == null) return;
+
+        if (nc.transport == Nice.CandidateTransport.UDP) {
+            // Execution was in the agent thread before
+            add_local_candidate_threadsafe(candidate);
+        }
+    }
+
+    private bool bytes_equal(uint8[] a1, uint8[] a2) {
+        return a1.length == a2.length && Memory.cmp(a1, a2, a1.length) == 0;
+    }
+
+    public override void handle_transport_accept(StanzaNode transport) throws Jingle.IqError {
+        debug("on_transport_accept from %s", peer_full_jid.to_string());
+        base.handle_transport_accept(transport);
+
+        if (dtls_srtp_handler != null && peer_fingerprint != null) {
+            if (dtls_srtp_handler.peer_fingerprint != null) {
+                if (!bytes_equal(dtls_srtp_handler.peer_fingerprint, peer_fingerprint)) {
+                    warning("Tried to replace certificate fingerprint mid use. We don't allow that.");
+                    peer_fingerprint = dtls_srtp_handler.peer_fingerprint;
+                    peer_fp_algo = dtls_srtp_handler.peer_fp_algo;
+                }
+            } else {
+                dtls_srtp_handler.peer_fingerprint = peer_fingerprint;
+                dtls_srtp_handler.peer_fp_algo = peer_fp_algo;
+            }
+            if (peer_setup == "passive") {
+                dtls_srtp_handler.mode = DtlsSrtp.Mode.CLIENT;
+                dtls_srtp_handler.stop_dtls_connection();
+                dtls_srtp_handler.setup_dtls_connection.begin((_, res) => {
+                    var content_encryption = dtls_srtp_handler.setup_dtls_connection.end(res);
+                    if (content_encryption != null) {
+                        this.content.encryptions[content_encryption.encryption_ns] = content_encryption;
+                    }
+                });
+            }
+        } else {
+            dtls_srtp_handler = null;
+        }
+    }
+
+    public override void handle_transport_info(StanzaNode transport) throws Jingle.IqError {
+        debug("on_transport_info from %s", peer_full_jid.to_string());
+        base.handle_transport_info(transport);
+
+        if (dtls_srtp_handler != null && peer_fingerprint != null) {
+            if (dtls_srtp_handler.peer_fingerprint != null) {
+                if (!bytes_equal(dtls_srtp_handler.peer_fingerprint, peer_fingerprint)) {
+                    warning("Tried to replace certificate fingerprint mid use. We don't allow that.");
+                    peer_fingerprint = dtls_srtp_handler.peer_fingerprint;
+                    peer_fp_algo = dtls_srtp_handler.peer_fp_algo;
+                }
+            } else {
+                dtls_srtp_handler.peer_fingerprint = peer_fingerprint;
+                dtls_srtp_handler.peer_fp_algo = peer_fp_algo;
+            }
+        }
+
+        if (!we_want_connection) return;
+
+        if (remote_ufrag != null && remote_pwd != null && !remote_credentials_set) {
+            agent.set_remote_credentials(stream_id, remote_ufrag, remote_pwd);
+            remote_credentials_set = true;
+        }
+        for (uint8 i = 1; i <= components; i++) {
+            SList<Nice.Candidate> candidates = new SList<Nice.Candidate>();
+            foreach (JingleIceUdp.Candidate candidate in remote_candidates) {
+                if (candidate.component == i) {
+                    candidates.append(candidate_to_nice(candidate));
+                }
+            }
+            int new_candidates = agent.set_remote_candidates(stream_id, i, candidates);
+            debug("Updated to %i remote candidates for candidate %u via transport info", new_candidates, i);
+        }
+    }
+
+    public override void create_transport_connection(XmppStream stream, Jingle.Content content) {
+        debug("create_transport_connection: %s", content.session.sid);
+        debug("local_credentials: %s %s", local_ufrag, local_pwd);
+        debug("remote_credentials: %s %s", remote_ufrag, remote_pwd);
+        debug("expected incoming credentials: %s %s", local_ufrag + ":" + remote_ufrag, local_pwd);
+        debug("expected outgoing credentials: %s %s", remote_ufrag + ":" + local_ufrag, remote_pwd);
+
+        we_want_connection = true;
+
+        if (remote_ufrag != null && remote_pwd != null && !remote_credentials_set) {
+            agent.set_remote_credentials(stream_id, remote_ufrag, remote_pwd);
+            remote_credentials_set = true;
+        }
+        for (uint8 i = 1; i <= components; i++) {
+            SList<Nice.Candidate> candidates = new SList<Nice.Candidate>();
+            foreach (JingleIceUdp.Candidate candidate in remote_candidates) {
+                if (candidate.ip.has_prefix("fe80::")) continue;
+                if (candidate.component == i) {
+                    candidates.append(candidate_to_nice(candidate));
+                    debug("remote candidate: %s", agent.generate_local_candidate_sdp(candidate_to_nice(candidate)));
+                }
+            }
+            int new_candidates = agent.set_remote_candidates(stream_id, i, candidates);
+            debug("Initiated component %u with %i remote candidates", i, new_candidates);
+
+            connections[i] = new DatagramConnection(agent, dtls_srtp_handler, stream_id, i);
+            content.set_transport_connection(connections[i], i);
+        }
+
+        base.create_transport_connection(stream, content);
+    }
+
+    private void on_component_state_changed(uint stream_id, uint component_id, uint state) {
+        if (stream_id != this.stream_id) return;
+        debug("stream %u component %u state changed to %s", stream_id, component_id, agent.get_component_state(stream_id, component_id).to_string());
+        may_consider_ready(stream_id, component_id);
+        if (incoming && dtls_srtp_handler != null && !dtls_srtp_handler.ready && is_component_ready(agent, stream_id, component_id) && dtls_srtp_handler.mode == DtlsSrtp.Mode.CLIENT) {
+            dtls_srtp_handler.setup_dtls_connection.begin((_, res) => {
+                Jingle.ContentEncryption? encryption = dtls_srtp_handler.setup_dtls_connection.end(res);
+                if (encryption != null) {
+                    this.content.encryptions[encryption.encryption_ns] = encryption;
+                }
+            });
+        }
+    }
+
+    private void may_consider_ready(uint stream_id, uint component_id) {
+        if (stream_id != this.stream_id) return;
+        if (connections.has_key((uint8) component_id) && !connections[(uint8)component_id].ready && is_component_ready(agent, stream_id, component_id) && (dtls_srtp_handler == null || dtls_srtp_handler.ready)) {
+            connections[(uint8)component_id].ready = true;
+        }
+    }
+
+    private void on_initial_binding_request_received(uint stream_id) {
+        if (stream_id != this.stream_id) return;
+        debug("initial_binding_request_received");
+    }
+
+    private void on_new_selected_pair_full(uint stream_id, uint component_id, Nice.Candidate p1, Nice.Candidate p2) {
+        if (stream_id != this.stream_id) return;
+        debug("new_selected_pair_full %u [%s, %s]", component_id, agent.generate_local_candidate_sdp(p1), agent.generate_local_candidate_sdp(p2));
+    }
+
+    private void on_recv(Nice.Agent agent, uint stream_id, uint component_id, uint8[] data) {
+        if (stream_id != this.stream_id) return;
+        uint8[] decrypt_data = null;
+        if (dtls_srtp_handler != null) {
+            try {
+                decrypt_data = dtls_srtp_handler.process_incoming_data(component_id, data);
+                if (decrypt_data == null) return;
+            } catch (Crypto.Error e) {
+                warning("%s while on_recv stream %u component %u", e.message, stream_id, component_id);
+                return;
+            }
+        }
+        may_consider_ready(stream_id, component_id);
+        if (connections.has_key((uint8) component_id)) {
+            if (!connections[(uint8) component_id].ready) {
+                debug("on_recv stream %u component %u when state %s", stream_id, component_id, agent.get_component_state(stream_id, component_id).to_string());
+            }
+            connections[(uint8) component_id].datagram_received(new Bytes(decrypt_data ?? data));
+        } else {
+            debug("on_recv stream %u component %u length %u", stream_id, component_id, data.length);
+        }
+    }
+
+    private static Nice.Candidate candidate_to_nice(JingleIceUdp.Candidate c) {
+        Nice.CandidateType type;
+        switch (c.type_) {
+            case JingleIceUdp.Candidate.Type.HOST: type = Nice.CandidateType.HOST; break;
+            case JingleIceUdp.Candidate.Type.PRFLX: type = Nice.CandidateType.PEER_REFLEXIVE; break;
+            case JingleIceUdp.Candidate.Type.RELAY: type = Nice.CandidateType.RELAYED; break;
+            case JingleIceUdp.Candidate.Type.SRFLX: type = Nice.CandidateType.SERVER_REFLEXIVE; break;
+            default: assert_not_reached();
+        }
+
+        Nice.Candidate candidate = new Nice.Candidate(type);
+        candidate.component_id = c.component;
+        char[] foundation = new char[Nice.CANDIDATE_MAX_FOUNDATION];
+        Memory.copy(foundation, c.foundation.data, size_t.min(c.foundation.length, Nice.CANDIDATE_MAX_FOUNDATION - 1));
+        candidate.foundation = foundation;
+        candidate.addr = Nice.Address();
+        candidate.addr.init();
+        candidate.addr.set_from_string(c.ip);
+        candidate.addr.set_port(c.port);
+        candidate.priority = c.priority;
+        if (c.rel_addr != null) {
+            candidate.base_addr = Nice.Address();
+            candidate.base_addr.init();
+            candidate.base_addr.set_from_string(c.rel_addr);
+            candidate.base_addr.set_port(c.rel_port);
+        }
+        candidate.transport = Nice.CandidateTransport.UDP;
+        return candidate;
+    }
+
+    private static JingleIceUdp.Candidate? candidate_to_jingle(Nice.Candidate nc) {
+        JingleIceUdp.Candidate candidate = new JingleIceUdp.Candidate();
+        switch (nc.type) {
+            case Nice.CandidateType.HOST: candidate.type_ = JingleIceUdp.Candidate.Type.HOST; break;
+            case Nice.CandidateType.PEER_REFLEXIVE: candidate.type_ = JingleIceUdp.Candidate.Type.PRFLX; break;
+            case Nice.CandidateType.RELAYED: candidate.type_ = JingleIceUdp.Candidate.Type.RELAY; break;
+            case Nice.CandidateType.SERVER_REFLEXIVE: candidate.type_ = JingleIceUdp.Candidate.Type.SRFLX; break;
+            default: assert_not_reached();
+        }
+        candidate.component = (uint8) nc.component_id;
+        candidate.foundation = ((string)nc.foundation).dup();
+        candidate.generation = 0;
+        candidate.id = Random.next_int().to_string("%08x"); // TODO
+
+        char[] res = new char[NICE_ADDRESS_STRING_LEN];
+        nc.addr.to_string(res);
+        candidate.ip = (string) res;
+        candidate.network = 0; // TODO
+        candidate.port = (uint16) nc.addr.get_port();
+        candidate.priority = nc.priority;
+        candidate.protocol = "udp";
+        if (nc.base_addr.is_valid() && !nc.base_addr.equal(nc.addr)) {
+            res = new char[NICE_ADDRESS_STRING_LEN];
+            nc.base_addr.to_string(res);
+            candidate.rel_addr = (string) res;
+            candidate.rel_port = (uint16) nc.base_addr.get_port();
+        }
+        if (candidate.ip.has_prefix("fe80::")) return null;
+
+        return candidate;
+    }
+
+    public override void dispose() {
+        base.dispose();
+        agent = null;
+        dtls_srtp_handler = null;
+        connections.clear();
+        if (thread_loop != null) {
+            thread_loop.quit();
+        }
+    }
+}
diff --git a/libdino/src/service/message_correction.vala b/libdino/src/service/message_correction.vala
index 77625c72..5f04bdbc 100644
--- a/libdino/src/service/message_correction.vala
+++ b/libdino/src/service/message_correction.vala
@@ -3,7 +3,7 @@ using Gee;
 using Xmpp;
 using Xmpp.Xep;
 using Dino.Entities;
-using Qlite;
+using Dino.Qlite;
 
 namespace Dino {
 
@@ -29,7 +29,6 @@ public class MessageCorrection : StreamInteractionModule, MessageListener {
     public MessageCorrection(StreamInteractor stream_interactor, Database db) {
         this.stream_interactor = stream_interactor;
         this.db = db;
-        stream_interactor.account_added.connect(on_account_added);
         stream_interactor.get_module(MessageProcessor.IDENTITY).received_pipeline.connect(this);
         stream_interactor.get_module(MessageProcessor.IDENTITY).build_message_stanza.connect(check_add_correction_node);
         stream_interactor.get_module(PresenceManager.IDENTITY).received_offline_presence.connect((jid, account) => {
@@ -232,23 +231,6 @@ public class MessageCorrection : StreamInteractionModule, MessageListener {
         return -1;
     }
 
-    private void on_account_added(Account account) {
-        Gee.List<Conversation> conversations = stream_interactor.get_module(ConversationManager.IDENTITY).get_active_conversations(account);
-        foreach (Conversation conversation in conversations) {
-            if (conversation.type_ != Conversation.Type.CHAT) continue;
-
-            HashMap<Jid, Message> last_conversation_messages = new HashMap<Jid, Message>(Jid.hash_func, Jid.equals_func);
-            Gee.List<Message> messages = stream_interactor.get_module(MessageStorage.IDENTITY).get_messages(conversation);
-            for (int i = messages.size - 1; i > 0; i--) {
-                Message message = messages[i];
-                if (!last_conversation_messages.has_key(message.from) && message.edit_to == null) {
-                    last_conversation_messages[message.from] = message;
-                }
-            }
-            last_messages[conversation] = last_conversation_messages;
-        }
-    }
-
     private void cache_unmatched_correction(ContentItem content_item, Conversation conversation) {
         MessageItem message_item = content_item as MessageItem;
         if (message_item == null || message_item.message.edit_to == null) return;
diff --git a/libdino/src/service/message_deletion.vala b/libdino/src/service/message_deletion.vala
index 4467311e..0060a7e2 100644
--- a/libdino/src/service/message_deletion.vala
+++ b/libdino/src/service/message_deletion.vala
@@ -3,7 +3,6 @@ using Gee;
 using Xmpp;
 using Xmpp.Xep;
 using Dino.Entities;
-using Qlite;
 
 namespace Dino {
 
diff --git a/libdino/src/service/message_processor.vala b/libdino/src/service/message_processor.vala
index b9c23240..7997af67 100644
--- a/libdino/src/service/message_processor.vala
+++ b/libdino/src/service/message_processor.vala
@@ -3,7 +3,7 @@ using Gee;
 using Xmpp;
 using Xmpp.Xep;
 using Dino.Entities;
-using Qlite;
+using Dino.Qlite;
 
 namespace Dino {
 
@@ -472,12 +472,8 @@ public class MessageProcessor : StreamInteractionModule, Object {
 
         // Set an origin ID if a MUC doen't guarantee to keep IDs
         if (conversation.type_ == Conversation.Type.GROUPCHAT) {
-            Xep.Muc.Flag? flag = stream.get_flag(Xep.Muc.Flag.IDENTITY);
-            if (flag == null) {
-                message.marked = Entities.Message.Marked.UNSENT;
-                return;
-            }
-            if(!flag.has_room_feature(conversation.counterpart, Xep.Muc.Feature.STABLE_ID)) {
+            var supports_stable_ids = stream_interactor.get_module(EntityInfo.IDENTITY).has_feature_cached(conversation.account, conversation.counterpart, Xep.Muc.FEATURE_STABLE_ID);
+            if(!supports_stable_ids) {
                 UniqueStableStanzaIDs.set_origin_id(new_message, message.stanza_id);
             }
         }
diff --git a/libdino/src/service/message_storage.vala b/libdino/src/service/message_storage.vala
index d6b8d6e3..0bcbe533 100644
--- a/libdino/src/service/message_storage.vala
+++ b/libdino/src/service/message_storage.vala
@@ -1,8 +1,8 @@
 using Xmpp;
 using Gee;
-using Qlite;
 
 using Dino.Entities;
+using Dino.Qlite;
 
 namespace Dino {
 
@@ -35,41 +35,82 @@ public class MessageStorage : StreamInteractionModule, Object {
         cache_message(message, conversation);
     }
 
-    public Gee.List<Message> get_messages(Conversation conversation, int count = 50) {
-        var query = db.message.select()
+    public Message? get_last_message(Conversation conversation) {
+        Gee.List<Message> messages = get_messages(conversation, 1);
+
+        if (messages.size > 0) {
+            return messages[0];
+        }
+
+        return null;
+    }
+
+    public Message? get_last_message_by_sent_resource(Conversation conversation, string resource) {
+        RowOption row = db.message.select({db.message.id})
                 .with(db.message.account_id, "=", conversation.account.id)
                 .with(db.message.counterpart_id, "=", db.get_jid_id(conversation.counterpart))
                 .with(db.message.type_, "=", (int) Util.get_message_type_for_conversation(conversation))
+                .with(db.message.our_resource, "=", resource)
+                .with(db.message.direction, "=", Message.DIRECTION_SENT)
                 .order_by(db.message.time, "DESC")
-                .outer_join_with(db.message_occupant_id, db.message_occupant_id.message_id, db.message.id)
-                .outer_join_with(db.message_correction, db.message_correction.message_id, db.message.id)
-                .outer_join_with(db.reply, db.reply.message_id, db.message.id)
-                .limit(count);
+                .single().row();
+        return get_message_by_id_row_opt(row, conversation);
+    }
 
-        Gee.List<Message> ret = new LinkedList<Message>(Message.equals_func);
-        foreach (Row row in query) {
-            Message? message = messages_by_db_id[row[db.message.id]];
-            if (message == null) {
-                message = create_message_from_row(row, conversation);
+    public Gee.List<Message> get_messages(Conversation conversation, int count = 50, Message.Type? type = null, DateTime? before = null, DateTime? after = null, int id = 0) {
+        QueryBuilder select = db.message.select();
+
+        if (before != null) {
+            if (id > 0) {
+                select.where(@"time < ? OR (time = ? AND message.id < ?)", { before.to_unix().to_string(), before.to_unix().to_string(), id.to_string() });
+            } else {
+                select.with(db.message.id, "<", id);
             }
-            ret.insert(0, message);
+        }
+        if (after != null) {
+            if (id > 0) {
+                select.where(@"time > ? OR (time = ? AND message.id > ?)", { after.to_unix().to_string(), after.to_unix().to_string(), id.to_string() });
+            } else {
+                select.with(db.message.time, ">", (long) after.to_unix());
+            }
+            if (id > 0) {
+                select.with(db.message.id, ">", id);
+            }
+        } else {
+            select.order_by(db.message.time, "DESC");
         }
 
-        return ret;
-    }
+        select.with(db.message.counterpart_id, "=", db.get_jid_id(conversation.counterpart))
+                .with(db.message.account_id, "=", conversation.account.id)
+                .limit(count);
+        if (conversation.counterpart.resourcepart != null) {
+            select.with(db.message.counterpart_resource, "=", conversation.counterpart.resourcepart);
+        }
+        if (type != null) {
+            select.with(db.message.type_, "=", (int) type);
+        }
 
-    public Message? get_last_message(Conversation conversation) {
-        Gee.List<Message> messages = get_messages(conversation, 1);
+        select.outer_join_with(db.real_jid, db.real_jid.message_id, db.message.id);
+        select.outer_join_with(db.message_correction, db.message_correction.message_id, db.message.id);
+        select.outer_join_with(db.message_occupant_id, db.message_occupant_id.message_id, db.message.id);
+        select.outer_join_with(db.reply, db.reply.message_id, db.message.id);
 
-        if (messages.size > 0) {
-            return messages[0];
+        LinkedList<Message> ret = new LinkedList<Message>();
+        foreach (Row row in select) {
+            try {
+                Message? message = messages_by_db_id[row[db.message.id]];
+                if (message == null) {
+                    message = create_message_from_row(row, conversation);
+                }
+            } catch (InvalidJidError e) {
+                warning("Ignoring message with invalid Jid: %s", e.message);
+            }
         }
-
-        return null;
+        return ret;
     }
 
     public Gee.List<MessageItem> get_messages_before_message(Conversation? conversation, DateTime before, int id, int count = 20) {
-        Gee.List<Message> db_messages = db.get_messages(conversation.counterpart, conversation.account, Util.get_message_type_for_conversation(conversation), count, before, null, id);
+        Gee.List<Message> db_messages = get_messages(conversation, count, Util.get_message_type_for_conversation(conversation), before, null, id);
         Gee.List<MessageItem> ret = new ArrayList<MessageItem>();
         foreach (Message message in db_messages) {
             ret.add(new MessageItem(message, conversation, -1));
@@ -78,7 +119,7 @@ public class MessageStorage : StreamInteractionModule, Object {
     }
 
     public Gee.List<MessageItem> get_messages_after_message(Conversation? conversation, DateTime after, int id, int count = 20) {
-        Gee.List<Message> db_messages = db.get_messages(conversation.counterpart, conversation.account, Util.get_message_type_for_conversation(conversation), count, null, after, id);
+        Gee.List<Message> db_messages = get_messages(conversation, count, Util.get_message_type_for_conversation(conversation), null, after, id);
         Gee.List<MessageItem> ret = new ArrayList<MessageItem>();
         foreach (Message message in db_messages) {
             ret.add(new MessageItem(message, conversation, -1));
@@ -86,6 +127,11 @@ public class MessageStorage : StreamInteractionModule, Object {
         return ret;
     }
 
+    private Message? get_message_by_id_row_opt(RowOption row_option, Conversation conversation) {
+        if (!row_option.is_present()) return null;
+        return get_message_by_id(row_option[db.message.id], conversation);
+    }
+
     public Message? get_message_by_id(int id, Conversation conversation) {
         Message? message = messages_by_db_id[id];
         if (message != null) {
@@ -93,9 +139,11 @@ public class MessageStorage : StreamInteractionModule, Object {
         }
 
         RowOption row_option = db.message.select().with(db.message.id, "=", id)
+                .outer_join_with(db.real_jid, db.real_jid.message_id, db.message.id)
                 .outer_join_with(db.message_occupant_id, db.message_occupant_id.message_id, db.message.id)
                 .outer_join_with(db.message_correction, db.message_correction.message_id, db.message.id)
                 .outer_join_with(db.reply, db.reply.message_id, db.message.id)
+                .single()
                 .row();
 
         return create_message_from_row_opt(row_option, conversation);
@@ -103,9 +151,9 @@ public class MessageStorage : StreamInteractionModule, Object {
 
     public Message? get_message_by_referencing_id(string id, Conversation conversation) {
         if (conversation.type_ == Conversation.Type.CHAT) {
-            return stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_stanza_id(id, conversation);
+            return get_message_by_stanza_id(id, conversation);
         } else {
-            return stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_server_id(id, conversation);
+            return get_message_by_server_id(id, conversation);
         }
     }
 
@@ -117,15 +165,12 @@ public class MessageStorage : StreamInteractionModule, Object {
             }
         }
 
-        var query = db.message.select()
+        var query = db.message.select({db.message.id})
                 .with(db.message.account_id, "=", conversation.account.id)
                 .with(db.message.counterpart_id, "=", db.get_jid_id(conversation.counterpart))
                 .with(db.message.type_, "=", (int) Util.get_message_type_for_conversation(conversation))
                 .with(db.message.stanza_id, "=", stanza_id)
-                .order_by(db.message.time, "DESC")
-                .outer_join_with(db.message_occupant_id, db.message_occupant_id.message_id, db.message.id)
-                .outer_join_with(db.message_correction, db.message_correction.message_id, db.message.id)
-                .outer_join_with(db.reply, db.reply.message_id, db.message.id);
+                .order_by(db.message.time, "DESC");
 
         if (conversation.counterpart.resourcepart != null) {
             query.with(db.message.counterpart_resource, "=", conversation.counterpart.resourcepart);
@@ -133,7 +178,7 @@ public class MessageStorage : StreamInteractionModule, Object {
 
         RowOption row_option = query.single().row();
 
-        return create_message_from_row_opt(row_option, conversation);
+        return get_message_by_id_row_opt(row_option, conversation);
     }
 
     public Message? get_message_by_server_id(string server_id, Conversation conversation) {
@@ -144,25 +189,20 @@ public class MessageStorage : StreamInteractionModule, Object {
             }
         }
 
-        var query = db.message.select()
+        var query = db.message.select({db.message.id})
                 .with(db.message.account_id, "=", conversation.account.id)
                 .with(db.message.counterpart_id, "=", db.get_jid_id(conversation.counterpart))
                 .with(db.message.type_, "=", (int) Util.get_message_type_for_conversation(conversation))
                 .with(db.message.server_id, "=", server_id)
-                .order_by(db.message.time, "DESC")
-                .outer_join_with(db.message_occupant_id, db.message_occupant_id.message_id, db.message.id)
-                .outer_join_with(db.message_correction, db.message_correction.message_id, db.message.id)
-                .outer_join_with(db.reply, db.reply.message_id, db.message.id);
+                .order_by(db.message.time, "DESC");
 
-        if (conversation.counterpart.resourcepart == null) {
-            query.with_null(db.message.counterpart_resource);
-        } else {
+        if (conversation.counterpart.resourcepart != null) {
             query.with(db.message.counterpart_resource, "=", conversation.counterpart.resourcepart);
         }
 
         RowOption row_option = query.single().row();
 
-        return create_message_from_row_opt(row_option, conversation);
+        return get_message_by_id_row_opt(row_option, conversation);
     }
 
     private Message? create_message_from_row_opt(RowOption row_option, Conversation conversation) {
diff --git a/libdino/src/service/module_manager.vala b/libdino/src/service/module_manager.vala
index 5ba4fe80..a6efe629 100644
--- a/libdino/src/service/module_manager.vala
+++ b/libdino/src/service/module_manager.vala
@@ -69,6 +69,7 @@ public class ModuleManager {
             module_map[account].add(new Presence.Module());
             module_map[account].add(new Xmpp.MessageModule());
             module_map[account].add(new Xmpp.MessageArchiveManagement.Module());
+            module_map[account].add(new Xep.EntityCapabilities.Module());
             module_map[account].add(new Xep.MessageCarbons.Module());
             module_map[account].add(new Xep.BitsOfBinary.Module());
             module_map[account].add(new Xep.Muc.Module());
@@ -84,7 +85,7 @@ public class ModuleManager {
             module_map[account].add(new Xep.InBandRegistration.Module());
             module_map[account].add(new Xep.HttpFileUpload.Module());
             module_map[account].add(new Xep.Reactions.Module());
-            module_map[account].add(new Xep.Socks5Bytestreams.Module());
+            module_map[account].add(new Xep.Socks5Bytestreams.Module.with_local_ip_address_handler(Util.get_local_ip_addresses));
             module_map[account].add(new Xep.InBandBytestreams.Module());
             module_map[account].add(new Xep.Jingle.Module());
             module_map[account].add(new Xep.JingleSocks5Bytestreams.Module());
@@ -96,11 +97,12 @@ public class ModuleManager {
             module_map[account].add(new Xep.JingleMessageInitiation.Module());
             module_map[account].add(new Xep.OccupantIds.Module());
             module_map[account].add(new Xep.MessageRetraction.Module());
-            module_map[account].add(new Xep.JingleRawUdp.Module());
+            module_map[account].add(new Xep.JingleRawUdp.Module.with_local_ip_address_handler(Util.get_local_ip_addresses));
             module_map[account].add(new Xep.Muji.Module());
             module_map[account].add(new Xep.CallInvites.Module());
             module_map[account].add(new Xep.Coin.Module());
             module_map[account].add(new Xep.MessageDisplayedSynchronization.Module());
+            module_map[account].add(new IceUdpModule());
             initialize_account_modules(account, module_map[account]);
         }
     }
diff --git a/libdino/src/service/muc_manager.vala b/libdino/src/service/muc_manager.vala
index b47a52bf..4959074b 100644
--- a/libdino/src/service/muc_manager.vala
+++ b/libdino/src/service/muc_manager.vala
@@ -108,19 +108,11 @@ public class MucManager : StreamInteractionModule, Object {
             joined_conversation.nickname = nick;
             stream_interactor.get_module(ConversationManager.IDENTITY).start_conversation(joined_conversation);
 
-            bool can_do_affiliation_versioning = yield entity_info.has_feature(account, jid, Xmpp.Xep.MucAffiliationsVersioning.NS_URI);
-            if (!can_do_affiliation_versioning) {
-                stream.get_module(Xep.Muc.Module.IDENTITY).fetch_affiliations.begin(stream, jid.bare_jid, () => {
-                    muc_affiliations.clear_affiliations(account, jid);
-                    persist_muc_affiliations(account, jid.bare_jid);
-                });
-            }
-
             if (can_do_mam) {
                 var history_sync = stream_interactor.get_module(MessageProcessor.IDENTITY).history_sync;
                 if (conversation == null) {
                     // We never joined the conversation before, just fetch the latest MAM page
-                    yield history_sync.fetch_latest_page(account, jid.bare_jid, null, new DateTime.from_unix_utc(0), cancellable);
+                    history_sync.fetch_latest_page.begin(account, jid.bare_jid, null, new DateTime.from_unix_utc(0), cancellable);
                 } else {
                     // Fetch everything up to the last time the user actively joined
                     if (!mucs_sync_cancellables.has_key(account)) {
@@ -137,6 +129,17 @@ public class MucManager : StreamInteractionModule, Object {
                     }
                 }
             }
+
+            bool can_do_affiliation_versioning = yield entity_info.has_feature(account, jid, Xmpp.Xep.MucAffiliationsVersioning.NS_URI);
+            if (!can_do_affiliation_versioning) {
+                stream.get_module(Xep.Muc.Module.IDENTITY).fetch_affiliations.begin(stream, jid.bare_jid, () => {
+                    muc_affiliations.clear_affiliations(account, jid);
+                    persist_muc_affiliations(account, jid.bare_jid);
+                });
+            }
+
+            room_info_updated(account, jid); // EntityInfo.has_feature trigged a disco query
+
         } else if (res.muc_error != null) {
             // Join failed
             enter_errors[jid] = res.muc_error;
@@ -254,19 +257,11 @@ public class MucManager : StreamInteractionModule, Object {
     //the term `private room` is a short hand for members-only+non-anonymous rooms
     public bool is_private_room(Account account, Jid jid) {
         var entity_info = stream_interactor.get_module(EntityInfo.IDENTITY);
-        return entity_info.has_feature_offline(account, jid, "muc_membersonly") && entity_info.has_feature_offline(account, jid, "muc_nonanonymous");
+        return entity_info.has_feature_offline(account, jid, Xep.Muc.FEATURE_MEMBERS_ONLY) && entity_info.has_feature_offline(account, jid, Xep.Muc.FEATURE_NON_ANONYMOUS);
     }
 
     public bool is_moderated_room(Account account, Jid jid) {
-        XmppStream? stream = stream_interactor.get_stream(account);
-        if (stream == null) {
-            return false;
-        }
-        Xep.Muc.Flag? flag = stream.get_flag(Xep.Muc.Flag.IDENTITY);
-        if (flag == null) {
-            return false;
-        }
-        return flag.has_room_feature(jid, Xep.Muc.Feature.MODERATED);
+        return stream_interactor.get_module(EntityInfo.IDENTITY).has_feature_cached(account, jid, Xep.Muc.FEATURE_MODERATED);
     }
 
     public bool is_public_room(Account account, Jid jid) {
@@ -332,9 +327,13 @@ public class MucManager : StreamInteractionModule, Object {
     }
 
     public string? get_room_name(Account account, Jid jid) {
-        Xep.Muc.Flag? flag = get_muc_flag(account);
-        if (flag != null) {
-            return flag.get_room_name(jid);
+        var identities = stream_interactor.get_module(EntityInfo.IDENTITY).get_identities_offline(account, jid);
+        if (identities == null) return null;
+
+        foreach (var identity in identities) {
+            if (identity.category == "conference") {
+                return identity.name;
+            }
         }
         return null;
     }
@@ -471,8 +470,10 @@ public class MucManager : StreamInteractionModule, Object {
                 private_room_occupants_updated(account, muc_jid);
             }
         });
-        stream_interactor.module_manager.get_module(account, Xep.Muc.Module.IDENTITY).room_info_updated.connect( (stream, muc_jid) => {
-            room_info_updated(account, muc_jid);
+        stream_interactor.module_manager.get_module(account, Xep.Muc.Module.IDENTITY).room_info_changed.connect( (stream, muc_jid) => {
+            stream_interactor.get_module(EntityInfo.IDENTITY).get_info_result.begin(account, muc_jid, null, () => {
+                room_info_updated(account, muc_jid);
+            });
         });
         stream_interactor.module_manager.get_module(account, Xep.OccupantIds.Module.IDENTITY).received_own_occupant_id.connect( (stream, jid, occupant_id) => {
             if (!own_occupant_ids.has_key(account)) {
diff --git a/libdino/src/service/occupant_id_store.vala b/libdino/src/service/occupant_id_store.vala
index 662b9cbb..d2849652 100644
--- a/libdino/src/service/occupant_id_store.vala
+++ b/libdino/src/service/occupant_id_store.vala
@@ -1,8 +1,8 @@
 using Xmpp;
 using Gee;
-using Qlite;
 
 using Dino.Entities;
+using Dino.Qlite;
 
 namespace Dino {
 
diff --git a/libdino/src/service/reactions.vala b/libdino/src/service/reactions.vala
index 16849c68..a8df614e 100644
--- a/libdino/src/service/reactions.vala
+++ b/libdino/src/service/reactions.vala
@@ -1,9 +1,9 @@
 using Gee;
-using Qlite;
 
+using Dino.Entities;
+using Dino.Qlite;
 using Xmpp;
 using Xmpp.Xep;
-using Dino.Entities;
 
 public class Dino.Reactions : StreamInteractionModule, Object {
     public static ModuleIdentity<Reactions> IDENTITY = new ModuleIdentity<Reactions>("reactions");
@@ -296,15 +296,6 @@ public class Dino.Reactions : StreamInteractionModule, Object {
         }
     }
 
-    private Message? get_message_for_reaction(Conversation conversation, string message_id) {
-        // Query message from a specific account and counterpart. This also makes sure it's a valid reaction for the message.
-        if (conversation.type_ == Conversation.Type.CHAT) {
-            return stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_stanza_id(message_id, conversation);
-        } else {
-            return stream_interactor.get_module(MessageStorage.IDENTITY).get_message_by_server_id(message_id, conversation);
-        }
-    }
-
     private void process_reaction_for_message(int content_item_id, ReactionInfo reaction_info) {
         Account account = reaction_info.conversation.account;
         MessageStanza stanza = reaction_info.stanza;
diff --git a/libdino/src/service/replies.vala b/libdino/src/service/replies.vala
index ea10cf88..95c28ef1 100644
--- a/libdino/src/service/replies.vala
+++ b/libdino/src/service/replies.vala
@@ -1,9 +1,9 @@
 using Gee;
-using Qlite;
 
 using Xmpp;
 using Xmpp.Xep;
 using Dino.Entities;
+using Dino.Qlite;
 
 public class Dino.Replies : StreamInteractionModule, Object {
     public static ModuleIdentity<Replies> IDENTITY = new ModuleIdentity<Replies>("reply");
diff --git a/libdino/src/service/search_processor.vala b/libdino/src/service/search_processor.vala
index 2b5ebe49..aaec990a 100644
--- a/libdino/src/service/search_processor.vala
+++ b/libdino/src/service/search_processor.vala
@@ -1,8 +1,8 @@
 using Gee;
 
-using Xmpp;
-using Qlite;
 using Dino.Entities;
+using Dino.Qlite;
+using Xmpp;
 
 namespace Dino {
 
diff --git a/libdino/src/service/stateless_file_sharing.vala b/libdino/src/service/stateless_file_sharing.vala
index 15e1ddfe..6e97a5ce 100644
--- a/libdino/src/service/stateless_file_sharing.vala
+++ b/libdino/src/service/stateless_file_sharing.vala
@@ -16,11 +16,16 @@ public class Dino.StatelessFileSharing : StreamInteractionModule, Object {
         private set { }
     }
 
-    public FileManager file_manager {
+    public FileManager fm {
         owned get { return stream_interactor.get_module(FileManager.IDENTITY); }
         private set { }
     }
 
+    public FileManager2 fm2 {
+        owned get { return stream_interactor.get_module(FileManager2.IDENTITY); }
+        private set { }
+    }
+
     public Database db {
         owned get { return Application.get_default().db; }
         private set { }
@@ -30,7 +35,7 @@ public class Dino.StatelessFileSharing : StreamInteractionModule, Object {
         this.stream_interactor = stream_interactor;
         this.db = db;
 
-        stream_interactor.get_module(MessageProcessor.IDENTITY).received_pipeline.connect(new ReceivedMessageListener(this));
+        stream_interactor.get_module(MessageProcessor.IDENTITY).build_message_stanza.connect(check_add_sfs_element);
     }
 
     public static void start(StreamInteractor stream_interactor, Database db) {
@@ -38,7 +43,81 @@ public class Dino.StatelessFileSharing : StreamInteractionModule, Object {
         stream_interactor.add_module(m);
     }
 
-    public async void create_file_transfer(Conversation conversation, Message message, string? file_sharing_id, Xep.FileMetadataElement.FileMetadata metadata, Gee.List<Xep.StatelessFileSharing.Source>? sources) {
+    public async Entities.Message announce_files(FileTransferGroup file_group, Conversation conversation) {
+        Entities.Message file_share_message = stream_interactor.get_module(MessageProcessor.IDENTITY).create_out_message(null, conversation);
+        stream_interactor.get_module(MessageStorage.IDENTITY).add_message(file_share_message, conversation);
+        file_group.message_id = file_share_message.id;
+
+        foreach (var file_transfer in file_group.file_transfers) {
+            file_transfer.provider = SFS_PROVIDER_ID;
+            file_transfer.info = file_share_message.id.to_string();
+            file_transfer.file_sharing_id = Xmpp.random_uuid();
+        }
+
+        stream_interactor.get_module(MessageProcessor.IDENTITY).send_xmpp_message(file_share_message, conversation);
+
+        return file_share_message;
+    }
+
+    public async void attach_source(FileTransfer file_transfer, Conversation conversation, string http_url, string to_sfs_id) {
+        MessageStanza stanza = new MessageStanza() { to = conversation.counterpart, type_ = conversation.type_ == GROUPCHAT ? MessageStanza.TYPE_GROUPCHAT : MessageStanza.TYPE_CHAT };
+        stanza.body = http_url;
+        Xep.OutOfBandData.add_url_to_message(stanza, http_url);
+        var sources = new ArrayList<Xep.StatelessFileSharing.Source>();
+        sources.add(new Xep.StatelessFileSharing.HttpSource() { url = http_url });
+        Xep.StatelessFileSharing.set_sfs_attachment(stanza, to_sfs_id, file_transfer.file_sharing_id, sources);
+
+        var stream = stream_interactor.get_stream(conversation.account);
+        if (stream == null) throw new FileSendError.UPLOAD_FAILED("No stream");
+
+        stream.get_module(MessageModule.IDENTITY).send_message.begin(stream, stanza);
+    }
+
+    public async bool try_process_sfs(Entities.Message message, Xmpp.MessageStanza stanza, Conversation conversation) {
+        Gee.List<Xep.StatelessFileSharing.FileShare> file_shares = Xep.StatelessFileSharing.get_file_shares(stanza);
+        if (file_shares != null) {
+            // For now, only accept file shares that have at least one supported hash
+            foreach (Xep.StatelessFileSharing.FileShare file_share in file_shares) {
+                if (!Xep.CryptographicHashes.has_supported_hashes(file_share.metadata.hashes)) {
+                    return false;
+                }
+            }
+
+            if (file_shares.size > 0) {
+                var file_transfers = new ArrayList<FileTransfer>();
+                foreach (Xep.StatelessFileSharing.FileShare file_share in file_shares) {
+                    var file_transfer = yield create_incoming_file_transfer(conversation, message, file_share.id, file_share.metadata, file_share.sources);
+                    file_transfers.add(file_transfer);
+                    stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file(file_transfer);
+                }
+                var file_group = new FileTransferGroup() {
+                    message_id = message.id,
+                    file_transfers = file_transfers
+                };
+                stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file_group(file_group);
+
+                fm2.received_file_group(file_group, conversation);
+            }
+            return true;
+        }
+
+        var source_attachments = Xep.StatelessFileSharing.get_source_attachments(stanza);
+        if (source_attachments != null) {
+            foreach (var source_attachment in source_attachments) {
+                on_received_sources(stanza.from, conversation, source_attachment.to_message_id, source_attachment.to_file_transfer_id, source_attachment.sources);
+                return true;
+            }
+        }
+
+        // Don't process messages that are fallback for legacy clients
+        if (Xep.StatelessFileSharing.is_sfs_fallback_message(stanza)) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public async FileTransfer create_incoming_file_transfer(Conversation conversation, Message message, string? file_sharing_id, Xep.FileMetadataElement.FileMetadata metadata, Gee.List<Xep.StatelessFileSharing.Source>? sources) {
         FileTransfer file_transfer = new FileTransfer();
         file_transfer.file_sharing_id = file_sharing_id;
         file_transfer.account = message.account;
@@ -57,7 +136,8 @@ public class Dino.StatelessFileSharing : StreamInteractionModule, Object {
         stream_interactor.get_module(FileTransferStorage.IDENTITY).add_file(file_transfer);
 
         conversation.last_active = file_transfer.time;
-        file_manager.received_file(file_transfer, conversation);
+
+        return file_transfer;
     }
 
     public void on_received_sources(Jid from, Conversation conversation, string attach_to_message_id, string? attach_to_file_id, Gee.List<Xep.StatelessFileSharing.Source> sources) {
@@ -74,9 +154,9 @@ public class Dino.StatelessFileSharing : StreamInteractionModule, Object {
 
         // "If no <hash/> is provided or the <hash/> elements provided use unsupported algorithms, receiving clients MUST ignore
         // any attached sources from other senders and only obtain the file from the sources announced by the original sender."
-        // For now we only allow the original sender
-        if (from.equals(file_transfer.from) && Xep.CryptographicHashes.get_supported_hashes(file_transfer.hashes).is_empty) {
-            warning("Ignoring sfs source: Not from original sender or no known file hashes");
+        // For now we don't allow source attachments for file shares without hashes. TODO extend this
+        if (Xep.CryptographicHashes.get_supported_hashes(file_transfer.hashes).is_empty) {
+            warning("Ignoring sfs source: No known file hashes");
             return;
         }
 
@@ -84,85 +164,26 @@ public class Dino.StatelessFileSharing : StreamInteractionModule, Object {
             file_transfer.add_sfs_source(source);
         }
 
-        if (file_manager.is_sender_trustworthy(file_transfer, conversation) && file_transfer.state == FileTransfer.State.NOT_STARTED && file_transfer.size >= 0 && file_transfer.size < 5000000) {
-            file_manager.download_file(file_transfer);
+        if (fm2.is_sender_trustworthy(file_transfer, conversation) && file_transfer.state == FileTransfer.State.NOT_STARTED && file_transfer.size >= 0 && file_transfer.size < 5000000) {
+            fm.download_file(file_transfer);
         }
     }
 
-    /*
-    public async void create_sfs_for_legacy_transfer(FileProvider file_provider, string info, Jid from, DateTime time, DateTime local_time, Conversation conversation, FileReceiveData receive_data, FileMeta file_meta) {
-        FileTransfer file_transfer = file_manager.create_file_transfer_from_provider_incoming(file_provider, info, from, time, local_time, conversation, receive_data, file_meta);
-
-        HttpFileReceiveData? http_receive_data = receive_data as HttpFileReceiveData;
-        if (http_receive_data == null) return;
+    private void check_add_sfs_element(Entities.Message message, Xmpp.MessageStanza message_stanza, Conversation conversation) {
+        if (message.encryption != Encryption.NONE) return;
 
-        var sources = new ArrayList<Xep.StatelessFileSharing.Source>();
-        Xep.StatelessFileSharing.HttpSource source = new Xep.StatelessFileSharing.HttpSource();
-        source.url = http_receive_data.url;
-        sources.add(source);
-
-        if (file_manager.is_jid_trustworthy(from, conversation)) {
-            try {
-                file_meta = yield file_provider.get_meta_info(file_transfer, http_receive_data, file_meta);
-            } catch (Error e) {
-                warning("Http meta request failed: %s", e.message);
+        // Check if it's a FileTransferGroup
+        FileTransferGroup? file_group = stream_interactor.get_module(FileTransferStorage.IDENTITY).get_file_group_by_message_id(message.id, conversation);
+        if (file_group != null)  {
+            print("check added file group\n");
+            foreach (FileTransfer file_transfer in file_group.file_transfers) {
+                Xep.StatelessFileSharing.set_sfs_element(message_stanza, file_transfer.file_sharing_id, file_transfer.file_metadata, file_transfer.sfs_sources);
             }
-        }
 
-        var metadata = new Xep.FileMetadataElement.FileMetadata();
-        metadata.size = file_meta.size;
-        metadata.name = file_meta.file_name;
-        metadata.mime_type = file_meta.mime_type;
+            Xep.MessageProcessingHints.set_message_hint(message_stanza, Xep.MessageProcessingHints.HINT_STORE);
 
-        file_transfer.provider = SFS_PROVIDER_ID;
-        file_transfer.file_metadata = metadata;
-        file_transfer.sfs_sources = sources;
-    }
-    */
-
-    private class ReceivedMessageListener : MessageListener {
-
-        public string[] after_actions_const = new string[]{ "STORE" };
-        public override string action_group { get { return "MESSAGE_REINTERPRETING"; } }
-        public override string[] after_actions { get { return after_actions_const; } }
-
-        private StatelessFileSharing outer;
-        private StreamInteractor stream_interactor;
-
-        public ReceivedMessageListener(StatelessFileSharing outer) {
-            this.outer = outer;
-            this.stream_interactor = outer.stream_interactor;
+            return;
         }
 
-        public override async bool run(Entities.Message message, Xmpp.MessageStanza stanza, Conversation conversation) {
-            Gee.List<Xep.StatelessFileSharing.FileShare> file_shares = Xep.StatelessFileSharing.get_file_shares(stanza);
-            if (file_shares != null) {
-                // For now, only accept file shares that have at least one supported hash
-                foreach (Xep.StatelessFileSharing.FileShare file_share in file_shares) {
-                    if (!Xep.CryptographicHashes.has_supported_hashes(file_share.metadata.hashes)) {
-                        return false;
-                    }
-                }
-                foreach (Xep.StatelessFileSharing.FileShare file_share in file_shares) {
-                    outer.create_file_transfer(conversation, message, file_share.id, file_share.metadata, file_share.sources);
-                }
-                return true;
-            }
-
-            var source_attachments = Xep.StatelessFileSharing.get_source_attachments(stanza);
-            if (source_attachments != null) {
-                foreach (var source_attachment in source_attachments) {
-                    outer.on_received_sources(stanza.from, conversation, source_attachment.to_message_id, source_attachment.to_file_transfer_id, source_attachment.sources);
-                    return true;
-                }
-            }
-
-            // Don't process messages that are fallback for legacy clients
-            if (Xep.StatelessFileSharing.is_sfs_fallback_message(stanza)) {
-                return true;
-            }
-
-            return false;
-        }
     }
 }
\ No newline at end of file
diff --git a/libdino/src/service/stream_interactor.vala b/libdino/src/service/stream_interactor.vala
index 2ac13103..2cd0c45c 100644
--- a/libdino/src/service/stream_interactor.vala
+++ b/libdino/src/service/stream_interactor.vala
@@ -100,12 +100,7 @@ public class ModuleIdentity<T> : Object {
     }
 
     public T? cast(StreamInteractionModule module) {
-#if VALA_0_56_11
-        // We can't typecheck due to compiler bug
-        return (T) module;
-#else
         return module.get_type().is_a(typeof(T)) ? (T?) module : null;
-#endif
     }
 
     public bool matches(StreamInteractionModule module) {
diff --git a/libdino/src/service/util.vala b/libdino/src/service/util.vala
index e85e2005..577bc6cc 100644
--- a/libdino/src/service/util.vala
+++ b/libdino/src/service/util.vala
@@ -1,9 +1,6 @@
 using Dino.Entities;
-using Qlite;
 
-namespace Dino {
-
-public class Util {
+namespace Dino.Util {
     public static Message.Type get_message_type_for_conversation(Conversation conversation) {
         switch (conversation.type_) {
             case Conversation.Type.CHAT:
@@ -42,6 +39,12 @@ public class Util {
         }
         return false;
     }
-}
 
+    public static Gee.List<string> get_local_ip_addresses() {
+        Gee.List<string> result = new Gee.ArrayList<string>();
+        foreach (string ip_address in Nice.interfaces_get_local_ips(false)) {
+            result.add(ip_address);
+        }
+        return result;
+    }
 }
diff --git a/libdino/src/version.c.in b/libdino/src/version.c.in
new file mode 100644
index 00000000..44603c04
--- /dev/null
+++ b/libdino/src/version.c.in
@@ -0,0 +1,4 @@
+const char* dino_get_version ()
+{
+    return "@VERSION@";
+}
\ No newline at end of file
diff --git a/libdino/src/version.vala.in b/libdino/src/version.vala.in
deleted file mode 100644
index 2711d4a6..00000000
--- a/libdino/src/version.vala.in
+++ /dev/null
@@ -1,5 +0,0 @@
-namespace Dino {
-
-public const string VERSION = "%VERSION%";
-
-}