Branch data Line data Source code
1 : : /*
2 : : * UPnP XML helper routines
3 : : * Copyright (c) 2000-2003 Intel Corporation
4 : : * Copyright (c) 2006-2007 Sony Corporation
5 : : * Copyright (c) 2008-2009 Atheros Communications
6 : : * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
7 : : *
8 : : * See wps_upnp.c for more details on licensing and code history.
9 : : */
10 : :
11 : : #include "includes.h"
12 : :
13 : : #include "common.h"
14 : : #include "base64.h"
15 : : #include "http.h"
16 : : #include "upnp_xml.h"
17 : :
18 : :
19 : : /*
20 : : * XML parsing and formatting
21 : : *
22 : : * XML is a markup language based on unicode; usually (and in our case,
23 : : * always!) based on utf-8. utf-8 uses a variable number of bytes per
24 : : * character. utf-8 has the advantage that all non-ASCII unicode characters are
25 : : * represented by sequences of non-ascii (high bit set) bytes, whereas ASCII
26 : : * characters are single ascii bytes, thus we can use typical text processing.
27 : : *
28 : : * (One other interesting thing about utf-8 is that it is possible to look at
29 : : * any random byte and determine if it is the first byte of a character as
30 : : * versus a continuation byte).
31 : : *
32 : : * The base syntax of XML uses a few ASCII punctionation characters; any
33 : : * characters that would appear in the payload data are rewritten using
34 : : * sequences, e.g., & for ampersand(&) and < for left angle bracket (<).
35 : : * Five such escapes total (more can be defined but that does not apply to our
36 : : * case). Thus we can safely parse for angle brackets etc.
37 : : *
38 : : * XML describes tree structures of tagged data, with each element beginning
39 : : * with an opening tag <label> and ending with a closing tag </label> with
40 : : * matching label. (There is also a self-closing tag <label/> which is supposed
41 : : * to be equivalent to <label></label>, i.e., no payload, but we are unlikely
42 : : * to see it for our purpose).
43 : : *
44 : : * Actually the opening tags are a little more complicated because they can
45 : : * contain "attributes" after the label (delimited by ascii space or tab chars)
46 : : * of the form attribute_label="value" or attribute_label='value'; as it turns
47 : : * out we do not have to read any of these attributes, just ignore them.
48 : : *
49 : : * Labels are any sequence of chars other than space, tab, right angle bracket
50 : : * (and ?), but may have an inner structure of <namespace><colon><plain_label>.
51 : : * As it turns out, we can ignore the namespaces, in fact we can ignore the
52 : : * entire tree hierarchy, because the plain labels we are looking for will be
53 : : * unique (not in general, but for this application). We do however have to be
54 : : * careful to skip over the namespaces.
55 : : *
56 : : * In generating XML we have to be more careful, but that is easy because
57 : : * everything we do is pretty canned. The only real care to take is to escape
58 : : * any special chars in our payload.
59 : : */
60 : :
61 : : /**
62 : : * xml_next_tag - Advance to next tag
63 : : * @in: Input
64 : : * @out: OUT: start of tag just after '<'
65 : : * @out_tagname: OUT: start of name of tag, skipping namespace
66 : : * @end: OUT: one after tag
67 : : * Returns: 0 on success, 1 on failure
68 : : *
69 : : * A tag has form:
70 : : * <left angle bracket><...><right angle bracket>
71 : : * Within the angle brackets, there is an optional leading forward slash (which
72 : : * makes the tag an ending tag), then an optional leading label (followed by
73 : : * colon) and then the tag name itself.
74 : : *
75 : : * Note that angle brackets present in the original data must have been encoded
76 : : * as < and > so they will not trouble us.
77 : : */
78 : 3268 : int xml_next_tag(const char *in, const char **out,
79 : : const char **out_tagname, const char **end)
80 : : {
81 [ + + ][ + + ]: 39031 : while (*in && *in != '<')
82 : 35763 : in++;
83 [ + + ]: 3268 : if (*in != '<')
84 : 38 : return 1;
85 : 3230 : *out = ++in;
86 [ + + ]: 3230 : if (*in == '/')
87 : 1171 : in++;
88 : 3230 : *out_tagname = in; /* maybe */
89 [ + + ][ - + ]: 28954 : while (isalnum(*in) || *in == '-')
90 : 25724 : in++;
91 [ + + ]: 3230 : if (*in == ':')
92 : 495 : *out_tagname = ++in;
93 [ + - ][ + + ]: 34966 : while (*in && *in != '>')
94 : 31736 : in++;
95 [ - + ]: 3230 : if (*in != '>')
96 : 0 : return 1;
97 : 3230 : *end = ++in;
98 : 3268 : return 0;
99 : : }
100 : :
101 : :
102 : : /* xml_data_encode -- format data for xml file, escaping special characters.
103 : : *
104 : : * Note that we assume we are using utf8 both as input and as output!
105 : : * In utf8, characters may be classed as follows:
106 : : * 0xxxxxxx(2) -- 1 byte ascii char
107 : : * 11xxxxxx(2) -- 1st byte of multi-byte char w/ unicode value >= 0x80
108 : : * 110xxxxx(2) -- 1st byte of 2 byte sequence (5 payload bits here)
109 : : * 1110xxxx(2) -- 1st byte of 3 byte sequence (4 payload bits here)
110 : : * 11110xxx(2) -- 1st byte of 4 byte sequence (3 payload bits here)
111 : : * 10xxxxxx(2) -- extension byte (6 payload bits per byte)
112 : : * Some values implied by the above are however illegal because they
113 : : * do not represent unicode chars or are not the shortest encoding.
114 : : * Actually, we can almost entirely ignore the above and just do
115 : : * text processing same as for ascii text.
116 : : *
117 : : * XML is written with arbitrary unicode characters, except that five
118 : : * characters have special meaning and so must be escaped where they
119 : : * appear in payload data... which we do here.
120 : : */
121 : 74 : void xml_data_encode(struct wpabuf *buf, const char *data, int len)
122 : : {
123 : : int i;
124 [ + + ]: 1014 : for (i = 0; i < len; i++) {
125 : 940 : u8 c = ((u8 *) data)[i];
126 [ - + ]: 940 : if (c == '<') {
127 : 0 : wpabuf_put_str(buf, "<");
128 : 0 : continue;
129 : : }
130 [ - + ]: 940 : if (c == '>') {
131 : 0 : wpabuf_put_str(buf, ">");
132 : 0 : continue;
133 : : }
134 [ - + ]: 940 : if (c == '&') {
135 : 0 : wpabuf_put_str(buf, "&");
136 : 0 : continue;
137 : : }
138 [ - + ]: 940 : if (c == '\'') {
139 : 0 : wpabuf_put_str(buf, "'");
140 : 0 : continue;
141 : : }
142 [ - + ]: 940 : if (c == '"') {
143 : 0 : wpabuf_put_str(buf, """);
144 : 0 : continue;
145 : : }
146 : : /*
147 : : * We could try to represent control characters using the
148 : : * sequence: &#x; where x is replaced by a hex numeral, but not
149 : : * clear why we would do this.
150 : : */
151 : 940 : wpabuf_put_u8(buf, c);
152 : : }
153 : 74 : }
154 : :
155 : :
156 : : /* xml_add_tagged_data -- format tagged data as a new xml line.
157 : : *
158 : : * tag must not have any special chars.
159 : : * data may have special chars, which are escaped.
160 : : */
161 : 63 : void xml_add_tagged_data(struct wpabuf *buf, const char *tag, const char *data)
162 : : {
163 : 63 : wpabuf_printf(buf, "<%s>", tag);
164 : 63 : xml_data_encode(buf, data, os_strlen(data));
165 : 63 : wpabuf_printf(buf, "</%s>\n", tag);
166 : 63 : }
167 : :
168 : :
169 : : /* A POST body looks something like (per upnp spec):
170 : : * <?xml version="1.0"?>
171 : : * <s:Envelope
172 : : * xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"
173 : : * s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
174 : : * <s:Body>
175 : : * <u:actionName xmlns:u="urn:schemas-upnp-org:service:serviceType:v">
176 : : * <argumentName>in arg value</argumentName>
177 : : * other in args and their values go here, if any
178 : : * </u:actionName>
179 : : * </s:Body>
180 : : * </s:Envelope>
181 : : *
182 : : * where :
183 : : * s: might be some other namespace name followed by colon
184 : : * u: might be some other namespace name followed by colon
185 : : * actionName will be replaced according to action requested
186 : : * schema following actionName will be WFA scheme instead
187 : : * argumentName will be actual argument name
188 : : * (in arg value) will be actual argument value
189 : : */
190 : 296 : char * xml_get_first_item(const char *doc, const char *item)
191 : : {
192 : 296 : const char *match = item;
193 : 296 : int match_len = os_strlen(item);
194 : : const char *tag, *tagname, *end;
195 : : char *value;
196 : :
197 : : /*
198 : : * This is crude: ignore any possible tag name conflicts and go right
199 : : * to the first tag of this name. This should be ok for the limited
200 : : * domain of UPnP messages.
201 : : */
202 : : for (;;) {
203 [ + + ]: 3187 : if (xml_next_tag(doc, &tag, &tagname, &end))
204 : 38 : return NULL;
205 : 3149 : doc = end;
206 [ + + ][ + - ]: 3149 : if (!os_strncasecmp(tagname, match, match_len) &&
207 [ - + ]: 258 : *tag != '/' &&
208 [ # # ]: 0 : (tagname[match_len] == '>' ||
209 : 0 : !isgraph(tagname[match_len]))) {
210 : : break;
211 : : }
212 : 2891 : }
213 : 258 : end = doc;
214 [ + - ][ + + ]: 32197 : while (*end && *end != '<')
215 : 31939 : end++;
216 : 258 : value = os_zalloc(1 + (end - doc));
217 [ - + ]: 258 : if (value == NULL)
218 : 0 : return NULL;
219 : 258 : os_memcpy(value, doc, end - doc);
220 : 296 : return value;
221 : : }
222 : :
223 : :
224 : 124 : struct wpabuf * xml_get_base64_item(const char *data, const char *name,
225 : : enum http_reply_code *ret)
226 : : {
227 : : char *msg;
228 : : struct wpabuf *buf;
229 : : unsigned char *decoded;
230 : : size_t len;
231 : :
232 : 124 : msg = xml_get_first_item(data, name);
233 [ + + ]: 124 : if (msg == NULL) {
234 : 2 : *ret = UPNP_ARG_VALUE_INVALID;
235 : 2 : return NULL;
236 : : }
237 : :
238 : 122 : decoded = base64_decode((unsigned char *) msg, os_strlen(msg), &len);
239 : 122 : os_free(msg);
240 [ - + ]: 122 : if (decoded == NULL) {
241 : 0 : *ret = UPNP_OUT_OF_MEMORY;
242 : 0 : return NULL;
243 : : }
244 : :
245 : 122 : buf = wpabuf_alloc_ext_data(decoded, len);
246 [ - + ]: 122 : if (buf == NULL) {
247 : 0 : os_free(decoded);
248 : 0 : *ret = UPNP_OUT_OF_MEMORY;
249 : 0 : return NULL;
250 : : }
251 : 124 : return buf;
252 : : }
|
