1 /**
2  * httpread - Manage reading file(s) from HTTP/TCP socket
3  * Author: Ted Merrill
4  * Copyright 2008 Atheros Communications
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License version 2 as
8  * published by the Free Software Foundation.
9  *
10  * Alternatively, this software may be distributed under the terms of BSD
11  * license.
12  *
13  * See README and COPYING for more details.
14  *
15  * The files are buffered via internal callbacks from eloop, then presented to
16  * an application callback routine when completely read into memory. May also
17  * be used if no file is expected but just to get the header, including HTTP
18  * replies (e.g. HTTP/1.1 200 OK etc.).
19  *
20  * This does not attempt to be an optimally efficient implementation, but does
21  * attempt to be of reasonably small size and memory consumption; assuming that
22  * only small files are to be read. A maximum file size is provided by
23  * application and enforced.
24  *
25  * It is assumed that the application does not expect any of the following:
26  * -- transfer encoding other than chunked
27  * -- trailer fields
28  * It is assumed that, even if the other side requested that the connection be
29  * kept open, that we will close it (thus HTTP messages sent by application
30  * should have the connection closed field); this is allowed by HTTP/1.1 and
31  * simplifies things for us.
32  *
33  * Other limitations:
34  * -- HTTP header may not exceed a hard-coded size.
35  *
36  * Notes:
37  * This code would be massively simpler without some of the new features of
38  * HTTP/1.1, especially chunked data.
39  */
40 
41 #include "includes.h"
42 
43 #include "common.h"
44 #include "eloop.h"
45 #include "httpread.h"
46 
47 
48 /* Tunable parameters */
49 #define HTTPREAD_READBUF_SIZE 1024      /* read in chunks of this size */
50 #define HTTPREAD_HEADER_MAX_SIZE 4096   /* max allowed for headers */
51 #define HTTPREAD_BODYBUF_DELTA 4096     /* increase allocation by this */
52 
53 #if 0
54 /* httpread_debug -- set this global variable > 0 e.g. from debugger
55  * to enable debugs (larger numbers for more debugs)
56  * Make this a #define of 0 to eliminate the debugging code.
57  */
58 int httpread_debug = 99;
59 #else
60 #define httpread_debug 0        /* eliminates even the debugging code */
61 #endif
62 
63 
64 /* control instance -- actual definition (opaque to application)
65  */
66 struct httpread {
67 	/* information from creation */
68 	int sd;         /* descriptor of TCP socket to read from */
69 	void (*cb)(struct httpread *handle, void *cookie,
70 		    enum httpread_event e);  /* call on event */
71 	void *cookie;   /* pass to callback */
72 	int max_bytes;          /* maximum file size else abort it */
73 	int timeout_seconds;            /* 0 or total duration timeout period */
74 
75 	/* dynamically used information follows */
76 	int sd_registered;      /* nonzero if we need to unregister socket */
77 	int to_registered;      /* nonzero if we need to unregister timeout */
78 
79 	int got_hdr;            /* nonzero when header is finalized */
80 	char hdr[HTTPREAD_HEADER_MAX_SIZE+1];   /* headers stored here */
81 	int hdr_nbytes;
82 
83 	enum httpread_hdr_type hdr_type;
84 	int version;            /* 1 if we've seen 1.1 */
85 	int reply_code;         /* for type REPLY, e.g. 200 for HTTP/1.1 200 OK */
86 	int got_content_length; /* true if we know content length for sure */
87 	int content_length;     /* body length,  iff got_content_length */
88 	int chunked;            /* nonzero for chunked data */
89 	char *uri;
90 
91 	int got_body;           /* nonzero when body is finalized */
92 	char *body;
93 	int body_nbytes;
94 	int body_alloc_nbytes;  /* amount allocated */
95 
96 	int got_file;           /* here when we are done */
97 
98 	/* The following apply if data is chunked: */
99 	int in_chunk_data;      /* 0=in/at header, 1=in the data or tail*/
100 	int chunk_start;        /* offset in body of chunk hdr or data */
101 	int chunk_size;         /* data of chunk (not hdr or ending CRLF)*/
102 	int in_trailer;         /* in header fields after data (chunked only)*/
103 	enum trailer_state {
104 		trailer_line_begin = 0,
105 		trailer_empty_cr,       /* empty line + CR */
106 		trailer_nonempty,
107 		trailer_nonempty_cr,
108 	} trailer_state;
109 };
110 
111 
112 /* Check words for equality, where words consist of graphical characters
113  * delimited by whitespace
114  * Returns nonzero if "equal" doing case insensitive comparison.
115  */
116 static int word_eq(char *s1, char *s2)
117 {
118 	int c1;
119 	int c2;
120 	int end1 = 0;
121 	int end2 = 0;
122 	for (;;) {
123 		c1 = *s1++;
124 		c2 = *s2++;
125 		if (isalpha(c1) && isupper(c1))
126 			c1 = tolower(c1);
127 		if (isalpha(c2) && isupper(c2))
128 			c2 = tolower(c2);
129 		end1 = !isgraph(c1);
130 		end2 = !isgraph(c2);
131 		if (end1 || end2 || c1 != c2)
132 			break;
133 	}
134 	return end1 && end2;  /* reached end of both words? */
135 }
136 
137 
138 /* convert hex to binary
139  * Requires that c have been previously tested true with isxdigit().
140  */
141 static int hex_value(int c)
142 {
143 	if (isdigit(c))
144 		return c - '0';
145 	if (islower(c))
146 		return 10 + c - 'a';
147 	return 10 + c - 'A';
148 }
149 
150 
151 static void httpread_timeout_handler(void *eloop_data, void *user_ctx);
152 
153 /* httpread_destroy -- if h is non-NULL, clean up
154  * This must eventually be called by the application following
155  * call of the application's callback and may be called
156  * earlier if desired.
157  */
158 void httpread_destroy(struct httpread *h)
159 {
160 	if (httpread_debug >= 10)
161 		wpa_printf(MSG_DEBUG, "ENTER httpread_destroy(%p)", h);
162 	if (!h)
163 		return;
164 
165 	if (h->to_registered)
166 		eloop_cancel_timeout(httpread_timeout_handler, NULL, h);
167 	h->to_registered = 0;
168 	if (h->sd_registered)
169 		eloop_unregister_sock(h->sd, EVENT_TYPE_READ);
170 	h->sd_registered = 0;
171 	os_free(h->body);
172 	os_free(h->uri);
173 	os_memset(h, 0, sizeof(*h));  /* aid debugging */
174 	h->sd = -1;     /* aid debugging */
175 	os_free(h);
176 }
177 
178 
179 /* httpread_timeout_handler -- called on excessive total duration
180  */
181 static void httpread_timeout_handler(void *eloop_data, void *user_ctx)
182 {
183 	struct httpread *h = user_ctx;
184 	wpa_printf(MSG_DEBUG, "httpread timeout (%p)", h);
185 	h->to_registered = 0;   /* is self-cancelling */
186 	(*h->cb)(h, h->cookie, HTTPREAD_EVENT_TIMEOUT);
187 }
188 
189 
190 /* Analyze options only so far as is needed to correctly obtain the file.
191  * The application can look at the raw header to find other options.
192  */
193 static int httpread_hdr_option_analyze(
194 	struct httpread *h,
195 	char *hbp       /* pointer to current line in header buffer */
196 	)
197 {
198 	if (word_eq(hbp, "CONTENT-LENGTH:")) {
199 		while (isgraph(*hbp))
200 			hbp++;
201 		while (*hbp == ' ' || *hbp == '\t')
202 			hbp++;
203 		if (!isdigit(*hbp))
204 			return -1;
205 		h->content_length = atol(hbp);
206 		h->got_content_length = 1;
207 		return 0;
208 	}
209 	if (word_eq(hbp, "TRANSFER_ENCODING:") ||
210 	    word_eq(hbp, "TRANSFER-ENCODING:")) {
211 		while (isgraph(*hbp))
212 			hbp++;
213 		while (*hbp == ' ' || *hbp == '\t')
214 			hbp++;
215 		/* There should (?) be no encodings of interest
216 		 * other than chunked...
217 		 */
218 		if (word_eq(hbp, "CHUNKED")) {
219 			h->chunked = 1;
220 			h->in_chunk_data = 0;
221 			/* ignore possible ;<parameters> */
222 		}
223 		return 0;
224 	}
225 	/* skip anything we don't know, which is a lot */
226 	return 0;
227 }
228 
229 
230 static int httpread_hdr_analyze(struct httpread *h)
231 {
232 	char *hbp = h->hdr;      /* pointer into h->hdr */
233 	int standard_first_line = 1;
234 
235 	/* First line is special */
236 	h->hdr_type = HTTPREAD_HDR_TYPE_UNKNOWN;
237 	if (!isgraph(*hbp))
238 		goto bad;
239 	if (os_strncmp(hbp, "HTTP/", 5) == 0) {
240 		h->hdr_type = HTTPREAD_HDR_TYPE_REPLY;
241 		standard_first_line = 0;
242 		hbp += 5;
243 		if (hbp[0] == '1' && hbp[1] == '.' &&
244 		    isdigit(hbp[2]) && hbp[2] != '0')
245 			h->version = 1;
246 		while (isgraph(*hbp))
247 			hbp++;
248 		while (*hbp == ' ' || *hbp == '\t')
249 			hbp++;
250 		if (!isdigit(*hbp))
251 			goto bad;
252 		h->reply_code = atol(hbp);
253 	} else if (word_eq(hbp, "GET"))
254 		h->hdr_type = HTTPREAD_HDR_TYPE_GET;
255 	else if (word_eq(hbp, "HEAD"))
256 		h->hdr_type = HTTPREAD_HDR_TYPE_HEAD;
257 	else if (word_eq(hbp, "POST"))
258 		h->hdr_type = HTTPREAD_HDR_TYPE_POST;
259 	else if (word_eq(hbp, "PUT"))
260 		h->hdr_type = HTTPREAD_HDR_TYPE_PUT;
261 	else if (word_eq(hbp, "DELETE"))
262 		h->hdr_type = HTTPREAD_HDR_TYPE_DELETE;
263 	else if (word_eq(hbp, "TRACE"))
264 		h->hdr_type = HTTPREAD_HDR_TYPE_TRACE;
265 	else if (word_eq(hbp, "CONNECT"))
266 		h->hdr_type = HTTPREAD_HDR_TYPE_CONNECT;
267 	else if (word_eq(hbp, "NOTIFY"))
268 		h->hdr_type = HTTPREAD_HDR_TYPE_NOTIFY;
269 	else if (word_eq(hbp, "M-SEARCH"))
270 		h->hdr_type = HTTPREAD_HDR_TYPE_M_SEARCH;
271 	else if (word_eq(hbp, "M-POST"))
272 		h->hdr_type = HTTPREAD_HDR_TYPE_M_POST;
273 	else if (word_eq(hbp, "SUBSCRIBE"))
274 		h->hdr_type = HTTPREAD_HDR_TYPE_SUBSCRIBE;
275 	else if (word_eq(hbp, "UNSUBSCRIBE"))
276 		h->hdr_type = HTTPREAD_HDR_TYPE_UNSUBSCRIBE;
277 	else {
278 	}
279 
280 	if (standard_first_line) {
281 		char *rawuri;
282 		char *uri;
283 		/* skip type */
284 		while (isgraph(*hbp))
285 			hbp++;
286 		while (*hbp == ' ' || *hbp == '\t')
287 			hbp++;
288 		/* parse uri.
289 		 * Find length, allocate memory for translated
290 		 * copy, then translate by changing %<hex><hex>
291 		 * into represented value.
292 		 */
293 		rawuri = hbp;
294 		while (isgraph(*hbp))
295 			hbp++;
296 		h->uri = os_malloc((hbp - rawuri) + 1);
297 		if (h->uri == NULL)
298 			goto bad;
299 		uri = h->uri;
300 		while (rawuri < hbp) {
301 			int c = *rawuri;
302 			if (c == '%' &&
303 			    isxdigit(rawuri[1]) && isxdigit(rawuri[2])) {
304 				*uri++ = (hex_value(rawuri[1]) << 4) |
305 					hex_value(rawuri[2]);
306 				rawuri += 3;
307 			} else {
308 				*uri++ = c;
309 				rawuri++;
310 			}
311 		}
312 		*uri = 0;       /* null terminate */
313 		while (isgraph(*hbp))
314 			hbp++;
315 		while (*hbp == ' ' || *hbp == '\t')
316 			hbp++;
317 		/* get version */
318 		if (0 == strncmp(hbp, "HTTP/", 5)) {
319 			hbp += 5;
320 			if (hbp[0] == '1' && hbp[1] == '.' &&
321 			    isdigit(hbp[2]) && hbp[2] != '0')
322 				h->version = 1;
323 		}
324 	}
325 	/* skip rest of line */
326 	while (*hbp)
327 		if (*hbp++ == '\n')
328 			break;
329 
330 	/* Remainder of lines are options, in any order;
331 	 * or empty line to terminate
332 	 */
333 	for (;;) {
334 		/* Empty line to terminate */
335 		if (hbp[0] == '\n' ||
336 		    (hbp[0] == '\r' && hbp[1] == '\n'))
337 			break;
338 		if (!isgraph(*hbp))
339 			goto bad;
340 		if (httpread_hdr_option_analyze(h, hbp))
341 			goto bad;
342 		/* skip line */
343 		while (*hbp)
344 			if (*hbp++ == '\n')
345 				break;
346 	}
347 
348 	/* chunked overrides content-length always */
349 	if (h->chunked)
350 		h->got_content_length = 0;
351 
352 	/* For some types, we should not try to read a body
353 	 * This is in addition to the application determining
354 	 * that we should not read a body.
355 	 */
356 	switch (h->hdr_type) {
357 	case HTTPREAD_HDR_TYPE_REPLY:
358 		/* Some codes can have a body and some not.
359 		 * For now, just assume that any other than 200
360 		 * do not...
361 		 */
362 		if (h->reply_code != 200)
363 			h->max_bytes = 0;
364 		break;
365 	case HTTPREAD_HDR_TYPE_GET:
366 	case HTTPREAD_HDR_TYPE_HEAD:
367 		/* in practice it appears that it is assumed
368 		 * that GETs have a body length of 0... ?
369 		 */
370 		if (h->chunked == 0 && h->got_content_length == 0)
371 			h->max_bytes = 0;
372 		break;
373 	case HTTPREAD_HDR_TYPE_POST:
374 	case HTTPREAD_HDR_TYPE_PUT:
375 	case HTTPREAD_HDR_TYPE_DELETE:
376 	case HTTPREAD_HDR_TYPE_TRACE:
377 	case HTTPREAD_HDR_TYPE_CONNECT:
378 	case HTTPREAD_HDR_TYPE_NOTIFY:
379 	case HTTPREAD_HDR_TYPE_M_SEARCH:
380 	case HTTPREAD_HDR_TYPE_M_POST:
381 	case HTTPREAD_HDR_TYPE_SUBSCRIBE:
382 	case HTTPREAD_HDR_TYPE_UNSUBSCRIBE:
383 	default:
384 		break;
385 	}
386 
387 	return 0;
388 
389 bad:
390 	/* Error */
391 	return -1;
392 }
393 
394 
395 /* httpread_read_handler -- called when socket ready to read
396  *
397  * Note: any extra data we read past end of transmitted file is ignored;
398  * if we were to support keeping connections open for multiple files then
399  * this would have to be addressed.
400  */
401 static void httpread_read_handler(int sd, void *eloop_ctx, void *sock_ctx)
402 {
403 	struct httpread *h = sock_ctx;
404 	int nread;
405 	char *rbp;      /* pointer into read buffer */
406 	char *hbp;      /* pointer into header buffer */
407 	char *bbp;      /* pointer into body buffer */
408 	char readbuf[HTTPREAD_READBUF_SIZE];  /* temp use to read into */
409 
410 	if (httpread_debug >= 20)
411 		wpa_printf(MSG_DEBUG, "ENTER httpread_read_handler(%p)", h);
412 
413 	/* read some at a time, then search for the interal
414 	 * boundaries between header and data and etc.
415 	 */
416 	nread = read(h->sd, readbuf, sizeof(readbuf));
417 	if (nread < 0)
418 		goto bad;
419 	if (nread == 0) {
420 		/* end of transmission... this may be normal
421 		 * or may be an error... in some cases we can't
422 		 * tell which so we must assume it is normal then.
423 		 */
424 		if (!h->got_hdr) {
425 			/* Must at least have completed header */
426 			wpa_printf(MSG_DEBUG, "httpread premature eof(%p)", h);
427 			goto bad;
428 		}
429 		if (h->chunked || h->got_content_length) {
430 			/* Premature EOF; e.g. dropped connection */
431 			wpa_printf(MSG_DEBUG,
432 				   "httpread premature eof(%p) %d/%d",
433 				   h, h->body_nbytes,
434 				   h->content_length);
435 			goto bad;
436 		}
437 		/* No explicit length, hopefully we have all the data
438 		 * although dropped connections can cause false
439 		 * end
440 		 */
441 		if (httpread_debug >= 10)
442 			wpa_printf(MSG_DEBUG, "httpread ok eof(%p)", h);
443 			h->got_body = 1;
444 			goto got_file;
445 	}
446 	rbp = readbuf;
447 
448 	/* Header consists of text lines (terminated by both CR and LF)
449 	 * and an empty line (CR LF only).
450 	 */
451 	if (!h->got_hdr) {
452 		hbp = h->hdr + h->hdr_nbytes;
453 		/* add to headers until:
454 		 *      -- we run out of data in read buffer
455 		 *      -- or, we run out of header buffer room
456 		 *      -- or, we get double CRLF in headers
457 		 */
458 		for (;;) {
459 			if (nread == 0)
460 				goto get_more;
461 			if (h->hdr_nbytes == HTTPREAD_HEADER_MAX_SIZE) {
462 				goto bad;
463 			}
464 			*hbp++ = *rbp++;
465 			nread--;
466 			h->hdr_nbytes++;
467 			if (h->hdr_nbytes >= 4 &&
468 			    hbp[-1] == '\n' &&
469 			    hbp[-2] == '\r' &&
470 			    hbp[-3] == '\n' &&
471 			    hbp[-4] == '\r' ) {
472 				h->got_hdr = 1;
473 				*hbp = 0;       /* null terminate */
474 				break;
475 			}
476 		}
477 		/* here we've just finished reading the header */
478 		if (httpread_hdr_analyze(h)) {
479 			wpa_printf(MSG_DEBUG, "httpread bad hdr(%p)", h);
480 			goto bad;
481 		}
482 		if (h->max_bytes == 0) {
483 			if (httpread_debug >= 10)
484 				wpa_printf(MSG_DEBUG,
485 					   "httpread no body hdr end(%p)", h);
486 			goto got_file;
487 		}
488 		if (h->got_content_length && h->content_length == 0) {
489 			if (httpread_debug >= 10)
490 				wpa_printf(MSG_DEBUG,
491 					   "httpread zero content length(%p)",
492 					   h);
493 			goto got_file;
494 		}
495 	}
496 
497 	/* Certain types of requests never have data and so
498 	 * must be specially recognized.
499 	 */
500 	if (!os_strncasecmp(h->hdr, "SUBSCRIBE", 9) ||
501 	    !os_strncasecmp(h->hdr, "UNSUBSCRIBE", 11) ||
502 	    !os_strncasecmp(h->hdr, "HEAD", 4) ||
503 	    !os_strncasecmp(h->hdr, "GET", 3)) {
504 		if (!h->got_body) {
505 			if (httpread_debug >= 10)
506 				wpa_printf(MSG_DEBUG,
507 					   "httpread NO BODY for sp. type");
508 		}
509 		h->got_body = 1;
510 		goto got_file;
511 	}
512 
513 	/* Data can be just plain binary data, or if "chunked"
514 	 * consists of chunks each with a header, ending with
515 	 * an ending header.
516 	 */
517 	if (nread == 0)
518 		goto get_more;
519 	if (!h->got_body) {
520 		/* Here to get (more of) body */
521 		/* ensure we have enough room for worst case for body
522 		 * plus a null termination character
523 		 */
524 		if (h->body_alloc_nbytes < (h->body_nbytes + nread + 1)) {
525 			char *new_body;
526 			int new_alloc_nbytes;
527 
528 			if (h->body_nbytes >= h->max_bytes)
529 				goto bad;
530 			new_alloc_nbytes = h->body_alloc_nbytes +
531 				HTTPREAD_BODYBUF_DELTA;
532 			/* For content-length case, the first time
533 			 * through we allocate the whole amount
534 			 * we need.
535 			 */
536 			if (h->got_content_length &&
537 			    new_alloc_nbytes < (h->content_length + 1))
538 				new_alloc_nbytes = h->content_length + 1;
539 			if ((new_body = os_realloc(h->body, new_alloc_nbytes))
540 			    == NULL)
541 				goto bad;
542 
543 			h->body = new_body;
544 			h->body_alloc_nbytes = new_alloc_nbytes;
545 		}
546 		/* add bytes */
547 		bbp = h->body + h->body_nbytes;
548 		for (;;) {
549 			int ncopy;
550 			/* See if we need to stop */
551 			if (h->chunked && h->in_chunk_data == 0) {
552 				/* in chunk header */
553 				char *cbp = h->body + h->chunk_start;
554 				if (bbp-cbp >= 2 && bbp[-2] == '\r' &&
555 				    bbp[-1] == '\n') {
556 					/* end of chunk hdr line */
557 					/* hdr line consists solely
558 					 * of a hex numeral and CFLF
559 					 */
560 					if (!isxdigit(*cbp))
561 						goto bad;
562 					h->chunk_size = strtoul(cbp, NULL, 16);
563 					/* throw away chunk header
564 					 * so we have only real data
565 					 */
566 					h->body_nbytes = h->chunk_start;
567 					bbp = cbp;
568 					if (h->chunk_size == 0) {
569 						/* end of chunking */
570 						/* trailer follows */
571 						h->in_trailer = 1;
572 						if (httpread_debug >= 20)
573 							wpa_printf(
574 								MSG_DEBUG,
575 								"httpread end chunks(%p)", h);
576 						break;
577 					}
578 					h->in_chunk_data = 1;
579 					/* leave chunk_start alone */
580 				}
581 			} else if (h->chunked) {
582 				/* in chunk data */
583 				if ((h->body_nbytes - h->chunk_start) ==
584 				    (h->chunk_size + 2)) {
585 					/* end of chunk reached,
586 					 * new chunk starts
587 					 */
588 					/* check chunk ended w/ CRLF
589 					 * which we'll throw away
590 					 */
591 					if (bbp[-1] == '\n' &&
592 					    bbp[-2] == '\r') {
593 					} else
594 						goto bad;
595 					h->body_nbytes -= 2;
596 					bbp -= 2;
597 					h->chunk_start = h->body_nbytes;
598 					h->in_chunk_data = 0;
599 					h->chunk_size = 0; /* just in case */
600 				}
601 			} else if (h->got_content_length &&
602 				   h->body_nbytes >= h->content_length) {
603 				h->got_body = 1;
604 				if (httpread_debug >= 10)
605 					wpa_printf(
606 						MSG_DEBUG,
607 						"httpread got content(%p)", h);
608 				goto got_file;
609 			}
610 			if (nread <= 0)
611 				break;
612 			/* Now transfer. Optimize using memcpy where we can. */
613 			if (h->chunked && h->in_chunk_data) {
614 				/* copy up to remainder of chunk data
615 				 * plus the required CR+LF at end
616 				 */
617 				ncopy = (h->chunk_start + h->chunk_size + 2) -
618 					h->body_nbytes;
619 			} else if (h->chunked) {
620 				/*in chunk header -- don't optimize */
621 				*bbp++ = *rbp++;
622 				nread--;
623 				h->body_nbytes++;
624 				continue;
625 			} else if (h->got_content_length) {
626 				ncopy = h->content_length - h->body_nbytes;
627 			} else {
628 				ncopy = nread;
629 			}
630 			/* Note: should never be 0 */
631 			if (ncopy > nread)
632 				ncopy = nread;
633 			os_memcpy(bbp, rbp, ncopy);
634 			bbp += ncopy;
635 			h->body_nbytes += ncopy;
636 			rbp += ncopy;
637 			nread -= ncopy;
638 		}       /* body copy loop */
639 	}       /* !got_body */
640 	if (h->chunked && h->in_trailer) {
641 		/* If "chunked" then there is always a trailer,
642 		 * consisting of zero or more non-empty lines
643 		 * ending with CR LF and then an empty line w/ CR LF.
644 		 * We do NOT support trailers except to skip them --
645 		 * this is supported (generally) by the http spec.
646 		 */
647 		bbp = h->body + h->body_nbytes;
648 		for (;;) {
649 			int c;
650 			if (nread <= 0)
651 				break;
652 			c = *rbp++;
653 			nread--;
654 			switch (h->trailer_state) {
655 			case trailer_line_begin:
656 				if (c == '\r')
657 					h->trailer_state = trailer_empty_cr;
658 				else
659 					h->trailer_state = trailer_nonempty;
660 				break;
661 			case trailer_empty_cr:
662 				/* end empty line */
663 				if (c == '\n') {
664 					h->trailer_state = trailer_line_begin;
665 					h->in_trailer = 0;
666 					if (httpread_debug >= 10)
667 						wpa_printf(
668 							MSG_DEBUG,
669 							"httpread got content(%p)", h);
670 					h->got_body = 1;
671 					goto got_file;
672 				}
673 				h->trailer_state = trailer_nonempty;
674 				break;
675 			case trailer_nonempty:
676 				if (c == '\r')
677 					h->trailer_state = trailer_nonempty_cr;
678 				break;
679 			case trailer_nonempty_cr:
680 				if (c == '\n')
681 					h->trailer_state = trailer_line_begin;
682 				else
683 					h->trailer_state = trailer_nonempty;
684 				break;
685 			}
686 		}
687 	}
688 	goto get_more;
689 
690 bad:
691 	/* Error */
692 	wpa_printf(MSG_DEBUG, "httpread read/parse failure (%p)", h);
693 	(*h->cb)(h, h->cookie, HTTPREAD_EVENT_ERROR);
694 	return;
695 
696 get_more:
697 	return;
698 
699 got_file:
700 	if (httpread_debug >= 10)
701 		wpa_printf(MSG_DEBUG,
702 			   "httpread got file %d bytes type %d",
703 			   h->body_nbytes, h->hdr_type);
704 	/* Null terminate for convenience of some applications */
705 	if (h->body)
706 		h->body[h->body_nbytes] = 0; /* null terminate */
707 	h->got_file = 1;
708 	/* Assume that we do NOT support keeping connection alive,
709 	 * and just in case somehow we don't get destroyed right away,
710 	 * unregister now.
711 	 */
712 	if (h->sd_registered)
713 		eloop_unregister_sock(h->sd, EVENT_TYPE_READ);
714 	h->sd_registered = 0;
715 	/* The application can destroy us whenever they feel like...
716 	 * cancel timeout.
717 	 */
718 	if (h->to_registered)
719 		eloop_cancel_timeout(httpread_timeout_handler, NULL, h);
720 	h->to_registered = 0;
721 	(*h->cb)(h, h->cookie, HTTPREAD_EVENT_FILE_READY);
722 }
723 
724 
725 /* httpread_create -- start a new reading session making use of eloop.
726  * The new instance will use the socket descriptor for reading (until
727  * it gets a file and not after) but will not close the socket, even
728  * when the instance is destroyed (the application must do that).
729  * Return NULL on error.
730  *
731  * Provided that httpread_create successfully returns a handle,
732  * the callback fnc is called to handle httpread_event events.
733  * The caller should do destroy on any errors or unknown events.
734  *
735  * Pass max_bytes == 0 to not read body at all (required for e.g.
736  * reply to HEAD request).
737  */
738 struct httpread * httpread_create(
739 	int sd,	 /* descriptor of TCP socket to read from */
740 	void (*cb)(struct httpread *handle, void *cookie,
741 		   enum httpread_event e),  /* call on event */
742 	void *cookie,    /* pass to callback */
743 	int max_bytes,	  /* maximum body size else abort it */
744 	int timeout_seconds     /* 0; or total duration timeout period */
745 	)
746 {
747 	struct httpread *h = NULL;
748 
749 	h = os_zalloc(sizeof(*h));
750 	if (h == NULL)
751 		goto fail;
752 	h->sd = sd;
753 	h->cb = cb;
754 	h->cookie = cookie;
755 	h->max_bytes = max_bytes;
756 	h->timeout_seconds = timeout_seconds;
757 
758 	if (timeout_seconds > 0) {
759 		if (eloop_register_timeout(timeout_seconds, 0,
760 					   httpread_timeout_handler,
761 					   NULL, h)) {
762 			/* No way to recover (from malloc failure) */
763 			goto fail;
764 		}
765 		h->to_registered = 1;
766 	}
767 	if (eloop_register_sock(sd, EVENT_TYPE_READ, httpread_read_handler,
768 				NULL, h)) {
769 		/* No way to recover (from malloc failure) */
770 		goto fail;
771 	}
772 	h->sd_registered = 1;
773 	return h;
774 
775 fail:
776 
777 	/* Error */
778 	httpread_destroy(h);
779 	return NULL;
780 }
781 
782 
783 /* httpread_hdr_type_get -- When file is ready, returns header type. */
784 enum httpread_hdr_type httpread_hdr_type_get(struct httpread *h)
785 {
786 	return h->hdr_type;
787 }
788 
789 
790 /* httpread_uri_get -- When file is ready, uri_get returns (translated) URI
791  * or possibly NULL (which would be an error).
792  */
793 char * httpread_uri_get(struct httpread *h)
794 {
795 	return h->uri;
796 }
797 
798 
799 /* httpread_reply_code_get -- When reply is ready, returns reply code */
800 int httpread_reply_code_get(struct httpread *h)
801 {
802 	return h->reply_code;
803 }
804 
805 
806 /* httpread_length_get -- When file is ready, returns file length. */
807 int httpread_length_get(struct httpread *h)
808 {
809 	return h->body_nbytes;
810 }
811 
812 
813 /* httpread_data_get -- When file is ready, returns file content
814  * with null byte appened.
815  * Might return NULL in some error condition.
816  */
817 void * httpread_data_get(struct httpread *h)
818 {
819 	return h->body ? h->body : "";
820 }
821 
822 
823 /* httpread_hdr_get -- When file is ready, returns header content
824  * with null byte appended.
825  * Might return NULL in some error condition.
826  */
827 char * httpread_hdr_get(struct httpread *h)
828 {
829 	return h->hdr;
830 }
831 
832 
833 /* httpread_hdr_line_get -- When file is ready, returns pointer
834  * to line within header content matching the given tag
835  * (after the tag itself and any spaces/tabs).
836  *
837  * The tag should end with a colon for reliable matching.
838  *
839  * If not found, returns NULL;
840  */
841 char * httpread_hdr_line_get(struct httpread *h, const char *tag)
842 {
843 	int tag_len = os_strlen(tag);
844 	char *hdr = h->hdr;
845 	hdr = os_strchr(hdr, '\n');
846 	if (hdr == NULL)
847 		return NULL;
848 	hdr++;
849 	for (;;) {
850 		if (!os_strncasecmp(hdr, tag, tag_len)) {
851 			hdr += tag_len;
852 			while (*hdr == ' ' || *hdr == '\t')
853 				hdr++;
854 			return hdr;
855 		}
856 		hdr = os_strchr(hdr, '\n');
857 		if (hdr == NULL)
858 			return NULL;
859 		hdr++;
860 	}
861 }
862